{ "Event": { "published": true, "date": "2022-05-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-29", "timestamp": 1653868982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f32f6c9c-2551-40cf-a394-7e6b9fac4754", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bba232b-df99-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653861003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861003, "uuid": "24357d4b-e37a-4824-acd8-1d530958ceaa", "comment": "Malware payload (Mirai)", "value": "673dfb41b3c55eab871fa6fec54a3e20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861003, "uuid": "01bf09e7-4aaa-42b2-8891-dce456958880", "comment": "Malware payload (Mirai)", "value": "00cdf6a02e6ba497973f469a4735b7d5818db928de678d572df7a0a1eb2e014e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861003, "uuid": "8b4bab2e-ab02-4ad4-8a09-81533075f4ad", "comment": "Malware payload (Mirai)", "value": "7d8c4b738c6500b018c91b6c689f746620863ed4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861003, "uuid": "ce9234f5-e4b4-437e-bbf1-a7019cfcbc9b", "comment": "Malware payload (Mirai)", "value": "ac8528875ba800ffb59adc361f795a5a81f013513fb34e224820b9254c3d95a106b69393e4dd8154ca17bb8903f8b904", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861003, "uuid": "1f280411-d50b-4fd1-9350-27f9c6bfb5aa", "value": "T192E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861003, "uuid": "5ec79666-afde-43f2-87ab-8d192e9e3fdb", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvkPhLZ85iBMR6yoC1Q8:walgM69pe0QmlTvI8t9mrsplDKZUQQB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653861003, "uuid": "cb5c4a07-7941-4230-a44f-de956d948b96", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653861003, "uuid": "91cdacf6-19c8-4cee-97d5-06c9b5d44ac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861003, "uuid": "8af7806f-0448-46fc-b993-3f925d3c86b5", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3055cc-df62-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1653837680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653837680, "uuid": "e1ca7302-64c0-474b-8143-c18362195f91", "comment": "Malware payload (NanoCore)", "value": "29d4c91fa142a2f3c2ec6003a1daa7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653837680, "uuid": "e132040a-7caa-45e6-8966-78644b2ea275", "comment": "Malware payload (NanoCore)", "value": "00fe7d7101fdda1828cba75767e016a5962f71db807e07e5d0d9d171457f57ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653837680, "uuid": "d1988f80-7012-4ffc-a9dd-d41710e430cf", "comment": "Malware payload (NanoCore)", "value": "ef892fdbf8f58c4ca2f61d3e6704bcd179a3199a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653837680, "uuid": "1e8b47b4-ca8b-405d-bacc-d03f6ca9b559", "comment": "Malware payload (NanoCore)", "value": "f4a3479a97e27825465dbbb842357a3496ed7e558b2f460f5a486f1178a23b6fa9944411b26f71758b2ee43e52531ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653837680, "uuid": "99914222-1774-4309-9747-4dd6246ac7fd", "value": "T16714CF5637A8493FE2DE8678602242539379C2E3E8D3F3EE28D855B75B127E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653837680, "uuid": "07563579-3d04-4e59-8cca-4956823a5223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653837680, "uuid": "94da04d0-5200-4ffb-b9dd-7efa87626c1b", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIo8skdn+BJCnryIwzt4LLOcsx:gLV6Bta6dtJmakIM5SskxrgztsLPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653837680, "uuid": "2dbe6831-3c3e-43b4-9792-22be78ffc434", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653837680, "uuid": "8c9ce1f1-350e-42fa-9dc2-ec43faf5e763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653837680, "uuid": "a99116fa-99f9-402c-b872-dedfe4b652e1", "value": "00FE7D7101FDDA1828CBA75767E016A5962F71DB807E0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812f6ea5-df50-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653829739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829739, "uuid": "0d5fcef4-1ef8-4679-8309-a939af8af09d", "comment": "Malware payload (Smoke Loader)", "value": "ad3da1085dcc63075ce74790ee028070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829739, "uuid": "46d72d33-65eb-4604-bd3e-d7e3d38b3258", "comment": "Malware payload (Smoke Loader)", "value": "01c16eabaab034fa6db30583f9fd82af4a4fc121e7f0532a5deecf8b5b83917d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829739, "uuid": "77e462bd-8fbf-414b-863b-ab20d2743dd6", "comment": "Malware payload (Smoke Loader)", "value": "55ded11adca16dc1ff9b7489dd0d3cba27570cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829739, "uuid": "d1e82561-aa86-46ee-9ff7-99ee319157d3", "comment": "Malware payload (Smoke Loader)", "value": "29d2f9954eead4b87d81c58c8499eb89b2911c10c195b6d44643ac381ce0ce4b3af4e8234f879d8af45b74ec4a203592", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829739, "uuid": "a07aadc8-25b5-42d5-bbfb-1207e217de74", "value": "T130238D423FA4E2D0DD960A3064638B325F32FD76AAD18B6B37E5B12F9C33351652605E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829739, "uuid": "4c4bba6d-6a09-423c-a656-7279537ab906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829739, "uuid": "eec5bb45-174b-4553-aa26-f2797baaf437", "value": "768:1QVbGbrNdawLXaIkjkqkhUZZZ3DIrd7RibEVglbAC6ids80p9E+8iROn0W:e1GbrNnujkqkSZZZ3gdtibEVglbACfTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829739, "uuid": "0a32d88a-c957-4b0c-ae73-ccf92c876ee1", "value": 45848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829739, "uuid": "a94aaafb-ab2f-4474-804b-9c34b69353cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829739, "uuid": "30298eb3-7184-4631-8aba-803160d0c51e", "value": "ad3da1085dcc63075ce74790ee028070.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fd5ada-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799824, "uuid": "27675909-f2f7-4c32-8fd6-293401c650e6", "comment": "Malware payload (Mirai)", "value": "c63c307b57433de93d9e975b2dfafdbd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799824, "uuid": "3efdf000-1a44-4bd6-a938-1a9f655c28c5", "comment": "Malware payload (Mirai)", "value": "03e1f304077e02e105baee280100936184f0083018fd4a6db4c7dad538029740", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799824, "uuid": "c47ae37b-e15b-4b8e-a7ed-5232d7b53122", "comment": "Malware payload (Mirai)", "value": "fa9c375d752755db3713f0ff2aad8a8696b1a8a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799824, "uuid": "3ce98f24-a48b-47c5-9fee-0d1dd495809d", "comment": "Malware payload (Mirai)", "value": "0929384977d91a42b7dc77789a419a7bdfd7783f7728cec9ce7d6a60756ec849ad99aaf4c13de2bddce70587ab5c11b8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799824, "uuid": "212973e4-0255-49aa-9a4a-4f3907cf0e31", "value": "T198432985BC92DA06C9D823B7F62E11CE372263A9E1DF3207DD126F11778A92F0D67542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799824, "uuid": "a374f0a5-06f3-418b-8706-5ad11bf8db7d", "value": "768:70oL7tI6A2RoJYNvkS0H4NsENyITHSbMcsoCBy0n3g3BNOL9yNLCMXHHHSEt:1LRI6vRo+NvkS0H+brSIcKk0n79T0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799824, "uuid": "dc570a27-3974-4cef-8e38-2f56c4339a60", "value": 56916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799824, "uuid": "9eea0026-47f8-49bc-9867-8fe1e0fce4dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799824, "uuid": "99c92ac3-8c32-4828-853a-761e7971c05e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9b7c6e-def5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653790832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653790832, "uuid": "6bf1bd20-d62b-40dc-8d6d-07a8facb8449", "comment": "Malware payload (AgentTesla)", "value": "97fe602dd763d9b8b579b3df413b09dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653790832, "uuid": "372c9ec7-205b-4738-8fe8-a058f2634e4e", "comment": "Malware payload (AgentTesla)", "value": "0485780dcb1eb6a50a1c02bfbacad41f6402d50b3cdd61b98271f673d736e98b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653790832, "uuid": "b58bb3b7-6750-4f60-a490-92178e3ceea3", "comment": "Malware payload (AgentTesla)", "value": "27ff2b2a86cfdc20e3203b481fefd0e5f4dead98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653790832, "uuid": "677bbd99-dab5-4232-af29-a19c03db1a6a", "comment": "Malware payload (AgentTesla)", "value": "76fcf16f18004de6fc078c84abdfc51919e18bff3f0a70f2693d66fe5242d4e8b2e222d212a29e658da35b7de0a3cc87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653790832, "uuid": "bbbb374a-cf95-444c-bf9a-6cef23b45125", "value": "T1E4D4E090A363EF76F1287373B16090082B655A2ED0D4C57A9B9CB0CE75A2B461DF6F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653790832, "uuid": "af0986ed-8bfa-45e3-8414-8e0b85cd0f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653790832, "uuid": "c614d8ab-0c81-4b05-9e10-14794447c5d3", "value": "12288:JoQNz5avnV4hvOxn3RopZMOxucZiGIHEbc0Mw7q7d/lkXjIbHo:J9dCqdbwwoUjIbHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653790832, "uuid": "063a10f5-2134-4bb5-a407-634c35a756f5", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653790832, "uuid": "17b3b761-0a8f-432b-b676-78d7d21255af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653790832, "uuid": "939fad73-5f50-490d-bdb7-b56368396df0", "value": "print_po_004780_220529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d1bff1-df77-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653846659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653846659, "uuid": "a39ab945-1097-4341-beda-32440e27e792", "comment": "Malware payload (RedLineStealer)", "value": "71afbdf7e93d38c9bfe5c58c0a7e519b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653846659, "uuid": "cc86bbb8-a5a8-4c05-b437-bdf462d67686", "comment": "Malware payload (RedLineStealer)", "value": "05d57f5a9de385039f7c3b130325595f176d7181e205681b22a1ad9e4f46951b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653846659, "uuid": "1f33021b-8607-42f2-ac55-488367646fff", "comment": "Malware payload (RedLineStealer)", "value": "a80a2b215c4c22074a44edcf198419fadbdc1757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653846659, "uuid": "3caec826-5c71-45ca-b36f-c6ac8e412e8e", "comment": "Malware payload (RedLineStealer)", "value": "c0908ba71c2b6bebd6c9ac5a1398509ceb5547e774c533dcb59b034a869fcc21b9cebe07bf3467f06b65339c4b668297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653846659, "uuid": "edd4e3e2-e361-4cff-b6e6-d5dd0d42f5b8", "value": "T1C0A34C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4EA1F67B42592AEF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653846659, "uuid": "994515f5-5da9-4fdc-9420-2739266f6200", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653846659, "uuid": "cae158a4-e5bd-48a8-a0c7-c7dd4dc9c1b1", "value": "1536:d907dzp8rglbG6jejoigIuyYLB3UicrMFW08UAiqumbfcxv0ujXyyed1ztmulgSe:A9pCwYuciRWjUA57C0ujyzdiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653846659, "uuid": "d8a1fd26-4913-4362-a87d-78f3925f136c", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653846659, "uuid": "72bdaf1c-e4b1-459a-8abf-088844bc2e55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653846659, "uuid": "a405eeb1-8c0b-4812-875e-0b1319f2af43", "value": "05D57F5A9DE385039F7C3B130325595F176D7181E2056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581d7a3c-df05-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653797458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653797458, "uuid": "a451761d-3eaa-4382-b838-f0c383f6e04a", "comment": "Malware payload (Amadey)", "value": "ab64ce255c59a0421a942829d374586d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653797458, "uuid": "8a8731ef-6c41-46e3-974c-dc04be25e4ae", "comment": "Malware payload (Amadey)", "value": "0c2904ecd4b19029cf744748d94fc2eab2292b46fafda9956e0e24e2e5dda191", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653797458, "uuid": "3bc94ad6-3926-46c0-b434-b8c755647544", "comment": "Malware payload (Amadey)", "value": "f8a1cc2335775fb18971877a35780399a52e61be", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653797458, "uuid": "5cdd0dd4-bb21-4299-aa6e-94c204d8354a", "comment": "Malware payload (Amadey)", "value": "979ef8fb2267bf456fc92790cc11cd5f785b7bc154e10f6bf1f09ed858a481352a33911fee9fa2c57a85a54e1b96e2f6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653797458, "uuid": "723832e3-7d49-410b-8651-0d477127b411", "value": "T159D5232D3B31BF33D16129FDAA70D8F6ACEBEB674D47451E60882F254AA1479049708F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653797458, "uuid": "e1b6cfa0-e6cb-4aa5-bd6d-f2efb88b4f33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653797458, "uuid": "28dd434f-9aec-40c2-8f2a-318bd7774c47", "value": "49152:yiXBNn4M5o0jOaiEAdpR3I+hsURGLx3UeO0ZNhSJ177QqdH:pjn9o9aiEf+hJGLxk4hSJ17M2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653797458, "uuid": "181a9448-dba0-4f28-9433-3b8514039953", "value": 2874368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653797458, "uuid": "03078a19-2d7c-478f-942e-e2401ccc26e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653797458, "uuid": "9948af54-3ef9-4b94-a621-527239d1c5a1", "value": "ab64ce255c59a0421a942829d374586d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3abf58-def8-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1653792150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653792150, "uuid": "f3cdf6b3-b6f0-4b64-9eab-e0e7ec5a6e4e", "comment": "Malware payload (GuLoader)", "value": "e2612e9171f79c3234d149efcb302cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653792150, "uuid": "d64c2771-699e-4622-9ccc-1f1192b7904b", "comment": "Malware payload (GuLoader)", "value": "0d66963f740bff50acc41caab4a86629f168b38293d6c05774e0e4db617c046d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653792150, "uuid": "f5703060-d307-4ad6-80bf-e8cd7fce5d7a", "comment": "Malware payload (GuLoader)", "value": "9148a619a45696ecd09eaca52d6d281a2891f327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653792150, "uuid": "71d2e313-77bf-4e62-b8a6-0daf82e8bf34", "comment": "Malware payload (GuLoader)", "value": "c12b8d570e87c85da046dca45f0c27094cf8ccee6c9312cc733787497d144947d74a0c28046e35700c014ad60ec09988", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653792150, "uuid": "011efaed-686f-46fb-bb3a-b759697d4a31", "value": "T1ACD4F155FAC8ECABC016517C5475AB6266D3FE2518358A03173A7E2FF732293343B819", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653792150, "uuid": "f334d401-527f-49f8-b12a-10cbc4d8f69f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653792150, "uuid": "4c73340e-5db6-4a34-819e-a8eb1b0a2fe5", "value": "12288:5bspF04asBQ9a9jXbgO1xzSs9IKTQWfsmuYU4:5bsLDasj0k9IKTQWkmuZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653792150, "uuid": "8d150993-c30e-4191-924e-1484491f3288", "value": 608822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653792150, "uuid": "1c9ac395-e13a-42e4-838d-dd4087b369b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653792150, "uuid": "b3932c5b-c5eb-438c-8eab-255ec9f4b324", "value": "Proof of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9963e7-df5c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653835025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835025, "uuid": "11f11577-c25d-4441-b07e-0e2808a84134", "comment": "Malware payload (AveMariaRAT)", "value": "8b766d5b8815e267c1e36a89b5723ba8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835025, "uuid": "f75e6eee-fb50-4cf9-8269-4fc3bd72a0e6", "comment": "Malware payload (AveMariaRAT)", "value": "0e8fe8321d3ae4c7edcf58b0048285b630e63c3a1ee17222349cfe32c1b46293", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835025, "uuid": "0cd56f6f-955b-45a6-9046-b78cf0d603e7", "comment": "Malware payload (AveMariaRAT)", "value": "15459ddc310aeaced84f747b37b254494ac7653f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835025, "uuid": "47036b5e-5fe9-42d5-9c4c-e63f293b09df", "comment": "Malware payload (AveMariaRAT)", "value": "80ce1ae01387e04645da2a62fadf6c8f874a3122111c0c464452d748858df7a8e30d85466281e972a0b0dbebc9091833", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835025, "uuid": "2f1eb0a2-5eb6-483e-abfe-c9f7d49afc41", "value": "T12BC4F12C7AE1EE02C51426F6C1D385A443F199DBBA72D3D72D8911C21E42BD49DCABCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835025, "uuid": "2f9e8da7-b284-476f-8785-f2a0cd49636b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835025, "uuid": "a93a7ff1-a8c8-4575-acde-aec5b3f652f3", "value": "12288:aVbFe7VmCeqH7tkkdLyGn8Gp2kIg02pHH2Xk5Fvm:arSVvNb2M+Gn8GRVWXmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835025, "uuid": "a9813dec-9ca5-4a0b-91f0-5d43e24b1338", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835025, "uuid": "f15d8563-5f63-46ad-8b1e-66d2f69583b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835025, "uuid": "842a415f-94c2-47cf-bdc6-1f2dc6ec5041", "value": "SecuriteInfo.com.W32.AIDetectNet.01.16368.24515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766d329a-df94-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653858927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858927, "uuid": "d0a987bf-dc4f-4e54-a31e-f8f0d9f0a58f", "comment": "Malware payload (Amadey)", "value": "ad1d233f8ba7df222746285cf827440f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858927, "uuid": "eb86e312-704b-4153-97bf-b834ad1a1bcb", "comment": "Malware payload (Amadey)", "value": "1092843eeab5d8d15a58211a45b65a568e52842fce63aef32e46b87e159bd935", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858927, "uuid": "89fee1e7-55ae-48a4-ac4f-a84fbeb25a23", "comment": "Malware payload (Amadey)", "value": "73479ae4db5502b1c36936ec10a31193fde47f47", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858927, "uuid": "a3ce32e9-00dc-4f0a-8511-1b5ee1aa6871", "comment": "Malware payload (Amadey)", "value": "24863e0179f48dca521c25c4651373e7d978beb7b6e7cb9ac140038ba4bab1f69caaef27cc957db017f3ae65abfcde4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858927, "uuid": "feccc970-3168-4fd6-aa5f-e6a360260dc1", "value": "T1BCD523ADBA22958BEB591038518ECA0B3737781E190F4FC4ECD20D9119DE5B8D513FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858927, "uuid": "b79dd007-a739-486e-a10a-f23b16a2d8c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858927, "uuid": "ae1c6cd4-d103-4320-8085-d0440c0881cc", "value": "49152:kc2eq+b8nGv8owO1fWPhdBA68H/um2Ib7uwZR0Ov2px9BO:kc/qVnGv8HkKULn0/v9BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653858927, "uuid": "ac407728-8658-4e94-9ef9-7da2dfd7335b", "value": 2869760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653858927, "uuid": "95a4000c-3f0d-4cf9-8e9f-2f59cd92b108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858927, "uuid": "4508121f-2d52-4655-89a5-cb4431adcd10", "value": "ad1d233f8ba7df222746285cf827440f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90d9456-df91-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653857831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857831, "uuid": "f395de88-1d85-4063-b0fd-bf833900661a", "comment": "Malware payload (RedLineStealer)", "value": "60a0c40ccd86968b550cfc34927638b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857831, "uuid": "45676ba9-cbad-4cef-978f-0756ddfa1882", "comment": "Malware payload (RedLineStealer)", "value": "121873343a2752cdfce8f990986da1fd6e05883b44e62bfd0639a7508c58e387", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857831, "uuid": "526beff0-e6c7-4e0d-92bd-974d3ac474ea", "comment": "Malware payload (RedLineStealer)", "value": "d904118a4d9e4bef0316927922872ca1cc53ec8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857831, "uuid": "31ef0710-fc1d-47fd-bacf-b3d5f2f80c90", "comment": "Malware payload (RedLineStealer)", "value": "a18889cc46705bea840144fa7b240f17117e31211c9dae17287dce6c53fdbdd5f362b73594384edd7235cfe53ffd4b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857831, "uuid": "d7ef838b-ed41-4630-888b-e5a44971da38", "value": "T1F094AE107A50E037F5B71AF4497583A8B92ABDA19B2471CB62D97AEE563C6D0FC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857831, "uuid": "19a813c2-e16b-45c6-8127-cc054db96efe", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857831, "uuid": "75f517e7-f0fb-4a9b-afe5-3e3f709a05f5", "value": "6144:ACaIuycdLUplIx31UDlVZbCtcWUyrs1cooX6cE7U/AsuuXTezCliao00//a:laI+LUgJ1UDfZbZWWxFo/g8gAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653857831, "uuid": "4ea2d845-2dd2-4f11-b21f-67dec60e22bd", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653857831, "uuid": "41fd3603-383a-46aa-af71-ed6e2db2e741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857831, "uuid": "e731d288-8f15-4611-854a-92417a1785fa", "value": "60a0c40ccd86968b550cfc34927638b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2b8b88-df5b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653834563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834563, "uuid": "ace1ab53-c18f-436b-b657-cfd1d8a95f42", "comment": "Malware payload (Mirai)", "value": "73ee3be952293a202887119e894c9519", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834563, "uuid": "d4fdd838-a931-44ce-a8f3-32136e896c6f", "comment": "Malware payload (Mirai)", "value": "13129021bd9b9ed405f9c133101f4c03079aa03883f8faf1f80626bcd466e2e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834563, "uuid": "082301b0-6610-4034-a1dd-b39cfe51a356", "comment": "Malware payload (Mirai)", "value": "a903008372390b682b2b9e7bc47758af7471bf8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834563, "uuid": "059d3200-5e7e-464b-9a48-9f9ecbf4e431", "comment": "Malware payload (Mirai)", "value": "f9757bb26b3a4fa4cb2ebf4f358eeb0e5d3c3db8c108696b31442eed8257d52565daf0e2c4acf9d303a06a4303934fc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834563, "uuid": "5f5a7c98-6949-4f87-9e0b-e9459db078ef", "value": "T19BA2D122E9C6DDE0D3300879EF7C458637A7DEBCD0ED9166225146254AA148B26FCB1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834563, "uuid": "44d911eb-dca8-46f1-a166-b2ebd4baa7b3", "value": "384:AVpe+PuK+295jGDEG2f06e47JGC1n8cpWifHZ0fHAjiTGsiYtgu1YhymdGUop5h6:Ok0s29pmw3wCt8cpWiRPjiSsSoYs3Uo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834563, "uuid": "399d6795-373b-461e-8c32-49bb588a8ec8", "value": 22304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834563, "uuid": "da17b358-ace2-43b6-97bc-fa7aa84cf2be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834563, "uuid": "a2420726-8007-4d2d-bcc2-dd1564806622", "value": "73ee3be952293a202887119e894c9519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d652297-df21-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653809359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809359, "uuid": "975be202-f7f9-417a-81c3-5896508e6e59", "comment": "Malware payload (Smoke Loader)", "value": "034be5a6b999678cddba05e58cc436f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809359, "uuid": "d88fc3fb-d806-47e1-ae21-fd69229a8940", "comment": "Malware payload (Smoke Loader)", "value": "14910cbfb55d39bec4f5f6e43110388cfb23a10f94e0df456bd054bf491fda86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809359, "uuid": "8723edc2-6ba6-446c-b9d1-19d57152b823", "comment": "Malware payload (Smoke Loader)", "value": "0b2cd5a84831163006500045b9a6ae3a3eac8cc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809359, "uuid": "17080ea3-0d76-476b-a730-60a6e846f2a1", "comment": "Malware payload (Smoke Loader)", "value": "2e256e8826b668fa6de2e0aa0de360e5fde0cbd5adc7bc6a8c8efdab896d71fac11983743211a54016a6d300bbf6261f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809359, "uuid": "53ac77d8-bde8-42ea-8266-95956b1ad803", "value": "T10725BF22ADB148F6D177167C4DFB52DB58377D002AE898CE6BF41F884E386813B16297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809359, "uuid": "59904882-d2d3-42bc-b394-95529df2d30e", "value": "c294bc02a6388059f400574db0223013", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809359, "uuid": "47d5000c-43d0-4446-b6e6-a75f1d47ea26", "value": "12288:sc72DXGvolWWiKIYJ5N38cklUNb9lRUoa7s5/i/aL9LGbHGkAHiDgiggOsbgD2:R7MXGzWiKtffbFaq6ThXggz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653809359, "uuid": "37a353df-1379-49d6-949a-90505981ac3a", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653809359, "uuid": "1c5ba3d0-d6ff-4e07-8bbc-cbc392f80724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809359, "uuid": "98cb984a-bc42-4b7e-963a-8c7a79b5cc41", "value": "034be5a6b999678cddba05e58cc436f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ee851-df99-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653861004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861004, "uuid": "b620a021-a0ee-427c-b778-c3a8492869fd", "comment": "Malware payload (Mirai)", "value": "99a11dc8dafea4a3fdcc3a75cdb3aa0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861004, "uuid": "9ba12ae8-c675-44d1-9b48-9c06f4468aac", "comment": "Malware payload (Mirai)", "value": "14c1a0c4fcb4cc4204fc19e9c618e09e199c9b579b6b0341322974d91207b124", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861004, "uuid": "6ce43ebd-611d-4e3f-9e86-585206130908", "comment": "Malware payload (Mirai)", "value": "6faaf3499d3472a8ee576a23c7775c80ef0fedca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861004, "uuid": "a7f96328-0f6a-49fc-aec1-aa15b775a889", "comment": "Malware payload (Mirai)", "value": "eaa346890ce5d82c8145aae6a5340a88bd9df90678bcdfaccad6ca77da86d78824cfb6518682c9242ce172013d969f2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861004, "uuid": "542f2252-7d64-405a-be0f-2c852d3e9d43", "value": "T1265329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861004, "uuid": "48c7a35e-fdfc-45dd-81cc-cdad10e82620", "value": "1536:IoRC9170vwHbQXZ5+qXDEuX890dSW7V/DjObeFt6PuQ4Zg:PC917iwHbQXZ5+qXAX94SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653861004, "uuid": "70054d3d-a6bb-4a82-83e9-a1b940ffc1d2", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653861004, "uuid": "9e3bf0f1-f5ec-40a8-a49a-30809e5aa2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861004, "uuid": "a1d72f83-41aa-4581-a792-a3d57852de3f", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f500b3e-df1a-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653806356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806356, "uuid": "03d0ba51-b455-471c-bb84-3eb9cb0cced4", "comment": "Malware payload (RedLineStealer)", "value": "aa846c9614b8638cd4c45c5c8ccf0b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806356, "uuid": "4ce74c97-f876-41a3-b9cd-9af643da3bc0", "comment": "Malware payload (RedLineStealer)", "value": "15137e51de6b1766adcbc628bc24d5931fbbffa22a8f237d0331946eeb263e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806356, "uuid": "7438f0c8-9fe1-4650-a90b-54d6d945a6b9", "comment": "Malware payload (RedLineStealer)", "value": "bb469090fe49d8882d6748940e36380125a8ce50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806356, "uuid": "61612f3f-e6fb-479f-9bcf-3d5773f93a20", "comment": "Malware payload (RedLineStealer)", "value": "684a6452215f3311c8472651035dbaea9062883d0210070842863375cab9115a1c821ec27a0f44dfad9bacc21ebd2db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806356, "uuid": "044d93bc-bb9e-489a-a9d4-0804b65296b5", "value": "T16EE26C877BA48207ED9B8D7184E655331E70FF8599A1F65E2099F2134DA238233A7D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806356, "uuid": "62bcab73-4e24-4ef6-8a9d-f9517f4a90ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806356, "uuid": "304d4f32-a4c6-4be3-8912-70508ab93c2d", "value": "384:QjOSe83JbeoJXPBQLQEMpDPni0e4g5lnYPLO+fGfZOPLN+fGfZ7p4p23+r/jLSP:jS95b2ME8+0edle0EY07p4p23+zjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806356, "uuid": "13dd3011-f2b2-40c4-b9c4-d3708478588f", "value": 32592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806356, "uuid": "94401d2b-5a8c-4e4b-a698-9221e34da59b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806356, "uuid": "9da76465-0f22-47f4-9749-6dc16cd7dcbb", "value": "aa846c9614b8638cd4c45c5c8ccf0b7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31f8c4f-deee-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1653787840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787840, "uuid": "7b666783-d20f-4a3a-a9ff-253a549bb541", "comment": "Malware payload (Gafgyt)", "value": "f860939056c761a2f337177f50eee072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787840, "uuid": "abe58f74-0bba-41a2-ae6f-00215616a64d", "comment": "Malware payload (Gafgyt)", "value": "1604f0ab1f506a83d9ad14f9cc75a28cd16f6b245cd5d2e2e942685f553006db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787840, "uuid": "7ac06be3-cf3f-4bf9-a234-f3918ad00c5b", "comment": "Malware payload (Gafgyt)", "value": "e477f360c13d93280ee3e1e3828291d9287a92ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787840, "uuid": "3980898d-5da5-4da0-9447-bfb58727f9ce", "comment": "Malware payload (Gafgyt)", "value": "d9cf4224a96f5336412a84efee402d2839f468a777bee28112932ad6fa6fe17715057041e9d3923a5bea6b840381ee36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787840, "uuid": "8aed5d07-5642-4a16-9186-4f6cae9378a5", "value": "T177D33B46FA418A13C1D51B76FAAF414A3322D794D3DB330699186FF43F87A6E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787840, "uuid": "913fd2bc-4523-4494-a0e7-6987b982011a", "value": "3072:r2reAOfIRZZoOza8DC4ROa0yPTrb0o8M/9kGNnIa:r2xOfIRE/8DC4ROXy/b0nM/9kgnIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653787840, "uuid": "77b1f58c-0bc0-431b-9ea3-767d503edcee", "value": 142105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653787840, "uuid": "e26d0e36-c7df-4b05-9526-275191364140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787840, "uuid": "7a1273f3-9efc-49f6-be0b-467eb252b3b4", "value": "f860939056c761a2f337177f50eee072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47803d13-deed-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1653787122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787122, "uuid": "710d1018-9538-4419-92c5-7250b5dd9fcf", "comment": "Malware payload (Formbook)", "value": "01a52be812f172b91eace459ba95c6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787122, "uuid": "dbf7b2c3-ab90-440d-a34c-717b648b5775", "comment": "Malware payload (Formbook)", "value": "16a81a265cea156034bea5db891d480535cf697bdd8c8917fc6d994c33ddfdf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787122, "uuid": "8634249e-517b-465b-9849-fa80073edaab", "comment": "Malware payload (Formbook)", "value": "6a169e7a4871117b513852d89d5aa49b6c67e04e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787122, "uuid": "9f93c517-81e8-42e6-b3eb-244eeb1f2b40", "comment": "Malware payload (Formbook)", "value": "6a4b3d2ce2b4919b7ec4fbfb7795060e28cb75fabca8c1b43902ea50a4dd15fe0514c6d3cce0c8b8f1c3affc0425f385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787122, "uuid": "e94be7cf-6b69-43c9-a559-c874bebea0c5", "value": "T19CC4D040A75FFD30F52AE273B110C00863A0555EB9F2D03B9BAF788E74A574A55F1E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787122, "uuid": "6732eb17-b1a4-4465-8cb8-76e2fcad647b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787122, "uuid": "ccaf8bf6-3dff-44b3-ba85-c67f8841884c", "value": "12288:i+En27f7YyAFBinbc2qVsjUdm37jlkKQH:/jDkyMinxUdmfluH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653787122, "uuid": "c0a279a9-9313-434c-9c74-6cefa6a0448b", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653787122, "uuid": "80a0573c-3e19-44ab-843f-cabf93945981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787122, "uuid": "19dd6165-2c41-4cd8-87e4-30aa51acbb77", "value": "Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec4ae9ad-df70-11ec-93bb-42010a9c0043", "comment": "Malware payload (AZORult)", "timestamp": 1653843663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843663, "uuid": "36f55345-9e88-46a8-be4f-74f9d31eb288", "comment": "Malware payload (AZORult)", "value": "579dcf002dbc01c003918581f1d2bee8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843663, "uuid": "21096522-f642-4eef-bf01-d9da0c35fa9f", "comment": "Malware payload (AZORult)", "value": "1a28501ba0ea432b33e5b63b2b428cedc265b6dce0002173d87ee5bae0a1346b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843663, "uuid": "eab28c7b-9b52-46f1-86be-a9e888f65da4", "comment": "Malware payload (AZORult)", "value": "a6af7c60aff96e96f3b2284bb739d1b8cb919a4f", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843663, "uuid": "fc95879f-f8b8-4901-aafc-878495a37657", "comment": "Malware payload (AZORult)", "value": "b55507c023e44dc0599c046441b19d7ad588e5c00cd098faad4657ade2c5f9e97c0a038b7073a94b3e8da1f25337606c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843663, "uuid": "73c3b0da-c13c-468f-a08f-acbc3fc4e172", "value": "T116B3196EFBC18277D02408BDCD45A1B9907975302E391826F7E64F6CD8F96C26A6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843663, "uuid": "fe359e7b-ca5c-4e8a-901d-1d67ce3b70b6", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843663, "uuid": "3961e348-e6e8-4d82-918d-6c30d1593c34", "value": "3072:aixRaX6raoCoCyz6/mqv1JR+yBtGOeheWginSq:laZ1tme+1winN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653843663, "uuid": "42e477d4-2a8a-4730-96ad-0a10890faa34", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653843663, "uuid": "9ed4fed7-70da-4f31-842c-f6b62b9bf6b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843663, "uuid": "e31b6171-614b-452e-b0e5-441f849dd9cc", "value": "579dcf002dbc01c003918581f1d2bee8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a101866-df59-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653833459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653833459, "uuid": "2136c4cc-7f04-421c-9789-c28a70b14c4f", "comment": "Malware payload (Amadey)", "value": "ab32669f4569a0579e1263fdffb80a8d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653833459, "uuid": "2a8a9170-6ad2-4da5-a9f3-1ca4d95d7ca7", "comment": "Malware payload (Amadey)", "value": "1b39b6803f086419f973c91bb4969d1961853566c9ad36de23ee7aa9075dabab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653833459, "uuid": "4460c08c-4cf8-4614-b260-b18df3123e5a", "comment": "Malware payload (Amadey)", "value": "1c2416e536c210d5074cc11e0bd145b04811dbe4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653833459, "uuid": "c3a11582-ac90-4a92-b343-03d89bb38e52", "comment": "Malware payload (Amadey)", "value": "48383e6b72ba5897ed1ca9b87bfe6c5ce596300e125ba73b1853350fcab1725ef827e3f7e8aa897890efa7b7e6ebc76a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653833459, "uuid": "ee02fcf7-6484-4aa4-b362-af5152931299", "value": "T14ED5333071E630EAFB62ABB74B61F97C3314675E025F29BB6517E01B508363B5B812E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653833459, "uuid": "ca6f7a34-4b91-4d4b-a3bf-33849853568e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653833459, "uuid": "55ac8ef3-8315-44bf-baac-305e766e093b", "value": "49152:yvxokKM6HIMMm4mXtizKqx7SIhvDkSyFVdpA9ONLiLKPS8UWfeH6POc6598yP:nM2HEqtYxhmFb6ANLnP858", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653833459, "uuid": "1a2bb6e8-e002-47c2-997b-2d4a3e6ac8b0", "value": 2819584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653833459, "uuid": "1ef536dc-2cdf-4fd6-b8d5-0cca7c967521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653833459, "uuid": "aa9ef8ab-95b1-4d74-bb45-c64a02c2e6ce", "value": "ab32669f4569a0579e1263fdffb80a8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d2d3b8-df3d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653821513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821513, "uuid": "be12e2a7-8dc9-4a73-b1d4-c2c4de533c8a", "comment": "Malware payload (Mirai)", "value": "503deda6e125a857095b4a1e21407c03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821513, "uuid": "1b14fb35-bea8-42d1-ac88-86238acf4597", "comment": "Malware payload (Mirai)", "value": "1f1cc01ef2c5b07ffe5718dc057405ddd48c964ec72483b8d95a79d09fcba056", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821513, "uuid": "2571e184-ada6-46f0-b25d-396c8f80473d", "comment": "Malware payload (Mirai)", "value": "1061a4038632fb7c9b4f535d89b3da95bdb16b5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821513, "uuid": "3807ecb7-0292-4ca3-8d07-2f95aff80d8a", "comment": "Malware payload (Mirai)", "value": "8acd290b8341482af3c0efc465134a6959de020a79e12a13416381208534b2841b1e095d8c23e3f0190042124d0f07e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821513, "uuid": "27e8ec0c-2935-4af4-8859-66ec5456a765", "value": "T165D2F1E1DACC45A5C2E218F87E79CE433B6B5AB4927F286E12085F18FC411023DB574A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821513, "uuid": "13e4fe8b-d817-4696-a57e-7e55d6226580", "value": "384:74HSmaRMmS6hzVqRXtQS1363NcsT3iNcPkVN7MjjhayR2nqO0hymdGUop5h7F:74Hj7OVqQS56dp3iWPw7Mil0s3Uoz9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821513, "uuid": "64c9ca3b-0723-46a5-9080-87f3ea94b6b6", "value": 28784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821513, "uuid": "e8bb97f5-c785-493a-9c8a-cedb87540635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821513, "uuid": "73d0672a-9d22-4381-84f0-38848b872b74", "value": "503deda6e125a857095b4a1e21407c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b072bf35-df3e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653822088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822088, "uuid": "59decfa0-eb16-480e-b230-7e633d0e3be3", "comment": "Malware payload (Mirai)", "value": "11a56e30964d6f61183973d18648c9be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822088, "uuid": "a950bd93-7e9a-478f-ab27-a162156a2043", "comment": "Malware payload (Mirai)", "value": "1f940053f5df8995c73ad3913c5af57fd29f0f6793b4b65f14f1103eacf300b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822088, "uuid": "d057e2ce-f8f8-4507-9a8b-433a2bc91d8f", "comment": "Malware payload (Mirai)", "value": "e1bcd5a0e159739b69d1ea732c6c89a487da977f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822088, "uuid": "885bbf9d-6b47-43bf-954c-9e5f178f2874", "comment": "Malware payload (Mirai)", "value": "78f3b0f4ce7082e8bab5decb56ad775ce0a2132c0c6cf0735d5dd4aec3fa8415e279e1b618d52983245bf0bc09d5eb4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822088, "uuid": "b3dd4f13-03c7-44eb-8a46-4199151f8b94", "value": "T133F2E0EFD460FC4ACD9C9D7FB0582A619DA010C0396EAE9D3F405D883367B0BAE454B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822088, "uuid": "d606a8ac-8035-4996-b780-7f4dc779572a", "value": "768:CuTHVuPuVeJViDacylIHIAOptvB0X7I8faTrj/RRaR+b51W3:1TQPuUV+ayHpOptBb8faHzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653822088, "uuid": "cbe6d609-d791-477d-a13c-4b16c37ecb36", "value": 34516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653822088, "uuid": "aecc6aec-4360-410e-88ec-49db27d4800f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822088, "uuid": "2f0927b2-ce73-4df2-9e7a-4a8de6dc516c", "value": "11a56e30964d6f61183973d18648c9be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bc6be9-df1a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653806346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806346, "uuid": "45753dee-c016-4e71-85fb-f22f8edcdefa", "comment": "Malware payload (AgentTesla)", "value": "52a56523f61b94d81557990dd00a30bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806346, "uuid": "0c98a4ac-0900-4fe1-886a-ae1a54326eff", "comment": "Malware payload (AgentTesla)", "value": "1f9df9c77d848763463259351a801f7cd187a09e0d67509cc2c7f4cfe6fcca9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806346, "uuid": "5c66b645-84ee-4403-8d33-bd4bd96f55da", "comment": "Malware payload (AgentTesla)", "value": "920e8fbb70e104f9db168a067cbb1c797dc28b44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806346, "uuid": "f5394351-ca7e-45e6-a7ee-1a0dd9f89dab", "comment": "Malware payload (AgentTesla)", "value": "a03ff2abf2254bccc80f6a7374bc8c673df2b40cc90130b4c7ebb812d5fbbe2c54b2f4ec7856a84b5b2125a53611fba9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806346, "uuid": "19d35f36-838d-49f5-9d75-8de1ced38e79", "value": "T18AE4F1909367EE36F06822B3706490182771662E80E5D53EADDCB1DE34B6B461EF6F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806346, "uuid": "c8f8ee5c-3730-4540-bc24-d3b4fd867d8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806346, "uuid": "6ed8dc34-6c7e-491d-ab4c-937b2d13b5a0", "value": "12288:Wg9sRYV6PQCpEnuhl8yFdDY5BtkkHb3jQGEPrtEvbHo0:Wa1IPQ+l9HM5BtkkHb3PEmbHo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806346, "uuid": "8d2b281d-5dc8-4dd1-9fb2-1a26867ff33e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806346, "uuid": "46dcd2fe-c6fc-4a70-b417-9b0a609e24b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806346, "uuid": "b8d1238c-831d-4bd0-a3ee-5671befc6581", "value": "52a56523f61b94d81557990dd00a30bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafc6295-df90-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653857405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857405, "uuid": "995669da-710e-45a2-9ec6-251ab216b869", "comment": "Malware payload", "value": "f73c9cd9017c6bb93fadeb2fa4ac545b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857405, "uuid": "e4dae903-76d0-4171-bc46-273bf91307d7", "comment": "Malware payload", "value": "21a65c7320bb7fb4936aaeff6212378b5db9aefc67ddbddc47e77cb7fdce6796", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857405, "uuid": "1e4de116-5f83-4511-adc1-fdc224c929f6", "comment": "Malware payload", "value": "61975b77131ba3683396aafb8bf529db4f229081", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857405, "uuid": "90a1428f-9496-46be-b8a7-879915916dc0", "comment": "Malware payload", "value": "c39b3108bba38d7ba86f75872c93f09a7117a402607a76f4c37edc35ac39ba4a22fe8ede487188a02361b793ac54aa6d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857405, "uuid": "70142a99-f8d6-4301-945e-c96a3b0aa3d8", "value": "T182D2E13C563E94D9E761566A8C7DA841BC128C03F6DA274F472542A029C6CD32EC9FB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857405, "uuid": "e40fbdc3-3969-4b2a-a298-e44874803593", "value": "768:nXnRk3tTWkX8SbDtcfL7QRSjlME8brjlCJayceZlEZvgSeVNt9X/:ni9ZbCQR4ME8brjlCk1Z4SmD9X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653857405, "uuid": "1f388233-5f3b-4824-b76c-b1c4ee634dd6", "value": 30896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653857405, "uuid": "0304d73a-e573-4e76-855f-ce9a732066c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857405, "uuid": "8248f2bf-0e33-4388-a446-c1fbce9cd0f1", "value": "mirai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f8a63c-dfa1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653864342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653864342, "uuid": "f03ae607-c0d4-48e3-8fcd-77a2915ba1dd", "comment": "Malware payload (AsyncRAT)", "value": "4d54496236271d453859c10fc7df8793", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653864342, "uuid": "1cfd6e1d-07fd-4da1-b816-c6b25800fa85", "comment": "Malware payload (AsyncRAT)", "value": "2224910c2555982047835d3a2cf7666c0e11d02f9bb20f2ba4cd87696c2f09a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653864342, "uuid": "f7587d8f-2812-4d77-800f-983fe6d204c5", "comment": "Malware payload (AsyncRAT)", "value": "ffee488046d69481b61d5c5245c1508890e2796a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653864342, "uuid": "bfa9716c-82b1-475e-b406-e32b4d61084c", "comment": "Malware payload (AsyncRAT)", "value": "f2832ad5828add045d28eb9e1bea4173c71db79aec7c90809b4f9d627cc1c6c8feab3df95335b600aa68555ebb20a943", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653864342, "uuid": "e6bb0d17-2e60-4167-9db3-19f5ef4bfa2e", "value": "T1F9B40128B3619F52D2A816F5D5D3A12443F28947B632D3973ECA15CA9E027E05ECCF87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653864342, "uuid": "2b73e429-f8ae-436e-aa47-b76ef0ee25a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653864342, "uuid": "13856332-5e7d-4a43-9b01-ef307f85b1a5", "value": "12288:7u4uIxXulX6VPL28ul7uoVrXbwQVd3b5UR+9C:i4uuXCX6VPy8uDrXbw40R+9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653864342, "uuid": "18b4256f-5f18-4396-95f5-ac27f5b657df", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653864342, "uuid": "3e547bcb-5d99-4f17-adc8-88216a9b4aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653864342, "uuid": "b8068901-37e4-4495-a02a-168e2490a0a6", "value": "LIST OF ITEMS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c4bc05-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799822, "uuid": "803df458-3398-4579-8938-9f3ec8b1de90", "comment": "Malware payload (Mirai)", "value": "1b4626014e31750cf8f3c3b468e71c87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799822, "uuid": "963316a9-d6cf-4a37-8551-8d9b85a999f9", "comment": "Malware payload (Mirai)", "value": "24152b717aafa746eae00337a93939005264ddc2e7e286a5685e8edec9393737", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799822, "uuid": "2c475315-3bdc-4df9-8141-4a2e08b25519", "comment": "Malware payload (Mirai)", "value": "e2d38a3b01109b9d79ea66d78e90561a8173b616", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799822, "uuid": "1dc18eb9-c227-4b9c-82e6-478c2cdae144", "comment": "Malware payload (Mirai)", "value": "1d4bf2dcbe61b1c4a5ab4acee8675083aea6eaae3b7b8d6a380054779fff9a2ac1f0a4ab32a6431a4f6b801718df1638", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799822, "uuid": "22a4f33f-d1bb-45db-9744-2f4dcc83307a", "value": "T1107392097F614FFBF86FCC374AE92745218C641A22A87B397934D818F24B25B14E39B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799822, "uuid": "ac2ff3f5-f4e3-4cec-894e-0297ce80f83e", "value": "1536:pda0IrPUujoSH8VrDjZrmUK+OF9pHrmZS6TdoZnY:pdIrPUujoSUD9m7rm4ZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799822, "uuid": "a04d7199-615c-40d2-b280-a9649e5d7ac7", "value": 76840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799822, "uuid": "7771d169-68f9-4c6d-976e-86b43633187f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799822, "uuid": "2f896557-0c43-45aa-ad0f-1676f215a953", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f23a005-df1a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653806570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806570, "uuid": "7f05f401-96f6-401c-adfd-9ee1d30b3924", "comment": "Malware payload (Smoke Loader)", "value": "b443b098202addcccd1c2ea486a21545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806570, "uuid": "89c78530-1e59-49de-ba06-6460945c28c2", "comment": "Malware payload (Smoke Loader)", "value": "27af39fa2035877bc021012eaa968d998101afd2fc7a421c6270f2635eec41e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806570, "uuid": "ac8a1e97-138f-4bf0-b349-34353894ef67", "comment": "Malware payload (Smoke Loader)", "value": "9043dcea6ef9af2a408c2a0c585d21335a916a74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806570, "uuid": "9bacc8f9-942b-4d42-af6c-d1ad4db7bba8", "comment": "Malware payload (Smoke Loader)", "value": "94b7388f55b640975a7f7d28292b8046c599e5a29022ba2a3ddf7a37f4ac0ff91da4e3dccab1c0c2282d0ffce6af8a5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806570, "uuid": "41fed590-5ba9-4c1f-8f29-d296fbc9cfda", "value": "T1BF25BF22ADB148F6D177167C4DFB52DB58277D002AE898CE6BF41F8C4E386813B16297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806570, "uuid": "ea3c0eeb-05e6-4332-b1bd-0e23e79ff91b", "value": "c294bc02a6388059f400574db0223013", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806570, "uuid": "68c26c13-ab4b-46de-8c70-f27a91fd6706", "value": "12288:sc72DXGvolWWiKIYJ5N38cklUNb9lRdoa7s5/i/aL9LGbHGkAHiDgiggOtFgD2:R7MXGzWiKtffbCaq6ThXggy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806570, "uuid": "402afb00-115a-4f72-81a0-bfcbe0b4b776", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806570, "uuid": "8015c90e-97ff-442a-b84e-380093e4975b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806570, "uuid": "dbd1cddf-4c75-4c80-ad1f-c7c97ff2e1ab", "value": "b443b098202addcccd1c2ea486a21545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13763d89-df6c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Tofsee)", "timestamp": 1653841581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841581, "uuid": "7bc6ec24-d42a-4a46-93e5-e954fbe4f904", "comment": "Malware payload (Tofsee)", "value": "015e6a91fc2397216cdf2e0c0e7e4132", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841581, "uuid": "a8f0d69d-9309-4ac4-828c-a2073b5d6020", "comment": "Malware payload (Tofsee)", "value": "29aecf60d2b78688a409dd254eba6414e13fded9ebca1ac8beb624e252ae2f0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841581, "uuid": "0f3f7859-8bae-434b-a0f4-b6c29c8b124f", "comment": "Malware payload (Tofsee)", "value": "5f3a2877d37c6b0f392e42ac646af7afa0e45bcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841581, "uuid": "28748ff9-06ca-41ea-a07c-5ddf8caaf40b", "comment": "Malware payload (Tofsee)", "value": "b598adb5090885e30ec18df9608a861f4a3a045f008436f19345b1176eabda3872c419ac656c1c9fec4547cc6a40e3c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841581, "uuid": "459118b5-856b-4e22-8277-4b7eb086eabe", "value": "T1DD14AE25B5A0C032E1F765304874C1712B7BBC639575C94B3B842A3EAE71782ABF176E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841581, "uuid": "e8a14373-2135-4561-bd2c-dd6da1f4d451", "value": "f5b352298d89c175aa8d8d46bf23e0e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841581, "uuid": "907e2ac3-9e54-4cf1-b2da-3773d8cc310a", "value": "1536:d7NV7uLnn2sKpZ3+QADLNpI58YJDqg3foq3QmXW6sKv6vvLRHLBctoSEnZSIkuzm:dRVSryp3iN2Ci/fFQo6KivtHznl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653841581, "uuid": "ff39a366-b1e6-475c-9633-9998305a82ed", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653841581, "uuid": "75bb6200-da53-4f66-aeda-458b4543e76b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841581, "uuid": "762c91dd-8f52-46ba-b989-40bdca6cd14b", "value": "015e6a91fc2397216cdf2e0c0e7e4132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c2f261-df08-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653798602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653798602, "uuid": "fa1eb2db-3f6d-4842-9469-c4b315d311ec", "comment": "Malware payload (Mirai)", "value": "2b847048f527ada52d175ecd3d7c9dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653798602, "uuid": "b1f1003b-793e-4d09-82f2-fcf859694950", "comment": "Malware payload (Mirai)", "value": "2cd406aa9062c0f872bf0ff0320d3fd6fb24321bbd9b1f96f874afcedc857591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653798602, "uuid": "8ad79b1d-aa2d-444d-9838-9ad93763a917", "comment": "Malware payload (Mirai)", "value": "1b6a31560980b7b0f3f9be1f9f521c541cbfaeeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653798602, "uuid": "224f6a30-b777-4c2f-9d73-afb53bd1665f", "comment": "Malware payload (Mirai)", "value": "54588ae3250d6907b35d151192c09adc78dda0450ddfa7ac082546affc30f8b71b993d915cb8c84b7a0264eda315153a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653798602, "uuid": "4933077e-fbe1-4dbf-b038-7b11df70658d", "value": "T133330261D24CF6B8C75454B7D314D158B74ED1B8E7BF116E0382B250EB208FAE4AC4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653798602, "uuid": "270d113c-b5cd-4084-9634-612fc634307d", "value": "1536:6QU8Kdl5RMD5BAm+pEghCcMq47ky2MQ21:6Fdl5RmOh4tkyP51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653798602, "uuid": "e9880d64-0acf-4b74-adc6-93d39e827986", "value": 54420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653798602, "uuid": "7a36a52d-f7cd-4d1f-9f7a-926678bc150e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653798602, "uuid": "a41ae394-d15b-4e70-8bb4-8d7d92863e15", "value": "SecuriteInfo.com.Suspicious.Linux.Save.a.14771.18102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8c7e37-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799825, "uuid": "1cd33cbc-b79d-404d-b1d9-2f0c4014693e", "comment": "Malware payload (Mirai)", "value": "5d28954ec99792ecb8f48a0ddb644961", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799825, "uuid": "e46476d6-19a4-4047-b46c-a9bcf2859e79", "comment": "Malware payload (Mirai)", "value": "32f60200beb19fa35b2676c25b7bc15caa9ec700aed28bbec0c115728643de74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799825, "uuid": "e7ccc216-b414-4e07-9a29-b52bac5e1aa3", "comment": "Malware payload (Mirai)", "value": "ec69710390edf67534c88a457e47d95a603db14f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799825, "uuid": "02d09c10-f6e1-4658-b11b-637804893490", "comment": "Malware payload (Mirai)", "value": "bfe7c5f8b27ca9ad460077c2a6ff8048863d90beb491eb25b32fd52cc33a8fabaece6572147a5a64340ab77c7552c15e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799825, "uuid": "b3ee240b-b0f5-4155-bb8c-4298eaf9f1c2", "value": "T13C432AC0F94BD5F9D587593050A7F13FCE32D53940B0C66DEF8AAE35DA3BA01911224A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799825, "uuid": "c5fd0a90-41ec-4354-ae4e-c05a12fdc469", "value": "1536:aTQh/UU+mvCTcO4+7jCwMGvEBehkN0ZbIqxjpqfl8pIk:4Qh3+mvCTcOBGgvEBehC0BL48O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799825, "uuid": "390fd34f-79a9-4ccc-92f3-c201c9c21543", "value": 55824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799825, "uuid": "4b23161f-59b9-4f08-96b0-f0be20d0835d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799825, "uuid": "99afd491-1ce3-4b51-91a9-c384158a39da", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62842d3f-df3d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653821528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821528, "uuid": "e6195dcd-f74e-48ab-8a98-880963b8e937", "comment": "Malware payload (Mirai)", "value": "ad09d29e99655068e7d82f5646906c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821528, "uuid": "dbfdfd06-d96b-4c98-813c-68738ff58f8b", "comment": "Malware payload (Mirai)", "value": "36d4a0b7367fef247ecbb7fe709e9c94128a7f142a825d2c17fb680cde40dd7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821528, "uuid": "cf65d8b9-2ffa-40d1-aa6c-a65f1721071e", "comment": "Malware payload (Mirai)", "value": "b6364d22b5f5b53ce5872fb516b5fea7b6b881af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821528, "uuid": "e9c12c88-d81d-49c4-943f-19187ff15864", "comment": "Malware payload (Mirai)", "value": "41ff8a01d859fc4240a1534ba7c7b03447f0376b614c2424c3c692f302735f979c99c71a192ce3d1e2d281a3d0dac20b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821528, "uuid": "a49a3c35-a1d3-4efc-9bac-2cd6d595c2bd", "value": "T19F835CA9B412AE7CF58BD97980214E0EFC20229097934B3BEA77FDD37D63165B901E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821528, "uuid": "cc509dd7-2780-486a-a645-aa0710500ada", "value": "1536:cGCwbA6hvMpdZsx0vsNkU4mV622xCnEIFMR5ve/FlRppE08v8ApD0rFLSSPBy:cGapdZg0vsNkVmV622xCnEIFykVm4SGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821528, "uuid": "6dd32f1a-4cb7-4471-ab19-bdfd79197cb6", "value": 82668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821528, "uuid": "78fbd5ce-6999-4b2d-8ccc-de0ced1c2a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821528, "uuid": "6349a6f3-7b87-4824-aae6-272c22efd73c", "value": "ad09d29e99655068e7d82f5646906c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478d76fe-df54-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653831361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831361, "uuid": "0077a38f-8e61-425e-918b-dc9835d464b1", "comment": "Malware payload (Amadey)", "value": "923055c8d93dd53bed415b7b6d6be567", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831361, "uuid": "c98f9919-69f6-482d-b3de-2f1a99c904a9", "comment": "Malware payload (Amadey)", "value": "3a82105527a23a7ac48f854d245d58d8d34cdb0e118639eedbc7a76034ead35f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831361, "uuid": "878c2bc8-1b02-4ccd-9350-c18dda223034", "comment": "Malware payload (Amadey)", "value": "7eb2ece22a866d35e0ddbaea48045bd698b087e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831361, "uuid": "0d475859-6ea3-43c4-bd49-6b87c421b3ef", "comment": "Malware payload (Amadey)", "value": "bc3905c73ad85fd6a3722401136bbf6d27ce84f1a530f45a43340a0d5da30ac41adb7c7053638f1cd24a9f47dda6c3ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831361, "uuid": "1f59a548-4ba8-4f98-9a64-438bb06e204d", "value": "T14754F16D719CE830E1A349349876C5643A3E7C33AB3989773A843B7A2F713D26750792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831361, "uuid": "a13d0aba-cf77-4ac7-9298-70157c4e205a", "value": "0f8197d782997108db56ec1726ffac1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831361, "uuid": "417b9a50-0848-416d-8d56-32e6dd243d75", "value": "3072:dVWbvarVzyD0HGDkoTGWOCLC/uR7Wszk6jVt8n02ClY4MBif7/Zr846J0KER+t9q:TWkzyTCCNtWs4wnMBifqNJ0gt9E7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653831361, "uuid": "d01c1b6a-2e89-4752-a6c9-17c08b961b61", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653831361, "uuid": "c133fe13-3b42-41d8-b3b8-1c1c14974e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831361, "uuid": "7c6d8469-f7f0-41bf-b985-7905cd6cf583", "value": "923055c8d93dd53bed415b7b6d6be567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e98e315-df35-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1653818031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653818031, "uuid": "d1a478d4-3485-4291-acd4-bdbf74921671", "comment": "Malware payload (Loki)", "value": "f3ed0d94fd74fb96cc85e86f70afb286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653818031, "uuid": "3c9287d7-0cba-4ebe-a13e-ef58efc06d31", "comment": "Malware payload (Loki)", "value": "3d27d155c992ec9a73d28e2063e22e0a9822c7deecc8278e2bb60ca79b4d11b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653818031, "uuid": "9471ea37-e55d-420d-9876-90702e01115c", "comment": "Malware payload (Loki)", "value": "897f329c70c44879f987db88363cb2ffe12c34dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653818031, "uuid": "5d4919ab-abbf-4cb7-a8e8-cb4b0e17db43", "comment": "Malware payload (Loki)", "value": "711731d6ab63ed3a7c3e70c0dcde6fdfc8597f658af22a76e2724c4c59e59117cbb51ad8f5baa365dd8d816ea6dc76ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653818031, "uuid": "b0a1c63e-3974-4d27-9060-42b008c59538", "value": "T1642361C45D09C91FEC440AB1E139729E03A75FB791E7632EDD78B2EA933710D31A2662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653818031, "uuid": "7b6b727d-730a-4edc-92ba-aedd48160cde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653818031, "uuid": "48dd6e0a-9bef-400a-b882-df769ee8e75c", "value": "384:44YY8V2mSbsdt3GsTYIZTYtalTjM+50IJU8REvFofTVmw4ATMM:1kobg0IiZCU82Fmmw4AwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653818031, "uuid": "500ae75f-f13c-46ac-a431-4e151ee99dcb", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653818031, "uuid": "dc4684db-b75a-43a2-ac37-80d9536875e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653818031, "uuid": "1d55bc9e-dc27-43be-b885-c013d06b7866", "value": "RFQ 61340 DUE ON 3-06-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33758207-df50-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1653829609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829609, "uuid": "e29c679e-5f57-4a2b-a933-ec2e460f8cbb", "comment": "Malware payload (GCleaner)", "value": "08f0fbdf155a9d73357e3e5b7a29d68e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829609, "uuid": "0844dbef-38a8-4283-8169-1921efc7bb49", "comment": "Malware payload (GCleaner)", "value": "3eb501b1e2997a3cdbb81db7781b9c0bc9860e101ab8118d7c1c228e3259b75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829609, "uuid": "2326f530-cf00-496a-92b2-21a1ec4c077f", "comment": "Malware payload (GCleaner)", "value": "6d7b2b4c4939afbd3409966b06b06f342ef03488", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829609, "uuid": "18a11721-0844-4655-b3d9-1aa668c92a40", "comment": "Malware payload (GCleaner)", "value": "caabb358293ed81acd046f6365a285240f09864c696682fc694c1b2140caf51edad0bf7487040a8816287e70eb99e42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829609, "uuid": "6415154a-3193-4949-8e7d-c27e7df56af6", "value": "T16664F1547DA09C31EDA579348C71CA212A3BBC623139994B75F4375A6E33782BA30BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829609, "uuid": "02a4c8f2-e1bb-40d6-ae25-4a1d03f2571f", "value": "3b5b71419f19c89ea7002a31140d85fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829609, "uuid": "4b8b0610-6e47-4c7f-baca-c922d857727c", "value": "6144:JlmysYuzNO935M//qDtUgrKuKBf8vEC3qNoUllf0V:xqe5iyDCg+u0nYqNoUlKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829609, "uuid": "61e0ce33-6843-4b1a-86ad-24bf3d7b83cf", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829609, "uuid": "f1f3e177-9739-4c80-9e2e-0caea3974f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829609, "uuid": "2e68f6e7-9f92-44cf-ad1d-e488dccde862", "value": "08f0fbdf155a9d73357e3e5b7a29d68e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f873769-df5e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653835803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835803, "uuid": "9e919194-47a4-44a9-b5c3-bb17c235e64c", "comment": "Malware payload (Mirai)", "value": "607e931228d555b823ff278f5fa3af9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835803, "uuid": "10847a8e-f4d3-4406-880e-d6f05a74565c", "comment": "Malware payload (Mirai)", "value": "42ba565de765f3652e291931d3ce4a414aebe2f55e9fe2910f080aa9725dee2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835803, "uuid": "bfbfb7ae-56a9-4117-a5f7-7ab1c3de85ea", "comment": "Malware payload (Mirai)", "value": "e31d14a28355c7280356c0103d58f52370c323ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835803, "uuid": "e4e601bf-31c5-4347-891c-0c755ecc4c2f", "comment": "Malware payload (Mirai)", "value": "1ea8edf217303b1b7d37627952e7af5366db1b27105b5c2b2ef765e282f24741f9fe137ca3c643b91c6a837fd72909ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835803, "uuid": "8a0eff61-852e-47ab-8065-9c01b77b2f19", "value": "T14733F1929355B4F1F666EC2A64350C512B02433EE85D30B0B7A746248BBB5CF9EEFE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835803, "uuid": "c375fe7b-3f47-4f39-b300-1d22be42d624", "value": "768:I6SMLUQIYX3kmg95CC3yaO2RF5OceX8jlHkJ1gAb7ouJQuJ6TwVAMTE9q3UELCqW:XShCQhCuF5EEk7oJRMJLC0LWmhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835803, "uuid": "10b17193-62a3-497f-b7a7-fca43347a902", "value": 51012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835803, "uuid": "55929991-1c00-4322-b808-a49c47419e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835803, "uuid": "33a18dfd-995c-42ff-86d8-8396f70a1e31", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a55a4c0-df54-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653831446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831446, "uuid": "1b513d65-05ca-4810-bc9a-e42ab63ac20b", "comment": "Malware payload (Smoke Loader)", "value": "62e19434828f15aaba2125f1fa98283e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831446, "uuid": "b7173555-04b5-43bf-87a7-3ea9bef24c48", "comment": "Malware payload (Smoke Loader)", "value": "4617069ce25709428086ed41f2b3929a732318b4291e34e5178239415938097d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831446, "uuid": "5c13f0e5-98f6-4939-bae4-90697c9862da", "comment": "Malware payload (Smoke Loader)", "value": "587d62b438df6127ea9c9880317dcd78ae24ad9e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831446, "uuid": "354a0e58-62c7-404f-8658-fb2f019cf3b2", "comment": "Malware payload (Smoke Loader)", "value": "7cc896b054dc470b44ee33a0660e7ddf77d0774a293475d181a93201cac5668db8ecaa4337a9263378c61a7b91498aa9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831446, "uuid": "2ebad722-c462-4e61-bd73-daeda06ec69a", "value": "T1B6649D107B90D435F1B712F44ABAC2B8B93ABDA16B2441CB62D47AEE56347D0EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831446, "uuid": "df89fb26-408d-4cc2-bac5-a937421a01d9", "value": "35ab1c1a8226968453ac17f61f2ae770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831446, "uuid": "c885d6ac-8f40-4bfc-9abb-1c37cf7ca929", "value": "6144:nj4/wnmcL9XXl0truWocieRJpQ1iOs+lbR/FhPFspTg:j4/kZnl0tqWoCQofmRNig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653831446, "uuid": "b5dfbf86-d77b-4cb8-b5e7-ac39725c0aef", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653831446, "uuid": "db80c7b7-3293-40e4-a7e4-3b2797b55bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831446, "uuid": "d37c640c-a0e3-4b62-8a56-fa7a51858bff", "value": "62e19434828f15aaba2125f1fa98283e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f1797a-df50-11ec-93bb-42010a9c0043", "comment": "Malware payload (GCleaner)", "timestamp": 1653829586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829586, "uuid": "220969ae-3382-4dde-be6a-8fe4dd1fe35c", "comment": "Malware payload (GCleaner)", "value": "b6c47995a6103f9b860f909dd4c01fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829586, "uuid": "620a53e5-18d4-4f87-9dbe-5f2a74650d0e", "comment": "Malware payload (GCleaner)", "value": "47159757c0e58254d6b59eab72adc87b58dca31897a53cf0cace18e06863a0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829586, "uuid": "eec1c39b-4145-451e-9c40-e97e990f7354", "comment": "Malware payload (GCleaner)", "value": "5d477a982c26b5091d0f143f54a8e599ed040958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829586, "uuid": "b69b9b9f-0296-4d9e-a192-8f8cfa0a2bee", "comment": "Malware payload (GCleaner)", "value": "d2198d848282d2d1ce82b7baa49560760a0ab4e515ce1f6e2a56d779c45b763c3c89749e6ac2db1add7221e4aab9e6e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829586, "uuid": "9cd0fb6f-d88d-4d39-a9bc-470851372744", "value": "T19D84BF107F90D434F5BB11F48576C368753ABEA16B2095CB63E42AEE5A386D0EC3139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829586, "uuid": "698a23b9-8664-4535-a609-e781d73c6f49", "value": "face88db180055f7b959d0d8ad853754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829586, "uuid": "2c352f84-d9c1-40eb-892a-3f562dd99017", "value": "6144:uEF21u2TT40e4e80Lr8mo3RQEpA0j1k0V+Ug5VeggqqeYP5bI0l9o:lF2jTDT70LwmoFAoG0VrKcrqsG0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829586, "uuid": "e32808e2-9c58-41da-8a8c-057f74c76699", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829586, "uuid": "e4997683-f4a3-49d6-9d89-cb4ec6e8ce15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829586, "uuid": "1a3c26d1-cf72-49a5-804f-089a9d3be9d7", "value": "b6c47995a6103f9b860f909dd4c01fe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3512da6-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653804054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804054, "uuid": "11c2c231-7067-48ce-b773-ea604f6e42b2", "comment": "Malware payload (Gh0stRAT)", "value": "10ff133591b40dc98fae702d4a171ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804054, "uuid": "67cb512c-437c-46cb-86d6-6d4579ef616f", "comment": "Malware payload (Gh0stRAT)", "value": "4885e7bde06a0b7c27a0bb3bda4b277175b075d5a47a816389433e48a08fc9ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804054, "uuid": "0c4572ff-b49b-4516-ad88-00b43fed85f7", "comment": "Malware payload (Gh0stRAT)", "value": "7c28698a1359f97f459d37b02796f26b8742adc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804054, "uuid": "2d3db9c1-8184-4313-9fed-b236d1744d7b", "comment": "Malware payload (Gh0stRAT)", "value": "4a69a7168c27fd24b2a16cd3ca4318dee3539ce2057c173884c9586838efaa33912b4e25f481ae52c806122099ad76dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804054, "uuid": "c9451792-c5fa-4a74-88ce-694496e580aa", "value": "T136550242B273C1BAC41D01776C6E12794859AD290B54CAF377A37ECE1AF12E92D312BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804054, "uuid": "9e26e443-af3c-4ac2-83a4-0dbe7109ac01", "value": "ed83157ee2a41d9492a4ba052903de6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804054, "uuid": "47985f33-7a7b-4110-b52f-4761628d770c", "value": "24576:205rF0ZbmYvBA5zITmkA92ZeemXdTDnCzAehUQTc07quLdCmEHtIrNeDDp0n:7Ih4zwxqHTPCzAehZ+upENIrNeDDp0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804054, "uuid": "a191d428-613a-4122-abfc-3b60ecf53be9", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804054, "uuid": "f83de804-3fb1-4263-8d99-9072b145a19f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804054, "uuid": "98aca65a-7b29-4b6c-bea3-b73703864084", "value": "4885E7BDE06A0B7C27A0BB3BDA4B277175B075D5A47A816389433E48A08FC9EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24cfa0c-df3c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653821259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821259, "uuid": "219167d7-f3d9-4829-b369-f16103c4950f", "comment": "Malware payload", "value": "52945af1def85b171870b31fa4782e52", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "msdt", "colour": "#635EF2", "exportable": true, "hide_tag": false }, { "name": "msdt.exe", "colour": "#DF12C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821259, "uuid": "27c93c30-b183-49be-8f1a-1fa94bd4bffe", "comment": "Malware payload", "value": "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "msdt", "colour": "#635EF2", "exportable": true, "hide_tag": false }, { "name": "msdt.exe", "colour": "#DF12C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821259, "uuid": "3e28c087-00c8-4b34-9208-b39f70eab08c", "comment": "Malware payload", "value": "06727ffda60359236a8029e0b3e8a0fd11c23313", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "msdt", "colour": "#635EF2", "exportable": true, "hide_tag": false }, { "name": "msdt.exe", "colour": "#DF12C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821259, "uuid": "26d026a7-787e-4705-ba6b-cfd938f2aa39", "comment": "Malware payload", "value": "52224ab9447f67a78c9141524665c5ce274cf294aa65ade2da937222d8148f9a6cf00e6bcb07e83b1046abf8c6f80591", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "maldoc", "colour": "#51DB1D", "exportable": true, "hide_tag": false }, { "name": "msdt", "colour": "#635EF2", "exportable": true, "hide_tag": false }, { "name": "msdt.exe", "colour": "#DF12C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821259, "uuid": "0774b447-4afb-48fb-8f3c-f97ef3bc926c", "value": "T11722AE7B842A1E30E56B6774F0E06759EC4C04A6FE467974F0117AF387C1BCC9271A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821259, "uuid": "9d7a69f5-c981-46b6-9e72-b841b48a09d6", "value": "192:AEhM7fIUU09264wptGheab8h7Z/c+8poF1d3jvvtl59rGxjPQDasYBcG7h+:AqWfIz092hwLGAabkcfa7pr1lzyxjPQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821259, "uuid": "9883ebd2-a913-4342-b603-a583faa34ca2", "value": 10253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821259, "uuid": "4d9d9a2b-287d-4c90-82b9-6fbbfc0127b6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821259, "uuid": "a0968df9-c7d4-43c8-a5f5-8b1c88b10883", "value": "05-2022-0438.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d38fe1-df55-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1653831714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831714, "uuid": "470faeac-e58d-4853-a116-187346338906", "comment": "Malware payload (GuLoader)", "value": "9786b352cfe446517060c8999b101006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831714, "uuid": "63aefe22-f0eb-4200-a778-2b3e99d29f5c", "comment": "Malware payload (GuLoader)", "value": "4a6602205094982242c95e20a2bed8374aeb166cd8c07560773b39583a9fc031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831714, "uuid": "ddc4a4f1-dbd8-4020-a8b5-0b70a86d7915", "comment": "Malware payload (GuLoader)", "value": "a0805fca8414f29cdbf3348d9bd4c8079094dfaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831714, "uuid": "735d8ea2-3a9b-4b24-aeba-cab9260bd516", "comment": "Malware payload (GuLoader)", "value": "0d41836968783ff09368be5e10794ec141a3e8c930370de4624464e0181d24d66fe6ab917074c67203e08355a291c828", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831714, "uuid": "945360ce-337c-4679-a1ba-66678f4ccfd2", "value": "T19A440221B6F4C137F4610EB059399E335BB9A71224C89D075778AA083936B82D72FF5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831714, "uuid": "afaaca67-7d1c-48ff-b4d4-11fa4214c446", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831714, "uuid": "8b1f8cef-47a6-47ae-a172-3168e799ab93", "value": "6144:MYa6GTXSkAanO/PpUZyNiXgz8KjvyPTnPAe+5igxO:MYkuEnehU60gz8Kj6PTnYe+xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653831714, "uuid": "51d30847-d2cc-44c9-b84e-203e0da204c4", "value": 257397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653831714, "uuid": "9382d949-f027-4813-9a35-bd20e9d1841e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831714, "uuid": "d73ac34c-bb9e-4fc4-91ca-60306ee049a2", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.7352.14379.8183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add4c10b-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653804045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804045, "uuid": "c0969677-8a93-4372-a6da-313748b7c47a", "comment": "Malware payload (RedLineStealer)", "value": "6f4bc7cc75470267786e8caa638f56eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804045, "uuid": "94bdb33f-e588-4dc9-b025-297650749939", "comment": "Malware payload (RedLineStealer)", "value": "4b51bfdfb096e034e057e4cf48abcdb2f8f3301d3493f286053bf66f9b74f175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804045, "uuid": "4d8fd4f1-7d85-4d07-88f6-6847b6618ee0", "comment": "Malware payload (RedLineStealer)", "value": "98df0076e3e2d29ecdfb362b3ec60e49a7a91c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804045, "uuid": "85ff4305-6654-4b8b-a94d-8d8e25c51e66", "comment": "Malware payload (RedLineStealer)", "value": "cab43feac0b6eb469a5d4e5fe6c31de8720978917559fe6eea281334945f2d0d81704840e3eaa29ca785018a63eb1ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804045, "uuid": "8d371426-ff87-4bfc-8bf3-8851fe0db50b", "value": "T1BAB5FA03AA8B4E75DDC23BB461CB533A9734FE30CA269F7FE609C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804045, "uuid": "83623a2a-9f0e-4b68-b7f4-17ce4fb9b83e", "value": "0629c55152d38b4029f7de8a08e08d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804045, "uuid": "3040b5b4-4095-4f70-bd88-747e89fd172a", "value": "24576:gNj7ghK/tzukknOm1VZMw/lKYyCMv+o4/2yvM1afVouQ5p3h35w:gZOEkY6/2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804045, "uuid": "f2e10440-686b-4431-b41d-0c1a187f7e85", "value": 2274759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804045, "uuid": "b31148aa-834b-42aa-b487-1bf8cb925434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804045, "uuid": "6d27c6e3-4e22-44ba-9dc3-65a000eaf173", "value": "6f4bc7cc75470267786e8caa638f56eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb88009a-df90-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653857406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857406, "uuid": "c4608b4c-4ca6-4e9a-a39e-f310e9093e65", "comment": "Malware payload", "value": "9e965f3e35adda5bb97ce0d618291713", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857406, "uuid": "cd0dbec0-6299-486f-9e0b-bab63704e95c", "comment": "Malware payload", "value": "4d8b55115105080e1b235ed178dde769f23e91b554f4d6bb801c6b9c761dadc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857406, "uuid": "30007da0-34a1-49fc-bd1d-40f1db0c5a68", "comment": "Malware payload", "value": "0208ca40a0cfa4d1090bbc71b03d9c26becc5f8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857406, "uuid": "f157c067-60af-4e7f-9ae3-7757becbe135", "comment": "Malware payload", "value": "1e660911f559aaec766e8a85040de08afc2ec10eaff033ab9d564f7a61f0344a535568abdc8c17eed066cf7ccf421753", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857406, "uuid": "29856412-181f-46a4-9623-23db1b795e7a", "value": "T13E02B09E1AC29714C710DFB11B3F8AE261D5BFABA15A053971002DA13FCE182A298DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857406, "uuid": "fa481d9b-584a-49ec-8059-8a36814c2f81", "value": "192:BKFzHBfhI4txTujctDx7RtIkogKTCBdjYpM/p1tWXt66fsP:yzHBf/xCALXAVWzYqcdVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653857406, "uuid": "65b510ef-efe8-405e-8780-c61f8dd80d71", "value": 8916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653857406, "uuid": "84fb5e77-1a59-421d-8db7-6f1fe5c70e2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857406, "uuid": "bcdbe2ac-debb-471a-88d3-d451d981355b", "value": "mirai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b375ed38-df5b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653834548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834548, "uuid": "fe899f1a-f111-4561-9829-91ebc65e1408", "comment": "Malware payload (Mirai)", "value": "acfc60c17832696b3707c37e6f7105df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834548, "uuid": "00ef1c5d-5655-411d-927b-3018cdb6960b", "comment": "Malware payload (Mirai)", "value": "50318a199f48adaa8378271b7d6fec96bfee7725b4e3a94506a461ae2845ae8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834548, "uuid": "fe52bd4f-e3f6-4042-9542-ed1405aca040", "comment": "Malware payload (Mirai)", "value": "e5b098ac48efa0617d4c1f75345d036d85a09ca4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834548, "uuid": "59205156-f154-4a4c-8d6a-a45b1e9767a9", "comment": "Malware payload (Mirai)", "value": "4a3cfb60eaed099e9a0ec7246f4933b0167be8ee2d86f85afdc35bda23d8458c26abfc725c9eb8454f5471ff57295430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834548, "uuid": "c931cd83-3174-450f-8f77-d8c5e4e7605e", "value": "T193C2D1B4E0571A93DFFF8EB48E40E6C233D45F09271289F7E1949E30712695AEA41ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834548, "uuid": "40c95263-1830-4cab-9f68-40770fc81ed4", "value": "768:Vk/lvtbEusnoM0PV3szSc8Cg4uVcqgw09a:oTonoM0Px4Sc8Cg4u+qgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834548, "uuid": "d9b2f819-9263-41c3-8a81-2c67ac869a13", "value": 25880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834548, "uuid": "92a3736e-9c33-4057-9371-53d02b28e9cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834548, "uuid": "e3b69545-41b6-4e05-982d-c8f039e8c0ec", "value": "acfc60c17832696b3707c37e6f7105df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf9f2b1-df29-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1653813089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653813089, "uuid": "83a29dd4-2fc9-481f-92d9-cb5e88298c83", "comment": "Malware payload (CobaltStrike)", "value": "7301d6126cc0f933a4fa3358a349ef6c", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653813089, "uuid": "97c227bb-16ed-4388-afdb-d36fa484240c", "comment": "Malware payload (CobaltStrike)", "value": "50cea054f1bfeb13485a6a3fb68319577f577db8a9442552fbc55f3f111c5c66", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653813089, "uuid": "0c94d136-7dd5-4d35-a825-98039684f116", "comment": "Malware payload (CobaltStrike)", "value": "8fc4826223438df974f0bb259fba7355abcfdcf3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653813089, "uuid": "331a9e07-ad48-4343-acce-7756536350b2", "comment": "Malware payload (CobaltStrike)", "value": "af41b295a35f975297f1f3712152d0d6f72282819cc3a32a321e7d5d2c126dfb0efd84ad2fdf9ef6d52d486a015fd3d5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653813089, "uuid": "2cb6d75d-bb09-412e-9824-0157418c128d", "value": "T1F6248B913685F036D0960479A64FC7724EBDBC3416B198C7BF984AA99F22293DB39307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653813089, "uuid": "32bad2c7-ba3e-4def-81fe-f721261affa0", "value": "d78bb42be898a6d63b468b408da27a2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653813089, "uuid": "2ddc8901-7111-40c6-ba74-c1c0387a1228", "value": "3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUnw5EUh:v/MEfuN0t8C5oFsoeRM3o0j+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653813089, "uuid": "a44bc996-e879-42fe-bd59-2b50b64d6bf2", "value": 210108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653813089, "uuid": "68dda976-e07e-4022-b2bd-9c00025fd5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653813089, "uuid": "7e9ebf92-533d-4094-a2b7-486d5af5fb93", "value": "7301d6126cc0f933a4fa3358a349ef6c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdc6796-df99-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653861005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861005, "uuid": "57779cdc-6f51-45fa-ac2f-42d66691314e", "comment": "Malware payload (Mirai)", "value": "0474cef9a50d719cec4f90b51be05f59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861005, "uuid": "30b0a926-5e09-4f66-b0d2-7d1e432b4f5c", "comment": "Malware payload (Mirai)", "value": "52fa6a2e7f70d445d576674f8968641532127d9646e844dba29526ce9f21a746", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861005, "uuid": "90b753b0-6ebe-4704-a7be-f6b3206baabd", "comment": "Malware payload (Mirai)", "value": "80a4b886601b20470cb35460e3f6d199cd7f39ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653861005, "uuid": "dc3a9951-01b3-4365-b320-18224aef9dce", "comment": "Malware payload (Mirai)", "value": "861cd1cf16d6ce11940565e911aef42c8da4e6810d3079e362234b11d959eb45663b5e5b11802574d392c3cc3fb47573", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861005, "uuid": "7644ada5-688b-4e0f-acfe-73c34e5f683e", "value": "T1F16318817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861005, "uuid": "9e02c310-b633-416f-818b-7ea6cfa9f317", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8kHxouJeZWDFI8zM:GbtexU0r8mCKw2Fbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653861005, "uuid": "f5d76012-2e39-4e57-b409-0d4731ab26f2", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653861005, "uuid": "0bf83bc6-e98d-4913-b87f-0f5da2033287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653861005, "uuid": "5b060179-2799-4a42-a464-2e51e702b557", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4539f12c-df19-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1653806017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806017, "uuid": "6ac5b5ff-cde0-47ec-be17-f5f052e0c7af", "comment": "Malware payload (RemcosRAT)", "value": "2789106b8ca8de56ab5f4344d396530a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806017, "uuid": "81e724d9-65e4-498c-95ee-64d92633a2c3", "comment": "Malware payload (RemcosRAT)", "value": "5365f41c2622c96524db9665805c52e6c5b1374909392eda38452711d1c9dbf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806017, "uuid": "781864c5-2c01-45e2-baa5-ef36f21d6842", "comment": "Malware payload (RemcosRAT)", "value": "b7e9f1c1a27e727b7daf20b7ab1a3e6576db5e42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806017, "uuid": "4e0e1cf7-d6ad-4725-9b83-6b0dbfaa0abd", "comment": "Malware payload (RemcosRAT)", "value": "e2f530c7d297ab11721c2ebb0a4514e44e663195968f81130bdc0ffcc125e71a4573011a221fc5ef0e53c98f1ee36ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806017, "uuid": "2b7e74d8-b989-4df7-8b44-fce31529295d", "value": "T1CE259D62F3917437D97316389C4B97A89835BE103AA87C476FF62D4C5F7A2813839293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806017, "uuid": "20cb6f67-a0c0-40f5-871a-a0cd38557eac", "value": "b3a19c6db5f1f206bed8a9c17a9258aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806017, "uuid": "22c6f62c-dc9b-4870-9507-52a12ff7c47a", "value": "24576:nZ0Wm5sKwupnhhosHke5G+bIbGbtVSn523GB0:Z0W8uioJbG3Sn5235", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806017, "uuid": "bd557e10-98e0-40ff-bbd4-7eda45abcc3d", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806017, "uuid": "c98430e5-c897-4c17-baba-ce291cef4c18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806017, "uuid": "cd5df9f9-8a3e-49b0-98d6-73400e9d5002", "value": "HDFC_BankPaymentReferenceNO12SERDT54JHY6596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ba2e23-df19-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1653806309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806309, "uuid": "865fd299-52ee-40e6-a7d6-c13519447ab2", "comment": "Malware payload (Loki)", "value": "c2d150293a3198af79f47cb8ee22b996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806309, "uuid": "2c99c002-63b5-4e93-a7ad-be62d01a3b6a", "comment": "Malware payload (Loki)", "value": "5c2f7cf7cc4886a0e1905b2de9f1e9b1b376120f1a7a5c82151b6f77e6f77b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806309, "uuid": "4dacb03e-f351-482e-ae48-f1f18f830c4d", "comment": "Malware payload (Loki)", "value": "d555af633273ece2f9e3af8c88565599e2d617c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806309, "uuid": "bc6e22c3-d46c-4452-9410-a2bbebf55e57", "comment": "Malware payload (Loki)", "value": "0ff6086d1ce4afccb519a7497407873656b27b58db5e83a6cdad3f4aaac4e06139f0fb0a97543231c59d029dd0fca508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806309, "uuid": "5fe56674-1d5a-413b-ab90-27a9cb2603d6", "value": "T192C4E1C48367EE75F06873B3716490083B61662D90E5C53A9E9CB1CE70B2B4A5EF5E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806309, "uuid": "b64e12d2-777f-4853-a84a-f1fa4d63901e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806309, "uuid": "fd11d0a5-7f42-4297-afa7-cf085669e2f1", "value": "12288:x6OreqfuMSKtFujQjrTAjkyZ9NOWa+MbHo6:vmxGF8ITmNOWdMbHo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806309, "uuid": "3e4b0cdc-9eae-44fb-994a-c27e08ec2aad", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806309, "uuid": "be8dd99e-af14-41e2-b8bb-d4dba166e132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806309, "uuid": "2aa7b81d-5813-41ef-bfea-c91ab005833c", "value": "c2d150293a3198af79f47cb8ee22b996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb7d60e-df3e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653822080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822080, "uuid": "4647e89e-a807-4bdf-b33b-0906a1087a91", "comment": "Malware payload (Mirai)", "value": "b5437a6f5521f76cd281927cee7181db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822080, "uuid": "55fb388a-c1a9-4469-ab23-58be0bcc4cde", "comment": "Malware payload (Mirai)", "value": "5c95825861d1432f3560ab4bc0021ec7d2f093e145d3f9cc9c24079e8062e6c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822080, "uuid": "ae7e708f-9680-4e44-928f-8be58a3804ca", "comment": "Malware payload (Mirai)", "value": "dd13dcdf4ec2d56e82fcb5e1792be177de14ade9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822080, "uuid": "7df0e354-6fde-4217-8b2f-96ea4930a3d0", "comment": "Malware payload (Mirai)", "value": "83caa6cdf1db332baae03aa873cfb33931bbb15b031c9f180d1053ed4f1a8b348e21b192f5c762ab461c2d9cd69414be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822080, "uuid": "c670c743-579b-4089-a8d1-b727233c1f5b", "value": "T128F2F15B0622AC52DE610A71F7B9014B73757AB6E25472A397220788B6DED0336FC203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822080, "uuid": "08619ee2-8483-4feb-abfb-04459db311a6", "value": "768:aO/BT0EfYlvFh3xcYKQxtShMzblwsoDU1M8bY9q3UELHX:aO54IYLrgHDiBL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653822080, "uuid": "9dfb6fea-ce61-426c-adbe-e43dda76c8c0", "value": 36856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653822080, "uuid": "14a84e52-2566-4c12-abb6-b9b4640b6d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822080, "uuid": "80ef4aff-867f-42f9-b7e6-de803f375942", "value": "b5437a6f5521f76cd281927cee7181db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4022b496-df5b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834355, "uuid": "99748259-8ed6-478e-b916-0ed7c1e9a5d9", "comment": "Malware payload (Smoke Loader)", "value": "9c3afab411767e817f4655bbf94bad4f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834355, "uuid": "6d48426f-cf4a-46fc-b83c-61731b0fb061", "comment": "Malware payload (Smoke Loader)", "value": "5d3bb900041880e4488983a78c7cc2f29d476ec6f54501d980edecbb6f28229f", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834355, "uuid": "720f4b2d-1967-4fdd-9f82-8d02708869d7", "comment": "Malware payload (Smoke Loader)", "value": "10759ebe9fdd5295dbef53d076142370450f0489", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834355, "uuid": "f1464b1b-b9c6-4375-8b30-0d00fe3f6a65", "comment": "Malware payload (Smoke Loader)", "value": "e985b5b6b6d724c2eacc8ae7487d4922df4831b6f8658f82e5a760bf628a189e4a886a790ecb65cd343c6c0849e94464", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834355, "uuid": "62a98b10-8466-4162-a06f-3e45ed702048", "value": "T1D5646B10F693D435F1B712F449B983A8B92ABDA1AB3541CF62D46AEE56346D0EC30337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834355, "uuid": "ea38ff46-5f07-4e3e-8aba-8e0583914584", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834355, "uuid": "0d8f07f2-3a8a-4e87-bf8b-2ca2bbdda367", "value": "6144:xz6aAeZpELW+RW5UrlB9JuP3MnXhDBT3izqU:xOaABL7w5UrhJuIXB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834355, "uuid": "e08caabd-fb0c-4e5f-99ad-8242ad42e1cb", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834355, "uuid": "fa9b339c-9961-4300-92d7-accdddc05cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834355, "uuid": "a59102d7-b7bc-45b9-84be-6de2935e583c", "value": "9c3afab411767e817f4655bbf94bad4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30b56c9-df1d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1653807946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807946, "uuid": "85005360-f1fe-4230-b416-fd03f0b968e3", "comment": "Malware payload (Heodo)", "value": "ff8f9db21997c8e85105304d14b98fbf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807946, "uuid": "6db214b4-6a10-4f14-ad5b-424f6c15d9b8", "comment": "Malware payload (Heodo)", "value": "6208fe595e09c0e47c4edf6b9ae4831129da473532c0f45d29cc62c6bd7b5e6b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807946, "uuid": "a360b725-1b0a-43b0-a52d-c79e8ddf7898", "comment": "Malware payload (Heodo)", "value": "3437c993aa7b0c05e9ebe96075f371a8d503a6c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807946, "uuid": "2a023bdd-3c3a-4ed9-a6ee-5fabcecbe485", "comment": "Malware payload (Heodo)", "value": "f1d79a4a52b23c939768bff70fd13b6e699fbea6cdf34e42d8239cf55eefa8ace13b253ecfa06a6fa6dd087e140063f5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807946, "uuid": "bbc5c519-e4cf-4ed2-9751-a328282b97a9", "value": "T19594CF57225148ABE3637275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807946, "uuid": "61f6faab-f3c4-46f5-9e9a-e86e564d6472", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807946, "uuid": "2711cc8d-9831-4ed4-beb4-f448420af771", "value": "6144:I9wEpo6/4WaPgMIuxqqnAu/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqqnAQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653807946, "uuid": "87b17d6b-3ef9-497b-a03f-894b49aa1fb1", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653807946, "uuid": "f154389b-93d0-49ec-9067-ca7c7db48e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807946, "uuid": "436eaa27-49d4-49ee-8ffd-50dcb8316ed5", "value": "ff8f9db21997c8e85105304d14b98fbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9357111-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653804064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804064, "uuid": "c0867cf5-bda8-4892-ae2a-bc3921696ada", "comment": "Malware payload (RedLineStealer)", "value": "cbbdf20a1cebbc3fdb3033ce6e0bd89f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804064, "uuid": "116f479e-bc9a-40cd-919a-26312f809a9f", "comment": "Malware payload (RedLineStealer)", "value": "64b0b4f8536fc55d8ca14c01f1054d0b85e6bc704dcc43c056776a05f1fde101", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804064, "uuid": "fc61d41e-8d02-4f8b-b87e-2165ba3b7024", "comment": "Malware payload (RedLineStealer)", "value": "7f755bb9a47fe34a8ea46a93bdd314863e95d040", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804064, "uuid": "b786f1e2-fa54-40e9-9065-067e772fd3cd", "comment": "Malware payload (RedLineStealer)", "value": "dc891ed7f0ab14db5e93ab850b24b8623b2a7b97b57c1c68c5810188abbd66e2534b3a8abd2c5fd534b338e9ad4643ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804064, "uuid": "95031db3-0408-4cd0-bae6-c49771a55e79", "value": "T14FC2E7C832A8FE76F11A1F379562D2311B35AF094927C33E67E05F0BBD266E10794A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804064, "uuid": "761525c0-1ca8-47c2-9338-1452b0148f67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804064, "uuid": "f3001c3f-83fb-4ae2-8816-033ee3447b37", "value": "192:E4NM33oe4UHWWec4yfpS9bsT00kUs1wpZ6CuRk9T/EjZa2YVeCp4mRukveH9:AHH44WWNS9bsdjs1wpZ6CB9afgeCtuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804064, "uuid": "3117ed28-d553-4d38-aaf9-ac80ee353dd3", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804064, "uuid": "ff3bf06e-be8f-424a-8e0a-4bbe70b39a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804064, "uuid": "06e62220-4c0c-40a0-bcb5-47aafc1e4083", "value": "cbbdf20a1cebbc3fdb3033ce6e0bd89f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23bf4d2-df5a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834197, "uuid": "af4c5dda-7acb-4ddf-9d0e-75c53040f23b", "comment": "Malware payload (Smoke Loader)", "value": "31de916246fd137905e80d670d5f1b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834197, "uuid": "1f17dd0b-c3d6-4c53-9b0e-1bfe4cab18fb", "comment": "Malware payload (Smoke Loader)", "value": "64e57f479794015bb205b9bf37cfcac5c20087d66343656488502f0e1957e7a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834197, "uuid": "87852fd1-853e-493e-92a7-4477f48a94b8", "comment": "Malware payload (Smoke Loader)", "value": "f4b30b7dbed54e53c0fd236aac6068b40a494976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834197, "uuid": "60fce909-ffa7-4a3f-8982-eebcc203b561", "comment": "Malware payload (Smoke Loader)", "value": "6d5160626818a9c41edd83428b3dc7105904e3ada5fba96be7d64c72ec6d35c048ab3a7c2dae8ef7fdf04538f7e1c249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834197, "uuid": "1c7d9050-67bc-4cc9-824c-ca5d8d7242f7", "value": "T1A7648D107B90D434F1B716F48979C3B8B93ABEE19B2481CB62D52AEE56346E0ED30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834197, "uuid": "2034afc6-00f7-4dee-abfd-0f74b54456a9", "value": "f4cb565e5d7d1a7d80b8c3baae241328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834197, "uuid": "73abbfd0-9b8f-490c-bd8c-97b0294bfca9", "value": "6144:Kx/c7ouLzXVWjiyAOFIh+7yMLCsWi/V1pCjmstbsA:k/cHzlMiyAuIh+7Cx8Tstbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834197, "uuid": "5d73c045-c90c-4a65-b6f2-9ad62fe8e916", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834197, "uuid": "b9bbadee-64b1-4c4d-bda1-e9eeefb3997c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834197, "uuid": "0ee992f6-ebd7-47fe-a9a5-13ae0dbe0f37", "value": "31de916246fd137905e80d670d5f1b45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0357b48-df5a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834167, "uuid": "457d8d61-e299-40c5-916d-fc7ffb3bef64", "comment": "Malware payload (Smoke Loader)", "value": "d58f735c3bad6e69ffe02f22ddc97ce8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834167, "uuid": "1492b2cd-5821-4fff-a8cb-d36efe8a225a", "comment": "Malware payload (Smoke Loader)", "value": "67b2ea8bf7fb9fb2a075da771cc1bf0eb642ef2455bdf871aaeda69715cb6f0e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834167, "uuid": "a51daabd-b9ff-4d91-9004-094bfdd269f8", "comment": "Malware payload (Smoke Loader)", "value": "9ae034e3ed2766af10032aeef97e36cc8f80c15a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834167, "uuid": "64d99679-f7f0-440a-a2f9-cd39852ddf5c", "comment": "Malware payload (Smoke Loader)", "value": "dae4ce54d4db0d0eb81a329b1363bc77db64341691dfd3c8b2e4fce6c248da44ff51b7b72d75d0f16420a96d3499b332", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834167, "uuid": "fe6c1c64-7d76-4301-889e-31a60fbd7536", "value": "T1D1647C10BB90DC35F1B716F4497982A8FB2A7DA1AB2481CB52D47AEE96347D0EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834167, "uuid": "09b0b81e-772e-41f0-bb76-2e0c6820aac5", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834167, "uuid": "2a8c3aaf-1526-4f73-9365-8d684add2ba5", "value": "6144:pMiafeBgV/v+RWCUul/BYYMmCyjBrknD7kxuLAf:pRafH/2wCUuNBYACK9knD7kx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834167, "uuid": "a5ba493a-8ef9-47b1-9851-374051ff9b22", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834167, "uuid": "65d2596c-2c7b-4dac-9cf8-c142d38d2172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834167, "uuid": "45530d41-1f61-4c97-895f-2b5c3f9ba5aa", "value": "d58f735c3bad6e69ffe02f22ddc97ce8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0112171b-df21-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653809338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809338, "uuid": "48736b0b-16ed-499c-bf5c-5a809a40acc5", "comment": "Malware payload (Smoke Loader)", "value": "4ac397ba4a7c7b2f16a2f823a56a3c08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809338, "uuid": "69499f4e-b4e3-444a-b033-454336ff0ca1", "comment": "Malware payload (Smoke Loader)", "value": "6c264099d366cab67ddebfb9ba73213986c66087dec9c6ef6971774439950157", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809338, "uuid": "cb1fcbfb-1253-4383-aaf0-790f6ee0f8da", "comment": "Malware payload (Smoke Loader)", "value": "c508a9d5d08a414e873001d1d615a53718554af1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653809338, "uuid": "60951049-3314-47f1-a9a4-bae7cef79af0", "comment": "Malware payload (Smoke Loader)", "value": "54f9cc2a7a4f4eb233db92c16b91523bac2e9fb2d9bef15b74227c21ebd415b1de2e47b616cb9e21aea0cb98bacb2eca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809338, "uuid": "e57386c9-66ea-410c-8d87-e4ec98fd8837", "value": "T185A5BE22BD9389E7D7B6057C8CFA72CB582778105DE8648E7BE04F4C1E3A6703765292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809338, "uuid": "5413588d-efab-4d65-913c-36c6ab7fa663", "value": "8a059479252721a8bbcd86618e3c9cbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809338, "uuid": "4a5d9a32-9376-46ee-8f6c-072b93214513", "value": "49152:NgCnb1uHGoCIwS4bnaFXYRHuUxXdYR1ZX:NZuHNgbaFIROUxNs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653809338, "uuid": "7fd1365c-257f-481b-96b4-8b9e7e9c97e8", "value": 2070528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653809338, "uuid": "945274d1-66ba-45c5-b10d-c86fbbe07dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653809338, "uuid": "0ef1c3bb-43e5-432f-ada2-2193470c539e", "value": "4ac397ba4a7c7b2f16a2f823a56a3c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4a4b87-df19-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653806057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806057, "uuid": "a4b4de24-bd01-4fde-b21c-48926d395b81", "comment": "Malware payload", "value": "3ef10f90d94961aeb96b46b3f6b820c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806057, "uuid": "7528a614-5c95-41c4-bddc-39d9e6d352a8", "comment": "Malware payload", "value": "6f50ae6dfc12c685179e878890fd801fac676ff20b26e08fb1f18092bff76a31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806057, "uuid": "79627765-e982-4f9c-b8f3-fd53b723c6b2", "comment": "Malware payload", "value": "daafc8a4a6316eed84bbb378585c911ba26620a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806057, "uuid": "afa6e528-f6dc-41ab-9069-50bddbac84f9", "comment": "Malware payload", "value": "124d8a010e359d806350019fd30aadaef1e16538f2ce888e0dd8d2e308be803c0a0b3b0d0c8ea259bc4efb00b7984cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806057, "uuid": "f10663de-fb9c-450f-bc74-7973bcdfae16", "value": "T117D5AD16EB4619BAC943637285CB97377738FF104323EB6BAB09DA31AC232D16D06355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806057, "uuid": "c7563cd5-3637-4110-a86c-74897f08f37b", "value": "0629c55152d38b4029f7de8a08e08d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806057, "uuid": "3f9f0c4a-6f5b-4162-8748-986fca4c2c3e", "value": "49152:2b4eJPK2juhGxHmrgr14o9yyb9Mgr5i7wIh:2c6K2jsOm8h/yybGgr5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806057, "uuid": "40f2b657-bdff-4eb1-92ae-7b909816a505", "value": 2979496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806057, "uuid": "b8642f44-636c-4a57-851d-b744023b5b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806057, "uuid": "d1424eb7-f62f-49a4-be39-e6b17950ee1d", "value": "3ef10f90d94961aeb96b46b3f6b820c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbd6ae9-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1653804071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804071, "uuid": "034d6ca7-6b95-4311-bf5c-cf5193ce91c0", "comment": "Malware payload (Gh0stRAT)", "value": "e44af48124963322b13c05518c8299ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804071, "uuid": "fc780c55-d9ed-445b-b39b-324bcdfeddd1", "comment": "Malware payload (Gh0stRAT)", "value": "7027e7c8ac1db327ff484f153b56767121d306264332418047b1c3bcb78613d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804071, "uuid": "097baea9-6780-4768-8908-04f942cf1e11", "comment": "Malware payload (Gh0stRAT)", "value": "be11e6b4c81f705e719f8dbf7555020fdee3d4c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804071, "uuid": "15f00d53-e908-4f92-932e-f47295495178", "comment": "Malware payload (Gh0stRAT)", "value": "176eab229ca2e6c339c3469dab1966aab25f3306c051a141aed378829aa4e93dc4b98c6566a00f6d53afbbd53ddc3758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804071, "uuid": "329887a1-eee4-4937-96f8-0c49f1d0be42", "value": "T11185F0017BB5C435D261623208F6C73936A5BD61AB34A7C77BD03E2E6E315C2AE38365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804071, "uuid": "c4b328df-12e9-4cb3-94b1-f912c774af02", "value": "90235c766762e36de0fa9c8867729295", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804071, "uuid": "8d49f39f-79bc-47da-8a02-45c155315938", "value": "24576:umGZgAYEaFiZb8xcTmkA92ZeemXdTDnCzwEdQY1RRdvinfTfYvBn5z23N:FnEa01JxqHTPCznV19cTy5z2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804071, "uuid": "efe12b12-aa96-4589-9ec3-ac8a9656ad2b", "value": 1707520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804071, "uuid": "23328da3-c9c1-47cc-98c6-0c56d5c0f57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804071, "uuid": "095be199-7157-4fd0-9183-fa4e705614f6", "value": "7027E7C8AC1DB327FF484F153B56767121D306264332418047B1C3BCB78613D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42d5de7-df5a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834227, "uuid": "fc782030-49e5-4a30-a119-6b7490df1a21", "comment": "Malware payload (Smoke Loader)", "value": "fa86f89afab84bea33de01d50a56fc1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834227, "uuid": "7f227c0c-2547-4031-811b-0cd8910712f0", "comment": "Malware payload (Smoke Loader)", "value": "712b9c35cccb19d613a72ca131dfea33aea7b6e59b0dac798f5435993a33d991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834227, "uuid": "8d436ee7-57d0-4db9-8234-4a50d83a2d93", "comment": "Malware payload (Smoke Loader)", "value": "0632b38d3ca887e4b4f21ccf83edd2e0a34fc545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834227, "uuid": "9db6c8a1-a09a-44a4-89dc-dabcfaf81c29", "comment": "Malware payload (Smoke Loader)", "value": "28bf0bf4923dae922a19332d6322fe3316ff2ac470acd1c12e3d7c563bd5d8fe610c756822b1c9c8a57d0a6e0c347e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834227, "uuid": "9c2ffa7d-1e61-4024-8b85-5f157ab79541", "value": "T1CB646C10BB90D435F1B716F5897683ACA93ABDA19B2441CB62D63BEE57346E0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834227, "uuid": "736e29aa-5c5a-4574-bf36-ff15c6d16f04", "value": "f4cb565e5d7d1a7d80b8c3baae241328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834227, "uuid": "ddba0b16-fc9f-4dd3-b452-c817770588f5", "value": "6144:72/37gHbdiVWjJykORkpRLZMfQkx7liK5Opao5wU+gPZ5:S/3AdwMJykqkpReQuxOpaod+W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834227, "uuid": "52fa0885-7aa2-44b4-8b73-9a8514f2b44d", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834227, "uuid": "137a0850-66ae-464c-8c83-f3bc6a3fe50e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834227, "uuid": "0b290026-477e-4bf0-863d-804f7bdecb10", "value": "fa86f89afab84bea33de01d50a56fc1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7271646f-df6d-11ec-93bb-42010a9c0043", "comment": "Malware payload (IcedID)", "timestamp": 1653842170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653842170, "uuid": "7e8a4e59-3a0c-4d63-9d33-bc9f24e15fed", "comment": "Malware payload (IcedID)", "value": "47d8aebb46cc914d1eec5c4c917907f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653842170, "uuid": "a2a8ce88-0af0-4905-b211-80916cb7e535", "comment": "Malware payload (IcedID)", "value": "71f1c8e85b4187c34451aea70125e7f21759d7e24ada3f74c4d0e6df6d583e4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653842170, "uuid": "a56c3708-eb40-483f-aa09-d4e1b449793b", "comment": "Malware payload (IcedID)", "value": "a0f4517f0ad6ffa3e759b7aac338ad901f5457f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653842170, "uuid": "0ccde6d4-59fe-41d6-8f88-0068f7a088c7", "comment": "Malware payload (IcedID)", "value": "74f57065909d24069081db371bc281cf0266449fa00db6acd189666167d00832b22ab7f1c1f52b61a9b390a406b48f39", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653842170, "uuid": "d2c43c19-ea32-456c-b47c-a6ad038f74d3", "value": "T199847D56F6A404B9E0B7D1388D778506E7727C8A07A086DF23A4466E2F33FD0593EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653842170, "uuid": "35b71ca5-2f14-4cee-9c1e-a95cf30bc274", "value": "383ea2ff396b811477575576325992b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653842170, "uuid": "5b63beeb-d43d-49f2-b530-2a7d4f7f17cc", "value": "6144:oanAS7ru7NUQAYsL6RSVaaCslY3xatmvoLAoh0QJA/+DajuO8e+S:oaCUhYsLARqcat5cok7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653842170, "uuid": "5cff111e-5e87-4317-a2a3-c37605884dc9", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653842170, "uuid": "30fd2e4f-f44d-4615-b1f4-c84750d86442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653842170, "uuid": "99bfe487-70a9-43b1-b72d-c33c0e075dfc", "value": "71F1C8E85B4187C34451AEA70125E7F21759D7E24ADA3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec390284-df84-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1653852253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653852253, "uuid": "f647099d-84ac-421d-9df7-b48f1588dc20", "comment": "Malware payload (NetWire)", "value": "da3cc2973d7e10732123bd8e248aebd9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653852253, "uuid": "c5515736-6b4d-41a4-9609-d2377ded690f", "comment": "Malware payload (NetWire)", "value": "72b5c1eee8f0fcfef6817c8858f1661de269386ce804f0caa87b47bc081d7d27", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653852253, "uuid": "2c8fe483-55e7-4255-94c3-1fa5bafb014d", "comment": "Malware payload (NetWire)", "value": "2288b83cc9716f82e8f95962e65335ea9d4b5509", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653852253, "uuid": "ef5c1754-ce7c-40e2-a1ae-5dc8474626b9", "comment": "Malware payload (NetWire)", "value": "e6ede62b5dee69c94a950d07c72edf9edafe06faa06841d96e83e819f9874033a6b9d1a59fb03e14375c10012cb40dd6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653852253, "uuid": "975e6fd0-b2a3-4046-aed8-4df528984686", "value": "T11FE4233157FD078484FF618D10A641CEA921DB13726EEBEC89930ED16DAB1F6A051B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653852253, "uuid": "712deb89-a7df-49c4-b7fa-a15cd328b314", "value": "12288:O1oI5fj8IeA2Sk4AsAs4DJ9m3qbDW7Pg4SRX0YJMSyWQUlEPdk120Kc95IuhL:O1oI5h2SkvprmabDWjkREYJMSyWGdQ99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653852253, "uuid": "91301196-5783-4df8-9674-969264f8ad40", "value": 713625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653852253, "uuid": "9b57f76e-f217-4e6b-a287-1ea7d11f2cc8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653852253, "uuid": "4c5e089e-8280-4060-abd8-db9c79b77dd5", "value": "PO1153652300.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee03ad3-dfaa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653868202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868202, "uuid": "924fc3d1-1221-45db-8b84-a137765c0610", "comment": "Malware payload (Mirai)", "value": "88ef46b9e91310071f0fe99c8c6af9d0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868202, "uuid": "71abe796-a7ea-4efd-a66c-b6beb1525feb", "comment": "Malware payload (Mirai)", "value": "776ec975c58e9b1b5aae58c896c69827845fb29b1d096e8db00aea5690a13a79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868202, "uuid": "ffef290e-d49f-46e6-b129-95b8765213ab", "comment": "Malware payload (Mirai)", "value": "2793549ad2288605672c048906eee434c551048c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868202, "uuid": "5e53be23-93b7-4f83-b792-35f0b19f747f", "comment": "Malware payload (Mirai)", "value": "4419c8c7d587af5ab32a2fd65c21d579a1d8c347b4b3b6dee5923056c0628ec0e84b7b3e9a46ea0ce560279dc2355aa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868202, "uuid": "79981e0b-73ee-42e7-970a-a0877cb2ce1d", "value": "T11AD2E1B1EF58EAD68089B7349D5DCC5E30DCB5721F3E54080A810957703AD06B6F4EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868202, "uuid": "3d6515eb-bdf7-46e2-b763-e211042dd85a", "value": "768:3N8f6tfoQmQAXV7E7QDvjnVAiSZd8H0GuOZk3SYwqB:9MJXFl7+QjU6uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653868202, "uuid": "79c6b9d5-d35a-4e62-b881-bec570a86a25", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653868202, "uuid": "81b224fa-92f0-4784-ba2a-55c96030ec3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868202, "uuid": "5fac5417-04df-40c7-9d92-222040f51118", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c786c4e-df5b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834429, "uuid": "8cbe2432-6097-4787-b340-c94cf4cb3f9c", "comment": "Malware payload (Smoke Loader)", "value": "0f88b239676648cc46f86f6065a718f7", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834429, "uuid": "23ed15f3-e156-4c7d-b924-c028991668bd", "comment": "Malware payload (Smoke Loader)", "value": "7b92106a488a7894918ca3ea16e1eff6c59744b5aefef69427de081f3765ddbb", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834429, "uuid": "fe1fefd3-e6be-490b-8260-0881dccff9e3", "comment": "Malware payload (Smoke Loader)", "value": "4830757be55eaa2b077cce1346f425295255c0d3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834429, "uuid": "223b849b-7c34-4c79-985f-6a917a63069e", "comment": "Malware payload (Smoke Loader)", "value": "44dea4ae12fd344000591c0e3e162d6ddcd707f180328a165c2e5279c23db13bfdfbf6c619b0c6de475ed349b228a623", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834429, "uuid": "ff93a99f-5499-47c2-97d7-83b7f440eb74", "value": "T148648C107B90D035F1B717F849BA8368B93ABDA16B2485CB63D43AEE56346D0EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834429, "uuid": "426faa38-137e-4855-b292-5cdd7210987f", "value": "54ebcb663ea607f54ee2ca56ede30f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834429, "uuid": "6f280bfc-c193-4d8b-935d-570ec41912e1", "value": "6144:ufNT5bCoS+v1T0KrhKtRIKNp4+34bS89R+t3PRj:+NTdf9T0KNKt74CTuU3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834429, "uuid": "b157f310-accf-4a01-9d61-d3022237d1dc", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834429, "uuid": "0b02b262-7f2c-444a-8baa-3a7dfb2a8fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834429, "uuid": "167c89ad-82a5-4043-b0ee-99ec24e271ae", "value": "0f88b239676648cc46f86f6065a718f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbac492-df19-11ec-93bb-42010a9c0043", "comment": "Malware payload (QuasarRAT)", "timestamp": 1653805947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805947, "uuid": "dc8f719d-6166-41d2-81e4-028ffd7b7be1", "comment": "Malware payload (QuasarRAT)", "value": "2091194abd7db18a0adce2940cbe832f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805947, "uuid": "e155ae11-7d58-489f-a765-3799ec8e3243", "comment": "Malware payload (QuasarRAT)", "value": "7cd9fa6a0ed363ed654c8257182eb2455e952ac93648fe5af6455bed468a9ac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805947, "uuid": "e1b46068-bed1-4626-b5e7-db393d062e28", "comment": "Malware payload (QuasarRAT)", "value": "608aa862ad4370a0bff8479217f7b14b5893cdd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805947, "uuid": "cb68f52c-ac67-460b-b538-246bc58a508e", "comment": "Malware payload (QuasarRAT)", "value": "e10309c61d6563bed1938be2e7d1618859ed461ab6fef48241cbbf510c15c27eb8873e262e24d928270f392fdad1d904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805947, "uuid": "d77a536b-48f1-43fc-bea0-e7e6206b9471", "value": "T1F6B45B8123FC851BE1AE57BDE4B10421ABF5F407A6A7EB4F4940A1F93C567429E807B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805947, "uuid": "d2fe1c3b-b451-4f2d-a45d-262ed85a03dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805947, "uuid": "498ede1e-9441-4995-8363-df05756bf525", "value": "12288:ETEgdfYfdo6TDOtQ4Dyw0HpTVLYxE4cdS:JUwFzyFyw0HpTVcG4cdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653805947, "uuid": "258fd870-9677-41fe-a764-e5cc782fc5dc", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653805947, "uuid": "37a5671b-7b5a-4815-ac5f-ca79c37d9e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805947, "uuid": "2da6cc85-1dc3-41aa-8500-9978fd851962", "value": "2091194abd7db18a0adce2940cbe832f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a032e3e-df6c-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653841592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841592, "uuid": "093ea376-934d-4016-a30f-9940df40dde9", "comment": "Malware payload (RedLineStealer)", "value": "07e1b8af1465568353872058bf494d18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841592, "uuid": "342f8e3d-3031-4dda-b07f-cc89c758b653", "comment": "Malware payload (RedLineStealer)", "value": "7d404987992a4c6a08d9fe7c240556b74a50d67466ff2fe8811b45c304a7fec3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841592, "uuid": "b6fb8b0a-26c6-42ee-a7f1-3875832ff303", "comment": "Malware payload (RedLineStealer)", "value": "61bba99fafc2726250af06be7843b7c77c004a6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653841592, "uuid": "49f2ac97-ddda-4d9c-88cc-1b82613976a3", "comment": "Malware payload (RedLineStealer)", "value": "93f49666afbd01578e6f5ec0644a77204b25af705ac4c43fc2093b3a64fa9b6cec97d6414744de53ac2e21a8f02b6d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841592, "uuid": "e160ebf2-9285-493b-8737-3a967dc8b19b", "value": "T17B649F0434E14433E43319334AE4C565BA3CBA210BA558EFA3A47EEEDE607E0A77C9D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841592, "uuid": "ffdb6d4e-78c5-478b-950f-993ac33f0aa5", "value": "c114161e4dc497dd46e915789468fc86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841592, "uuid": "fd06a22a-206b-4a85-949b-510732d2a62f", "value": "6144:D9oAdBhXnbCib7zW7hAOYwr/4WwCHRAC0QA5hNo:DGAdB94NV/4WwQAF35To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653841592, "uuid": "4a4ab0d8-66fc-4d97-b68c-313263248194", "value": 308576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653841592, "uuid": "852a1496-f04a-4115-b48c-6e3297a63736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653841592, "uuid": "18e851a5-9c28-456f-8d15-954b1fcad2fe", "value": "07e1b8af1465568353872058bf494d18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b622e0-df0d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653800761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800761, "uuid": "091a9365-36d8-48bd-bcd8-9164b5caec2e", "comment": "Malware payload (Amadey)", "value": "aa6e78d5a8db1f174e6ca893220e72eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800761, "uuid": "6d3d374a-5a7d-4dd1-b8ac-cbf4b6d5286a", "comment": "Malware payload (Amadey)", "value": "7ed6e17d4eb4b8124ec1dac5ef69265d24c5fd7e9fb39e8a35b8f20cb9ee8edf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800761, "uuid": "7343721b-95d8-4eb2-b331-4b5ab3635947", "comment": "Malware payload (Amadey)", "value": "d5bd12e874f112f6f4b2ceea1ceb21aec6622b6d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800761, "uuid": "e8fbfebc-d3cb-4a10-9ba1-63a5c818c2eb", "comment": "Malware payload (Amadey)", "value": "cde92005cbcdc5017cb12a09d4995bdaa5cd4a4db18de957a5f12a4670d2f92245e836d6bf2b7de69934b46db3d8d253", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800761, "uuid": "2af1ddab-1b5f-4608-81f0-a77c5f57a104", "value": "T118D523C78AD4F9BAEB8725F5EE2C82477B58340CF41839C597189D4BA81AF8363875C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800761, "uuid": "d62b4a67-c0d2-4c00-91d4-f9187a68f7c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800761, "uuid": "2394b2bb-a5fd-4fe5-bf63-d0f886115821", "value": "49152:foXP/8UQPzyiKRvkMxnMYnwYbM289Y2/PTrRYZOcJ2T/WGk:3PyvkMxMcYHRW12T/vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653800761, "uuid": "9965b4aa-7820-4f74-ba3a-c6505aeebae8", "value": 2869760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653800761, "uuid": "71c2d4ed-e879-4bf4-ae08-bb9a69abab3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800761, "uuid": "d727d0c0-4da3-4487-ba13-9279f3974a19", "value": "aa6e78d5a8db1f174e6ca893220e72eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b56f31-df8f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653856827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653856827, "uuid": "fe8fb891-fe11-45ab-b55b-804e2b0a80a1", "comment": "Malware payload (Amadey)", "value": "ac9ed62c51f841daedf7c510d0656529", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653856827, "uuid": "50b8d301-7b36-4486-bc28-2ca17611c627", "comment": "Malware payload (Amadey)", "value": "7f55c1b5c5b97c08b970a1a6f7ca2f7f5de776be6cc74bb644cc6c893bbaf189", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653856827, "uuid": "aba75fa7-e389-413b-9c1d-d283c59b1a8a", "comment": "Malware payload (Amadey)", "value": "962c1194002db77d06e3961f9b1848c4584ef27f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653856827, "uuid": "f6f2a42d-91f7-4087-8506-9f280956b9f3", "comment": "Malware payload (Amadey)", "value": "8291ea81e0ab03abcce0f7ab97150ed1231b54a56157c1a974527e1482b38a7d5e842f3d9688adeae6ef660021761652", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653856827, "uuid": "ec67c5ad-c037-4da5-a9c7-ca764ab668a5", "value": "T1ACD523614718D23FEF049738DBAF13CE4E18925DDAA02480F42D35D772BA9A068777DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653856827, "uuid": "0dd831ec-741b-4c16-8dc6-2f1ef20a7f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653856827, "uuid": "83074ef3-adcf-4005-b490-6da41cc0e627", "value": "49152:l8lC4FaHChjtoLpeE2nkwolpqefrCI4uUr0m78FQbvgysCECXEK5p68v:l8FThxoLpeE2MpqezCduUr0mXrmCtXN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653856827, "uuid": "4146f558-60ac-464e-8063-4fc7b462116a", "value": 2923008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653856827, "uuid": "67bb41b5-17a5-48a1-9a52-13d1ec61ca37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653856827, "uuid": "62f7da3c-078d-4826-ae11-1cf933dea594", "value": "ac9ed62c51f841daedf7c510d0656529.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30103562-df75-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653845495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653845495, "uuid": "bda83f0d-6044-4812-a9fb-db1edb23b12b", "comment": "Malware payload", "value": "b413ff6e943c415afc26640ff535c724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653845495, "uuid": "5e4f17b1-9d73-49c2-b614-dcc74e79681f", "comment": "Malware payload", "value": "7ff0ff6e51a58398ad73da3cc8e7e6233a23e49d93aaa4b190672e4f9f08b9bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653845495, "uuid": "bda6033a-fac1-407a-b724-e247d1dd6255", "comment": "Malware payload", "value": "fcc13d52bf28416f3b8a594d58113fd8828a4093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653845495, "uuid": "0a3584f3-e26c-49ff-8298-6ab91451073f", "comment": "Malware payload", "value": "4a565d0cda34e39a634b79fe725b06d605b70ad19b01b2e73832a7d055e815239e03f56f194529406d80fd4c57bd705b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653845495, "uuid": "6adb8a7b-0422-417d-a549-7335ca4be0de", "value": "T11CB51A135A8B0E75DDC23BB4A1CB633E9734EE30CA2A9B7FF609C53559532C5681A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653845495, "uuid": "69a477e4-1d2c-4e0d-a09d-5e7d400f410b", "value": "d0dfe559e003c7370c899d20dea7dea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653845495, "uuid": "6fd0fa9a-f874-4cfa-9744-2c4985438cff", "value": "24576:dofQL0YjKOTrGRTnFZUDt4KZHD6XyeOjuTfedlb0hv4d7KXl8p+NauQ5V3h357:dofQL0YjKOTrGJ7C5iOjuTWdlxd7Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653845495, "uuid": "592acee2-f244-4676-a485-8ab1d24e763b", "value": 2476494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653845495, "uuid": "36792d46-9dfc-40c3-8c32-ef872bce5c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653845495, "uuid": "871ab0e0-80fc-4349-99cf-5d4eef3383a5", "value": "b413ff6e943c415afc26640ff535c724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8769645-df92-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653858179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858179, "uuid": "637bec26-d2a6-4773-bef3-0c3b942a4005", "comment": "Malware payload (RedLineStealer)", "value": "e01e4ebdceade8f7f9e29a3c8bceb7a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858179, "uuid": "3cbbaa32-4afa-408b-99ed-3976646a1e04", "comment": "Malware payload (RedLineStealer)", "value": "87a643f05a4a942da305e22222193770bee9ecee4f7f0442408445336bf1c8ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858179, "uuid": "ac73ef8b-8450-440e-9df8-3f35d141f8fa", "comment": "Malware payload (RedLineStealer)", "value": "f531072ea44f2ddbff5670b9c47030a235aaa97b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653858179, "uuid": "29ae556e-97fc-4902-be91-2fd2afd6a03a", "comment": "Malware payload (RedLineStealer)", "value": "eb597a8dbf0115b5e377e5f1ad2f8b6efb9d973a275a89c81f972846505c6e7992ba5ac6580ff55826b01819f5e007f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858179, "uuid": "0f4ad504-dc16-420d-b25e-86658372636e", "value": "T15B74F1C575A4CC32E5B34A380875C2746FB7BD32B974C54B3780233D6F712A1AAA57A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858179, "uuid": "c93259aa-7d9d-4241-9559-c1ed4da0726f", "value": "04acecae68698df6c0d2bfb43d12a27e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858179, "uuid": "5b1f47d3-4381-4ab9-8d8b-1bdd92cc3769", "value": "3072:4ZA3LP/8lKwd/VXV41N3QPjeoWKLgajNib2CIA6dnarCVu3MX6ZKH0KTPkZsGfwl:qA75w9FV41O68gajjLnar6CIH01sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653858179, "uuid": "48d142fa-a866-462d-a1c1-9af7225bc706", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653858179, "uuid": "b783343e-a9b8-4e98-b0f9-fc9c241bce4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653858179, "uuid": "4e8e1b8f-a278-41de-911f-786b7ba00caf", "value": "e01e4ebdceade8f7f9e29a3c8bceb7a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ed25cc-df50-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653829826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829826, "uuid": "0063df1d-f937-4577-97ff-5d9a0083d450", "comment": "Malware payload (Amadey)", "value": "b3cf3bf1fabffd6d6af1cff6a2c1304e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829826, "uuid": "35abd681-8004-4339-9b16-8f44d06bfdc7", "comment": "Malware payload (Amadey)", "value": "8859260318fb3b004aeabee2568ad31516c5882e7efd443b6934312a66f7b661", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829826, "uuid": "30733779-9329-4ded-b4d8-cfae2cff7155", "comment": "Malware payload (Amadey)", "value": "46613f6d72e5446e583664d2b56d5cbd1753ff5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829826, "uuid": "c89ce966-ed5b-4d06-a952-184476cfab32", "comment": "Malware payload (Amadey)", "value": "8ebabaacf6a86b22dc6d785b84b7915243b1a264be87fffafe57a339d96072fd68ca6de03ef8a557a60b2c89d61f98b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829826, "uuid": "82fae155-c393-4950-8c93-1ff00df2ae23", "value": "T17554F16061D0C436E0AB66384971C9743D7B7D32ABF9494B3384671E2E31391B674B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829826, "uuid": "9fe44ee4-cabf-4488-a266-db6c4241b1fd", "value": "3b5b71419f19c89ea7002a31140d85fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829826, "uuid": "020c5d87-3f95-4bfa-b6a2-c98e0b61d3b4", "value": "6144:jcZIbSYDD5KLfJWnDxru+KMBVI2YZ09xeD:1uCtgktrHjBVI2xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829826, "uuid": "18219134-c049-4a93-a733-3d0992fa9829", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829826, "uuid": "f4855425-b86f-4e92-ab2a-82b9892d11ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829826, "uuid": "303c240f-f5c1-4d71-870c-7df68da26a0b", "value": "b3cf3bf1fabffd6d6af1cff6a2c1304e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21a6d12-df5a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834090, "uuid": "4f01196f-9f01-444e-9c47-bce57f0d81c3", "comment": "Malware payload (Smoke Loader)", "value": "fed9dbddbf5abad910d34166c2725a54", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834090, "uuid": "26294477-92e8-4c4a-9f54-d634f0a73d7b", "comment": "Malware payload (Smoke Loader)", "value": "89d454fd9567e1a4fea94ba3a3712373ab809be8e88a9f6f29b499048beaeff9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834090, "uuid": "b068d85a-6dd7-4400-87e2-21d77ba62a80", "comment": "Malware payload (Smoke Loader)", "value": "f43fdb91eb5fa1d19a7225c8ee8b73c1ec4dbbfa", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834090, "uuid": "54c4b138-cb6c-40b0-98e0-34a2a0c36e1b", "comment": "Malware payload (Smoke Loader)", "value": "ab5f55898a6487a05c8c75d058881829ecbbf38f92c2ec54078ac830ead2230be522a8702eab1a50e17f2064d6bee015", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834090, "uuid": "dfe4717e-8e88-4301-8b4e-3ce972a9db0d", "value": "T151647D10BB90D434F1B712F4897AC368B93EBDE19B2451CB62D56AEE56346E4EE30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834090, "uuid": "a89b9633-ae68-4683-9abe-60b51e4ca2a1", "value": "c5df5f515f76bb815fad87fade1c304d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834090, "uuid": "0ca80d1f-b9fc-4c58-b95d-db87479314a3", "value": "6144:mtVacepcnS4+RWAUJlamNR0M5uHoBIE1VBYgy4HFvSAx8i:mXacRStwAUJwmNR3uIHmUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834090, "uuid": "6e1f6a02-2081-4185-be59-ef8f97397621", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834090, "uuid": "134beaa2-528b-4e27-b618-25b9a5b231e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834090, "uuid": "e24779bb-171a-407c-b564-f0207f13b043", "value": "fed9dbddbf5abad910d34166c2725a54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2029cba0-deee-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653787486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787486, "uuid": "2b425b79-3f21-493c-aaba-a194ed59100c", "comment": "Malware payload (AgentTesla)", "value": "99429e81f51eb96a9eae1753ae5f14ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787486, "uuid": "c579f239-381a-4ae1-94eb-ec5703d26929", "comment": "Malware payload (AgentTesla)", "value": "8f6519653bfad6ade33537621fffe65e9045703f466b07326ad7ce0bd28e98a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787486, "uuid": "c6e56cb9-e245-43b8-a3aa-cb57559b83a4", "comment": "Malware payload (AgentTesla)", "value": "d2d9e47f37b6cfe64f4a5c3bf8e03b2c6791e85c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787486, "uuid": "d1444f18-e255-43ee-b5c0-0e1201de3aca", "comment": "Malware payload (AgentTesla)", "value": "bf2fad2a55cfb9d01363fbea368d88d1ab39f92706729340607eec1448c6bb766c4c014eca577f1ab14a6ea633fddae3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787486, "uuid": "f4a10d02-b886-4ae2-87c5-050cc7099d9f", "value": "T1D7E4E1849367FF72F52472B3756580082B61162DC0E4D53A9E9DB0DE71B2B061EFAF0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787486, "uuid": "feca164f-8f71-4866-93e8-a06bc9db1a68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787486, "uuid": "27d7e471-35ec-46ee-9fc4-10136bfd8d6c", "value": "12288:dwtny5tOOttttttRtttttttr2y+5cx3Y343aQeWvvbUmm9dTUpM01GkF7j7Fvx2a:Gtny5tOOttttttRtttttttr2XqxI3Aas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653787486, "uuid": "e49b1587-c3d2-486e-abd7-7c3eb030eb3b", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653787486, "uuid": "1e10cd32-a0b2-4245-8b13-900448a15bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787486, "uuid": "66cef815-b13a-421a-b089-e5c062c53b32", "value": "PO-4093021b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9a41cd-deee-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653787859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787859, "uuid": "413239b6-4623-4b8c-adfa-1d19b27e9c9a", "comment": "Malware payload (Mirai)", "value": "6147d3a3ebb778cf948061ffcbda53d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787859, "uuid": "2bac9180-a857-4df2-b355-d6201f0e40a2", "comment": "Malware payload (Mirai)", "value": "9279e353f296d1e115fa32cc01b0fd147a61d1a1d9e1c9f08a7124181a30ee52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787859, "uuid": "2ded68c4-e26b-417c-99a4-1742e0fb9286", "comment": "Malware payload (Mirai)", "value": "cbf78d38858f88c8de44537579df5506c5b9672c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787859, "uuid": "6c04a266-f777-4ae7-a2b4-4ebf725a9498", "comment": "Malware payload (Mirai)", "value": "cfaa0b77731f518e7b1270c9297a59c841a1d2277cb64ba174b5c2f340a1c2248a68ddd30da749a39fb7c60aac1be4f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787859, "uuid": "c810f51b-99b8-4997-92ba-49d1b6040ba3", "value": "T1C6632985BC91AA26C6C05377FB2F008D3725A7D8D2DE32029D156FA0778AC1F0E6775A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787859, "uuid": "0f39f176-d8ca-450b-b410-fa6441c4b3c5", "value": "1536:4jkMs+d8N8+VDC8rknJWSUusRGw8N49L:4jkM48+kgSPP9N49L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653787859, "uuid": "5b4725f0-cfbf-4569-96af-26db692d7395", "value": 68784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653787859, "uuid": "c6900aaa-310e-4cbc-b32d-f1b7afdd9da0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787859, "uuid": "eacef0f6-22e5-4d8d-9633-da41808621b6", "value": "6147d3a3ebb778cf948061ffcbda53d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8f0cfc-df71-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653843907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843907, "uuid": "f724d6eb-84ce-4259-98a1-635a2197ed1d", "comment": "Malware payload", "value": "a58cd6b905179887fb493cc62089d5d7", "object_relation": "md5", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843907, "uuid": "ff5dca20-c94f-4b7a-a398-e87dae08e586", "comment": "Malware payload", "value": "9830bd16aedd4387da7bbe79c4e036b60b005df5d2964626c10be2d30257c35f", "object_relation": "sha256", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843907, "uuid": "3a323773-24d7-4f0e-a4c5-58702b633072", "comment": "Malware payload", "value": "132f4ae26954a39b7404b6ea52265e3ad538b52b", "object_relation": "sha1", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653843907, "uuid": "2af8b6f2-0c89-43bb-bfed-f2c6f25b2fbb", "comment": "Malware payload", "value": "1df6cbd8a9eb5a5690f9f6088345904d5e716442d8a259ab676c9d50e931ba41b5171b8291d01ac2318bde055cb65f98", "object_relation": "sha3-384", "Tag": [ { "name": "CL", "colour": "#5EDEA7", "exportable": true, "hide_tag": false }, { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843907, "uuid": "9e19c471-a94e-4e84-90b5-89f8250a4c0b", "value": "T130F5CF26759AC637EA7E8270652DCB7A60B97FF00BB144EB63C4592E0D744C102B2F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843907, "uuid": "b89ffefb-158f-4004-8a8d-97b8a8a323c2", "value": "98304:1tMKAptulbxKO1fTCcOjSEPYqDu5+tK3HyfKSFde:1LxfTCcKtDu5w+HUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653843907, "uuid": "94fb0f08-126b-4d63-9c81-ba49f9c81969", "value": 3406848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653843907, "uuid": "36f49f7b-c96b-401b-8ce6-cf846068a525", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653843907, "uuid": "f5a13470-8fc0-49c0-ba3f-ccefc9bb70a3", "value": "MTT002140001451.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00473052-df51-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1653829953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829953, "uuid": "44955bf8-a944-469d-89de-4876de974a1a", "comment": "Malware payload (CoinMiner)", "value": "4079db71862ea4fd16867ca6df4b50f8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829953, "uuid": "cd39a689-124a-4bb7-88c3-ecb36218b48b", "comment": "Malware payload (CoinMiner)", "value": "9e23fa0284eb968a9fc2e2b0d03993bef470cb1405676b66c4fa05c746ec1410", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829953, "uuid": "52827d10-d625-4ecf-82c1-6450b02ad18d", "comment": "Malware payload (CoinMiner)", "value": "1b30e3faaf77c9e763059e5af7c96a96a78c58f3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829953, "uuid": "638d99b9-beaf-44a2-81b8-47491826ac7b", "comment": "Malware payload (CoinMiner)", "value": "ce86e8f3e3d55cc6268e2902d59b7c4c2b92442db847341b9b7ec453b4d98483aab2bdc1f67d3c86f2d3adad34da4014", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829953, "uuid": "33b87cbd-d46c-402a-89e9-987287cb13d9", "value": "T145C4121B721092A1F48C0832581BDB785E35BD55DDC18B4FABB0BF8EED716D13A0A24A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829953, "uuid": "d08602a1-1c25-478c-aec7-f9bdc3790e2b", "value": "b78c7836a924f9a31372fe7f8bcc6142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829953, "uuid": "d3a59a25-5186-4635-b0f3-18b94629d081", "value": "12288:xQEtoYqimyWtCgLdqbXY+s6Rtx/4ctNNjNp/PTxIPopaFIDpqU7:xJlqHzd8Dn9QctjTWokq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829953, "uuid": "cce981db-0aa1-4022-b1cf-a89aa6c9bc84", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829953, "uuid": "8d750e18-235f-439f-b072-c3817549b824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829953, "uuid": "42b5d153-54c5-4168-9ae1-139a245ccc95", "value": "4079db71862ea4fd16867ca6df4b50f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba441f70-df50-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653829835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829835, "uuid": "cd483553-4f60-4691-9c65-1403116c66bf", "comment": "Malware payload (RedLineStealer)", "value": "7cac0bdc9b78b550849b9a6fc272be23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829835, "uuid": "f1ee1c81-9ee7-4894-9f33-84b1dd7b06e5", "comment": "Malware payload (RedLineStealer)", "value": "9e29af6ac4f0e8a2d70dfcbb00c3a43d9d3bf5991068afae5cea53a6d25e0cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829835, "uuid": "b853c77e-f62e-4ee2-bcff-cece356b79b4", "comment": "Malware payload (RedLineStealer)", "value": "f17c9c2ce1b35d5119fe77d9c3facc54a0a67bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653829835, "uuid": "0a31b8c3-a50f-4ff1-9f10-bcf0d7af27a6", "comment": "Malware payload (RedLineStealer)", "value": "e7cf13ccfec89fbae1879bef68153abcd2c8ab4acc0afb892a0110fd6352b202bf7ffc202753df4a14cedf8b9d99d18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829835, "uuid": "a8ab5ab0-8955-4252-85b6-31bdbb76c8d1", "value": "T1D0C209C472A4BD76F50A1F379467D2315B35AF094826C33EA3E06F4BBC166E14B90EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829835, "uuid": "b872c153-90c1-4266-b525-95fb6487834a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829835, "uuid": "15a7bbb3-b3f9-44bf-a0ab-3dd86a3afe7c", "value": "384:TYqDUO0n8rBCPbswkOVqlIZI29afgeCtu9:UqDx0n8rBWbqlI99a2u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653829835, "uuid": "5e2a8d4a-cfd5-44b6-aac1-1095371b035c", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653829835, "uuid": "33606544-3c90-40da-b2cd-797bb5e72b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653829835, "uuid": "c0d3f56d-23ac-4445-accb-b61fae3abed1", "value": "7cac0bdc9b78b550849b9a6fc272be23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e97b9d0-df25-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653811267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653811267, "uuid": "b68498f7-85bc-4ad1-a888-52cc07b5e902", "comment": "Malware payload", "value": "fd3d68de0cb7bdb09fe0ad492f435020", "object_relation": "md5", "Tag": [ { "name": "#Microsoft", "colour": "#41DCFC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653811267, "uuid": "38b692ea-5098-41f1-aed9-edb5d574a46e", "comment": "Malware payload", "value": "a30abde167f96d1183d155fc916f6aa77520562f8fb87466944bf0cc65b5dda2", "object_relation": "sha256", "Tag": [ { "name": "#Microsoft", "colour": "#41DCFC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653811267, "uuid": "38f3074d-080b-4baa-9b8e-e0ed53e37b90", "comment": "Malware payload", "value": "22561551c84224cef5c622a49fd88b94fab345cf", "object_relation": "sha1", "Tag": [ { "name": "#Microsoft", "colour": "#41DCFC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653811267, "uuid": "4055320d-9fec-4031-9600-8661806008e4", "comment": "Malware payload", "value": "bd20414d19171121b347ad07c0fede13212c8c104eb4f604e7d8a6d5918012815c6d6ea7d46d805f8b2c1dbd2c792275", "object_relation": "sha3-384", "Tag": [ { "name": "#Microsoft", "colour": "#41DCFC", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653811267, "uuid": "23a9813f-3712-4904-b1a0-571a32194273", "value": "T142544A37F491395C6267CA5851C47AF94E6F8257D2110BFAB82F3B604BDA6C60AB3D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653811267, "uuid": "e4aec0d2-d313-4549-aacb-c935e069d531", "value": "6144:+oYParYoENM6HN26y7KLEzt07KLEzt57KLEztsMiwJyt:kPGK4J6K4JJK4J1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653811267, "uuid": "f485c85e-14a3-42ff-8fed-9af279431a22", "value": 286173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653811267, "uuid": "4f9bf1ab-3633-4849-90d5-313b64e8e86d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653811267, "uuid": "b9011255-7fd0-40d4-836d-cd213f5b98a0", "value": "fd3d68de0cb7bdb09fe0ad492f435020.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125ca69f-df1a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653806361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806361, "uuid": "174a4a54-0106-4cce-a963-81293bef51ec", "comment": "Malware payload", "value": "d43a49cf25d5a1c85b9ee56b757cfb31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806361, "uuid": "52e9453b-b890-429c-896b-c8a7912dec9e", "comment": "Malware payload", "value": "a7e196f90f76afcaa5f6b56ab453fbeebf51b6393e60a1354c2f087d293d540b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806361, "uuid": "1b42b6aa-2b6d-42ac-8e51-07c1a5da5b02", "comment": "Malware payload", "value": "133444ae7a2fe551d69e8c02c702223937fb1f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806361, "uuid": "abef30cb-e2db-4fd6-890c-20c3448c764a", "comment": "Malware payload", "value": "e701c7633ac274fc2854034b43ce658a5574ca207a2632183471f5b8a578b2b15e3d7eb08b6fd1a44c868d7b177ab745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806361, "uuid": "b61aefdf-f27d-4dab-af6d-71a453aab8ec", "value": "T1F0D5AE1AE74529BAC913637285DA97377738FF144333EB6BAB0AD635AC232D22D11314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806361, "uuid": "a5afcb29-6c5f-452b-8153-4f1866389315", "value": "0629c55152d38b4029f7de8a08e08d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806361, "uuid": "dd8979bf-842e-456b-bcdf-b256b5fa84d5", "value": "49152:2b4eJPK2juhGxHmrgr14o9yyb9Mgr5i7wIx:2c6K2jsOm8h/yybGgr5E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806361, "uuid": "10edf681-b6fb-43d3-adcd-3526085c4e21", "value": 2848464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806361, "uuid": "0fa7a76c-d363-49ec-b9b7-747b373bb68b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806361, "uuid": "e18b288c-32b1-40cf-833c-9a1d9d86644f", "value": "d43a49cf25d5a1c85b9ee56b757cfb31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d6df1a-df19-11ec-93bb-42010a9c0043", "comment": "Malware payload (STRRAT)", "timestamp": 1653806019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806019, "uuid": "8cb2df8e-98c3-433a-8451-f55a95a049d2", "comment": "Malware payload (STRRAT)", "value": "9f63431948ce936957144f96b0c4f4b4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806019, "uuid": "8823819b-3cd4-44ce-a29a-451666b2cc56", "comment": "Malware payload (STRRAT)", "value": "a8bdcbe20b8253ce7427686f3cfe79e336e807d9fd82b5724793368f5dda2e97", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806019, "uuid": "62cb6ae6-aa64-4887-9830-165ea7c45804", "comment": "Malware payload (STRRAT)", "value": "0d977977796efae33fd6f0cb40cb52a938ea1974", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653806019, "uuid": "03008bca-a728-4c95-874e-d4e08c755212", "comment": "Malware payload (STRRAT)", "value": "00232c290b579360f6ad3724cebde436e4c422e4bee7d70428389ebcf6dd3046285dca9147ee1d9f0a7d19ea2c89523b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806019, "uuid": "39f6463b-80df-44f8-82a2-dcac749348a7", "value": "T1D493CF2B387BC078D10718B31079A523AA0E46DDD5CD612B22FC48527EB0D6EAF176DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806019, "uuid": "1b260f12-9f37-44ec-904c-0caa6aacbf5c", "value": "1536:oN/k1AjuP1A9QC1+jTFcgCnGSrf+0lpLXejmT68yhebqVHGvJvxMptHrfTy:oNxjuP1UQjj4GIf/l9XeCTJbqcvELfTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653806019, "uuid": "c665f454-5916-43d2-94d4-54ec5624db23", "value": 90102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653806019, "uuid": "379b7d44-a2c6-4746-a7a7-fd8ee8a444c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653806019, "uuid": "7ea56bf6-7442-406e-84df-d1f79cc1dfe0", "value": "required order details.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca535ff0-df18-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653805810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805810, "uuid": "c36a72a5-a1e3-43cc-8b57-feb673496cf6", "comment": "Malware payload (SnakeKeylogger)", "value": "c9a7898c858e3679cf8113f1ee2e543e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805810, "uuid": "99b59e1b-e539-4a20-a0fb-c9098b199bae", "comment": "Malware payload (SnakeKeylogger)", "value": "aac9be39ba2d7383d8b72e9ab50e41a12fe1203f69b16183e726ac584c0122fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805810, "uuid": "5d2868be-3c58-404c-970f-975e5a976afc", "comment": "Malware payload (SnakeKeylogger)", "value": "0717888422c38f17e3f598e45b6c8c3f6299d4d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805810, "uuid": "55418fae-c713-47a0-b5ba-b961f6ffa428", "comment": "Malware payload (SnakeKeylogger)", "value": "91716d020d89e9c3ae50af8c7437389c893b289258cbf4742045189c1f834c43d7ab7f1e686e8161e3502f882f08109e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805810, "uuid": "25e92f49-d5b6-4101-9b0a-517b7c230123", "value": "T128154DD1B1508DDAEC6B06F1BD2AA53025E3BE9C54A4C10C5A9DB75B66F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805810, "uuid": "8c27f0e8-de3e-43e1-b7c8-49895413c21b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805810, "uuid": "8c781eea-6029-4a56-b2c1-3fb6b87607c7", "value": "12288:AO9k3AfxC3aV4dKSYjo/L26sahjLJlpaqchdZ9snHovWQj:AO9OAfxZ2K1oC8FrlchdTsnQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653805810, "uuid": "1b49e893-a5a9-484e-a417-694919867543", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653805810, "uuid": "519ed2c3-9c81-4d07-a046-dfd33ec15d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805810, "uuid": "19d07f35-4634-4801-8073-ca61bf0ee5e3", "value": "c9a7898c858e3679cf8113f1ee2e543e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f4b75f-df3d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653821533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821533, "uuid": "023f79ea-6780-4fd8-828a-0babd379a4b3", "comment": "Malware payload (Mirai)", "value": "cbb1a5bfff6f363f426205fe10755ab1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821533, "uuid": "e5e83ada-7157-4e43-b40f-80d024d7ac52", "comment": "Malware payload (Mirai)", "value": "ab93401d999d616368a3ff03b84189cbd075ede7563a03c72fc29eac79e1b388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821533, "uuid": "df7b1e7b-9825-4807-9c8f-400c90b3f176", "comment": "Malware payload (Mirai)", "value": "114fd02fcb64b717902fe1d8a2b311660b1b9a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821533, "uuid": "a934923e-d541-49af-8085-8fa1f3bd3fc0", "comment": "Malware payload (Mirai)", "value": "9126b2a056ff448707ae3d86e76d6e5d66659f81a795118d3dacb79ce2db826ad394529c4658e70a25b1cac2df704446", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821533, "uuid": "ec55eaa0-b597-43d6-9dc5-48e2d8799cf6", "value": "T16EE2F114EC9B9D98EBDAD072A5BFC1AB0660228DE5C091BC5ED5C53728E5F2826283C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821533, "uuid": "7d941e06-009f-4ee0-8eb9-090163669569", "value": "768:q5s6Bt4PggbuV38B6JSIQwWSBABnbcuyD7UHQRjId:CCPggbu8cEIZWSeBnouy8Hyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821533, "uuid": "9a799df2-a209-4724-8aef-db2b4c50e5e8", "value": 32260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821533, "uuid": "4de05df8-2e4a-4369-86bf-bd474299f349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821533, "uuid": "3f6bc670-c2aa-4ded-b53d-fea414a3aa27", "value": "cbb1a5bfff6f363f426205fe10755ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48b2c7b-df18-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653805827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805827, "uuid": "080711ce-8f1e-4556-8d92-f13f69b4d070", "comment": "Malware payload (Smoke Loader)", "value": "efbb4d097679be92c9a9a70a5f3ef660", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805827, "uuid": "38704954-249d-4a00-b13b-c90a8110beff", "comment": "Malware payload (Smoke Loader)", "value": "addfedb90d654a7eeed9470771298c60d97cf09d2766ca223ce9ee4d61899bc2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805827, "uuid": "09c3dc02-cf4f-49f3-92c7-833c340c6637", "comment": "Malware payload (Smoke Loader)", "value": "a22e5a6e3f33866c24da85d42d131e788acbc77a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805827, "uuid": "79abeaa4-f18c-4ffd-bebb-ce686eb7ad42", "comment": "Malware payload (Smoke Loader)", "value": "1093423ab4dffa9bb846ec33b5c2d91d2929516d0f87da2e2c455c939fc184fa7882d797520b41e54e26f9488652985d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805827, "uuid": "9cf09295-dd6e-4d42-bd30-cd6bf59377b2", "value": "T1AB257D32F2D1C937D4F21A3C9C6BB39D98397D106D2CA84E7BE44E4C1E3A6813665297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805827, "uuid": "ae22ffd8-8777-460e-b92a-40348a1d1ea0", "value": "8a059479252721a8bbcd86618e3c9cbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805827, "uuid": "11f467e4-38ea-4d5b-95f5-69654c753b76", "value": "24576:M1gCwbIhb1KBHtwoCIwSpuTbnhv4M9ts0hpURq:GgCnb1uHGoCIwS4bnaON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653805827, "uuid": "964ee16a-0142-4e39-9b28-9f8ff1c43cbd", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653805827, "uuid": "b37fd37b-fb2d-4f47-8a54-bf0fee0f38e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805827, "uuid": "83a1d556-1b51-4b96-9fe8-590ef8b3490a", "value": "efbb4d097679be92c9a9a70a5f3ef660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c74fbb-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653804060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804060, "uuid": "367d009a-3fc8-45b8-85ab-7ce493165947", "comment": "Malware payload (RedLineStealer)", "value": "4d39f31d2f716053ca269b5b042adb0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804060, "uuid": "5406fc34-a15e-4f02-861a-cf976829ec2f", "comment": "Malware payload (RedLineStealer)", "value": "af3fe54766d73b5d832f60138055a992e440de735ca9e5cb33caa6f4de671b26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804060, "uuid": "af5760c5-f3b3-4225-8789-0bfb4b2c7e99", "comment": "Malware payload (RedLineStealer)", "value": "f6c96407f3833168fb09c42e559fe3b5c626802e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804060, "uuid": "22a7bf9b-bc82-4af7-b965-15bf9aee7528", "comment": "Malware payload (RedLineStealer)", "value": "85935b579179d7c0aa872797e1a9f5b53493eef78def5925082896e49a2f001cb58a17aecfe6bbb5a8079caa6326b1ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804060, "uuid": "b1fde3e5-5099-4d66-9015-dd456344912e", "value": "T18DC2E7C832A8FE76F21A1B379463D3311B34AF094926C33E67D46E5BBC216E147D4A61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804060, "uuid": "983577ee-537f-4dd2-abcd-b276e4359e64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804060, "uuid": "ea799a0c-f3c7-4a5c-b163-fd29a79ed2e9", "value": "192:e4NM33ok2YPr5TLjuOpoDbsT0Cmihhu9On6CuBk9T/EjZa2YVeCp4mRukveH9:eHh2YPrhoDbsrmi7c46CR9afgeCtuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804060, "uuid": "46650511-9dd6-490c-bcc7-9da7848444f4", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804060, "uuid": "6deeaefb-9017-4487-addd-ac8d9267e33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804060, "uuid": "918f543a-7925-4622-acde-de04bb818805", "value": "4d39f31d2f716053ca269b5b042adb0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0d8f66-df3d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653821522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821522, "uuid": "92542f9a-a055-45f0-b12b-e47f7aeb1b98", "comment": "Malware payload (Mirai)", "value": "68421a177ec1b030767b5f0a7112a962", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821522, "uuid": "dad39976-8b29-4b5b-bee3-c9672300c45d", "comment": "Malware payload (Mirai)", "value": "bd7c99096d0357a462a4deaa5ad9b569793405d1b7359c27c603591eb8e6d37d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821522, "uuid": "b9a800c8-671f-4fa7-a980-9a9ef0bfe923", "comment": "Malware payload (Mirai)", "value": "6cb109b428e86cae7494ed0680fff6756415bbd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821522, "uuid": "9d36eff3-710f-46d2-b499-9eceea16787d", "comment": "Malware payload (Mirai)", "value": "cf719f192ce2e34ef9c51807c7b84ce422559d88b7a4ffa27a70d4a3e2d7cd34c41354e9e0697f224d3612fecba774e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821522, "uuid": "f82d4c93-ed81-430e-984b-e0af82c524fc", "value": "T18283AE39E4DC9EA4C3218634BB88CD355F3270C996A33DF69A958AA80457ADCF414FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821522, "uuid": "f5edfe6d-8c39-4529-8dae-f56b0190fd6e", "value": "1536:Q/HrJy0TaBtqlWR+ZNjmwtRhD8/5dITofs3jHN7aUDOZTCq:QfrMqitqlWRcNKaa80f+jt7dDOZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821522, "uuid": "6dc50b1c-4c8b-4039-955c-21649e6cf61d", "value": 82932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821522, "uuid": "74803715-6109-4e9c-a29b-3e388f9b9661", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821522, "uuid": "f4a4ac99-8e75-4eb1-b3cb-1348282822e1", "value": "68421a177ec1b030767b5f0a7112a962", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f78b3-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799820, "uuid": "c20e3a80-eb9e-4d41-903d-4a9afd1ed718", "comment": "Malware payload (Mirai)", "value": "dbf1d6d8f764e3358fd50f0ecf64434f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799820, "uuid": "1ee8354e-7a86-41a7-9c5b-93cbdce9910e", "comment": "Malware payload (Mirai)", "value": "c031c605ebbe9976df526770158153cb4cd2cc1563abd8a77fd5d10aeb9437d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799820, "uuid": "18875a6b-75fc-46d3-92e3-c53e4d4137b5", "comment": "Malware payload (Mirai)", "value": "4cf983ae5248f3a6b847938d345e4b6ec8f0bec3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799820, "uuid": "35d973fe-bd0b-4d3e-b052-06ff293752f3", "comment": "Malware payload (Mirai)", "value": "176be4b060fd76bb1573bc3ad73303bb199fb22c52a3f24c924758f4c76439789a8ccd952730db6beb6e0d47c33ed533", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799820, "uuid": "b920d0c7-a41c-4576-9efd-6f7b2d829ecd", "value": "T18E231882BCC2955ACAD0A376FA7E11CE3321B3E9D1DB3217CD215F107A8562F0D67A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799820, "uuid": "629a8f8f-c5fe-46f5-968b-779e9f993506", "value": "768:MaITPvmFb9jhW5HBC3556XNCVwkfO7vWytSIB8uobhSZkBNmK:psXmZboHBy6XNCVwHzWwSW8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799820, "uuid": "0f909dae-7810-40f8-ad22-9ecc274a0069", "value": 48004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799820, "uuid": "b1229062-cc07-4e18-9694-d887259d9ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799820, "uuid": "8424ffd2-cac4-4e62-9259-6c759679a820", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6614112-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799818, "uuid": "ce5263a4-7778-4786-ac79-edb7879ae7be", "comment": "Malware payload (Mirai)", "value": "57aa1b048ac525071798a42a8f72c157", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799818, "uuid": "a9d67c02-7aea-407c-9a07-ac58fbbae161", "comment": "Malware payload (Mirai)", "value": "c484d236d4096155e5f75075c231e41af19a85c4c3c9a91279b702a9cdb6d0f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799818, "uuid": "47fc16a8-c77f-4392-a247-a534b1c44a10", "comment": "Malware payload (Mirai)", "value": "b6a1a247d53ececd9fec9d16b72273c4b8dda748", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799818, "uuid": "7906010b-d087-4f83-9143-a0462a6aa05a", "comment": "Malware payload (Mirai)", "value": "29f667e1c12ae1b8199d08224e9277a7d4e323446359194ce7b287895c0fb0b1a660991859ae6c04602bdf92d3e06880", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799818, "uuid": "0185a92e-d7b1-4a8f-a404-37523246028d", "value": "T13CC34B46FA418B03C4D52776BA9F42493323E754E3DB330699189FB43F86BAE4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799818, "uuid": "1961297c-b77d-4621-b88f-872a9ee6da0a", "value": "3072:3/bCIZACZzzin0zSsylaMl3Q8H+ruVxVzVV:3/ZZACZzzO0zSsylnlz+ruVxVBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799818, "uuid": "b81ab2ba-0ee4-4de8-a63b-e5fc30d4b7d5", "value": 129709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799818, "uuid": "8a8948ae-8737-4be4-bb96-9bb2f259e2ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799818, "uuid": "f2ffe427-486c-4ebf-b1dd-378d52a938fc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4a2c6c-df12-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653803289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653803289, "uuid": "dad5d11c-2bdf-485f-80cc-0275bfa1d374", "comment": "Malware payload", "value": "7a865475ff65ed58881f23270f5586f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653803289, "uuid": "88b95373-0c86-4e50-842a-21bab60fb3e6", "comment": "Malware payload", "value": "c4d15514ba8f971b8eb5f1cbb493c773b5d6d84c7921bfa4c2e1779e744b26dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653803289, "uuid": "8b7c4354-a0ee-4f77-8a36-cbc0ebbefe5e", "comment": "Malware payload", "value": "3ee5bcffc1044bb588fa4b8ae2ecd5be118203a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653803289, "uuid": "350b43a2-349a-4da1-ae65-1d54943c7436", "comment": "Malware payload", "value": "9d23979d8f21a12c088ec5fb8fc499390ebb1dfd4d65e6c6f7e9836aa55715ba8ef23a261b7848e40720b3935c184b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653803289, "uuid": "cea75d74-c931-41e5-aa90-d368d9e7fa56", "value": "T1E9E3D016A7B62968CA56817D4A32D3FB8327FCB6DE7AC3DF72B4595D0C210C15E2108E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653803289, "uuid": "df52a1a2-7221-4bbc-a2dc-9e05f50e2147", "value": "c3a4859bc9397e66aa68460dbfa51189", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653803289, "uuid": "77bb7cc1-e92b-4425-b1f7-ff4a0f1a548f", "value": "3072:xnYEkz6Pudaz7pDF/pstBaDqwONnct437Bl3N2UH:xYEoMtVDF/p/uwONct43j92U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653803289, "uuid": "456ce054-726e-4cf8-92a8-c844dc3276a9", "value": 143872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653803289, "uuid": "e346f405-bfb3-4a68-8fa4-e85b75273351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653803289, "uuid": "d993af31-0f3f-4aa8-a1f0-05d8af36effd", "value": "c4d15514ba8f971b8eb5f1cbb493c773b5d6d84c7921bfa4c2e1779e744b26dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10184c95-dfaa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653868204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868204, "uuid": "d21849a5-d1e8-4a76-bebe-017fa7c7204c", "comment": "Malware payload (Mirai)", "value": "3b04418a7f24f625f0c1038e2b9922a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868204, "uuid": "af19c64b-7681-44b2-8909-eedc75df1df3", "comment": "Malware payload (Mirai)", "value": "c8061f0b024ade5d2daf1b1c0dd5e5af2d970a4164296af0e8d36b37389b5680", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868204, "uuid": "6938644c-dd81-42ac-8620-ab9a7ee6a3a2", "comment": "Malware payload (Mirai)", "value": "d46a9b182b0eed15280e9201134994d90d74c73c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868204, "uuid": "45029fb9-026d-4bab-9bad-7de8f44fa9e1", "comment": "Malware payload (Mirai)", "value": "62cec677e7e987319d8f5de86544df4ad0b0a3ee1b135bde4bb52cfa9bc15627eb7e01d43d844bf5ad4ed99b6aa9d389", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868204, "uuid": "b1cd8111-ae65-401c-bdfe-c149098dad09", "value": "T110D2E0B82749637AD2212534E97AC7B7370316BD5235F9B4820487B8D1E290DACFF953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868204, "uuid": "87fd5fbc-564d-4d4e-8929-4096b4601483", "value": "768:w41e0sXRHvNdgXXLf3W9F+gLwfTfuB5HUeZfs3Uoz/:wStsvNdgSr+kwfbu7Ujz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653868204, "uuid": "75dc3ca1-3c8b-4f6d-971c-ce1e4a1e0e24", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653868204, "uuid": "3594b334-b75c-4bee-b847-5b533af699c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868204, "uuid": "0e736be3-e81b-4242-9d23-9dc952e8069b", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d960f1f6-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799823, "uuid": "2a740f1e-7699-44ab-8f8d-29ff0d80525c", "comment": "Malware payload (Mirai)", "value": "552c9bfb4f4c1a6133f09fc883483c10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799823, "uuid": "73e1cbe3-e8d3-4e68-8dad-4d0f22998b0f", "comment": "Malware payload (Mirai)", "value": "ca9983fa538b51ddaf8129baf2cf96c4b68e3ed1b414102d4f2313eff37e7f85", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799823, "uuid": "f030ef21-508a-4fcd-8cca-6e7e37751e64", "comment": "Malware payload (Mirai)", "value": "0381f48ed6a4065fdea29e91da5b23aded91c1c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799823, "uuid": "dcba5a51-7160-4e3e-950a-b6d5129d4cd7", "comment": "Malware payload (Mirai)", "value": "2a7dc1775e4a583b2713137c6b05affa237cbe7b0c93dea1a398868f3713dad9f8c2060a8b1e6f079b284be00f9459f0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799823, "uuid": "0c6209ab-886d-456d-b76d-afb466493032", "value": "T182336CC5A743EAF9EC160A313133EF325B72E53E6028FA47D7D99A33D985A02D10166D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799823, "uuid": "1284a01b-332a-41c2-b0b0-21a1bc9a46f3", "value": "1536:xFiUjpG6ydP7T0UlUS9HDHZPL70sRqVGi:xFbjpG6ydj4OR9HjZjorA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799823, "uuid": "1be77453-5a4d-44e4-a866-07ba4bdd22d7", "value": 50256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799823, "uuid": "3aee353c-1a65-4fdd-9436-e55abdb38d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799823, "uuid": "45fdc49f-cb13-48ee-848a-556db8a5da62", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df983a50-deee-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1653787807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787807, "uuid": "b3be7838-1211-492e-aee8-cebe29440eda", "comment": "Malware payload (Loki)", "value": "74842edc3530170532733cf82f34abfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787807, "uuid": "9c4e334d-332c-4589-bba8-30c9ddf7f410", "comment": "Malware payload (Loki)", "value": "cac28dbffd64b5146754771ee9994cca89c606043df14a7167e47e52a650d9f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787807, "uuid": "30790cbe-b0c4-48ab-b197-1b3860d04910", "comment": "Malware payload (Loki)", "value": "314da9aeff004f49520759e3e0449e4561d7a33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653787807, "uuid": "46c6181d-d325-4f24-8c1e-5d293b74f988", "comment": "Malware payload (Loki)", "value": "cc1ffa9f204bc9f0b213d8cf1940cf00329e6efa2b412a85c305149791909a9bef81b5fd7093cec06abcbb1af7fe7dbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787807, "uuid": "1a5413df-087e-44a8-9fc3-354ed36ae924", "value": "T18FB4D0E49376EE71F52973B37164904C2B616A2D84E0C13A9A8CB1CE71A2B472DF5F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787807, "uuid": "c5dc8283-82c5-4023-8806-b71c897c2210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787807, "uuid": "afc4210a-5296-4e1d-bf63-1d887444b221", "value": "12288:Ks+oGJncv2Jhj/4Hpbag63cZ8I/bduXbbHo:KdcCj/mbEcSOObbHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653787807, "uuid": "a6ae3d56-00e4-4fdc-825b-c8872bd7995a", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653787807, "uuid": "723b6b25-afe5-482d-a940-3e241fba406b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653787807, "uuid": "fa8fa6cc-59f4-42ea-b5c7-5187198b385d", "value": "Payment Proof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22af7a50-dee6-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653784054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653784054, "uuid": "66bd6c5e-dc14-4a86-9529-bf39e9c56221", "comment": "Malware payload (AveMariaRAT)", "value": "230ba9735b656ab22cc089ecb30c1648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653784054, "uuid": "112cf13e-39bb-4ca4-acae-4505da365299", "comment": "Malware payload (AveMariaRAT)", "value": "ce20195a9556da8cdff45dd636c2dc7ed08954762c5e3214472218d2a5f36c19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653784054, "uuid": "1e1e159c-d396-4269-9ff0-3c6136f454bf", "comment": "Malware payload (AveMariaRAT)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653784054, "uuid": "e239bd6d-46ab-4dd6-b2dc-3b826b0beac3", "comment": "Malware payload (AveMariaRAT)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653784054, "uuid": "9780adf7-a6fe-423c-ae34-65bc7ad4019e", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653784054, "uuid": "25c7713b-c067-48dd-91ac-b8f949609f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653784054, "uuid": "a37dac49-cc0f-49f5-a1a0-d52caee577ba", "value": "230ba9735b656ab22cc089ecb30c1648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f3c717-df41-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653823141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823141, "uuid": "fc027a43-06b0-4131-b1a8-a17d46ce2378", "comment": "Malware payload (AgentTesla)", "value": "e5caaffe91cc66838c26f39014295d3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823141, "uuid": "b4add6a3-f43a-4104-b673-ecd0a44b908f", "comment": "Malware payload (AgentTesla)", "value": "ce7d4e0c7eccead1c4746fdfb2b168fbcde141104a6b045a716dbc2d95b6d145", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823141, "uuid": "de2cf616-a38b-4215-9d35-0c4d993c842f", "comment": "Malware payload (AgentTesla)", "value": "76ec74c356040257b21083420eaa4d0b5cd310b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823141, "uuid": "759ed2f0-55fb-4915-a5d5-507f0f57e945", "comment": "Malware payload (AgentTesla)", "value": "cb5b43dfc3f72afe197923642f3b32017f35507203a5db7b9b5c1d62a1a63fae015941d426be766355bb1cda913d8381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823141, "uuid": "a36c9269-ed8e-42cc-a618-78f7a960edc5", "value": "T1D6E4F1297B629E22C26801B1C6D3952553F65883F632D3D73ECE02D64E017E85DCABDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823141, "uuid": "8a9a7557-94eb-4f40-b0dc-3096e0cabc13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823141, "uuid": "87bd76d2-445f-469b-a670-f704cc00d32e", "value": "12288:2rc/MQ9lpQICQU0GrqGF0jvZ8sRPNA6cnArNZuj39W7bw+yH67gsth:7/MQ9laQlhSs3cAMybby4gsth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653823141, "uuid": "386d5974-0238-4737-8578-01874fb31315", "value": 673280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653823141, "uuid": "2b19f123-63e3-4300-968c-1cefe96723ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823141, "uuid": "0472743a-bef3-4901-8c9d-e272d55123af", "value": "Image007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3ac821-df9f-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653863774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653863774, "uuid": "4853a12f-062c-41df-ba2f-d3ba4759c560", "comment": "Malware payload (RedLineStealer)", "value": "0b5b3155899f1e77e181609060dfddfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653863774, "uuid": "ab9d5388-6b2e-4fa1-b170-d8fdaad257c7", "comment": "Malware payload (RedLineStealer)", "value": "cfa68ef922dcfc909b9464418f74a6c1ebe3cdef3df406d7fdb9114862ee2eb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653863774, "uuid": "d019c211-5a29-4171-b19e-d95f3170b9c6", "comment": "Malware payload (RedLineStealer)", "value": "f28b848da315f238e28f294b19af89e27d79693f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653863774, "uuid": "bf8ac289-13da-4bd7-8bd9-77576b855b73", "comment": "Malware payload (RedLineStealer)", "value": "952bf172c34102f828229dd2269482c63333b8d176d82a60b445e6c02a2a6ef0b99bdd00fa5fa9a343796c9bc05b0747", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653863774, "uuid": "7f23db25-6d5b-41b4-ae26-cfa155546984", "value": "T1FD74F1493570D831C0A515701931CAB0AA7A7D32B979894F37C83FB96F72381BBA57E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653863774, "uuid": "b73a7978-1982-4025-9bc0-6a2082ccc52f", "value": "3b5b71419f19c89ea7002a31140d85fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653863774, "uuid": "e067cf8c-4669-4ea6-97f1-1b34baf11144", "value": "6144:CwN+qBrMKdlRg6yLeN4c0VP3yy6AQXKlXc3yX0d4VVPJ:ncshfoeNe13D2KlXcFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653863774, "uuid": "70a5c478-79ad-42e6-87c1-df610306d02c", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653863774, "uuid": "99796b95-fd22-4d2d-b4c1-91d534d5fc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653863774, "uuid": "805dcc93-8570-432b-990b-47976f5266e1", "value": "0b5b3155899f1e77e181609060dfddfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c32820-defe-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1653794582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653794582, "uuid": "cdd6e143-1dd3-4695-a933-e7a380d36cfd", "comment": "Malware payload (AveMariaRAT)", "value": "219f73fbaf18f292ad221e97575efdc8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653794582, "uuid": "382b928d-90fc-4957-a4e0-0e25dfc0fa78", "comment": "Malware payload (AveMariaRAT)", "value": "d219fbada6312282f862fcc037cb90999a13dbbd832eb997651685069c83cb76", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653794582, "uuid": "d6d6ce13-2bd6-4d0e-8a55-7975fcbd4e03", "comment": "Malware payload (AveMariaRAT)", "value": "998869405dd63881249aab15f4278c6deb0b23b9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653794582, "uuid": "5495ce49-f4ce-4bf0-b00e-1ac84f8aa04f", "comment": "Malware payload (AveMariaRAT)", "value": "ccf7febbb95cb6f28e712ddd5df3f1130e5deb7112b40bf38df1d63416dac12c841f5eeb3feb281a4168eaee1a41b6b9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mail", "colour": "#07FF85", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653794582, "uuid": "5d436c9a-8187-442e-aeb1-027eeb092b91", "value": "T1FD154A2123844F99F87EB73B6165010013F5F887D761CE5EFEC900D98626B86AEE7B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653794582, "uuid": "e1e979b9-1f66-4e98-8f42-9422d7db43a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653794582, "uuid": "0aa9b100-27ce-49b4-8524-3d3b02fab6fb", "value": "12288:V1OfCdVDtOi/cupkFq0DO+7ZQ4ZlmbsSD2Iz0GkEnIB95+5X1:POadOK3pkwd4iIRI5IB9kX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653794582, "uuid": "deb4ffda-9a0c-445d-9d49-f47b8d2ff8ca", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653794582, "uuid": "0c491ba7-be9a-4d47-a234-d3cc7fda4f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653794582, "uuid": "3e0e7331-0616-4723-9c44-7e17ebc914bd", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e72a54-df5b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653834291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834291, "uuid": "a92a3f53-6e45-447a-8779-10f3d3c2429e", "comment": "Malware payload (Smoke Loader)", "value": "2f91d05a9d217fb2cae1ab57b9c01fe8", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834291, "uuid": "92dfe9f5-9a0a-4bf4-8c88-a488744d8ff2", "comment": "Malware payload (Smoke Loader)", "value": "d21fc48678f43f43d9bf6c63633497b8ced09a4f3a3da6d46ade67ead39be4de", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834291, "uuid": "bcfb996f-dcd3-4f73-acec-861f96d3ef8d", "comment": "Malware payload (Smoke Loader)", "value": "e620b2fb2aa3af9514f54f76148556a06109f3ce", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653834291, "uuid": "37429786-1987-4b5e-8f3a-544d2e7e9e9d", "comment": "Malware payload (Smoke Loader)", "value": "cdd4bb317bb673b05ad134106d0e75852c2283eae5acf8f81abad09de79670b30ddfe0c6e316058a041553e7d6f25c7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834291, "uuid": "5e9a321b-b951-4f81-97fd-1b5e2929be7c", "value": "T143648D107798D436F1B716F4497593B8B93ABDA29B2451CB62D03AEE6634EE0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834291, "uuid": "c5209cbc-29b6-4361-b4d3-feb7a9fea416", "value": "f4cb565e5d7d1a7d80b8c3baae241328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834291, "uuid": "e4f3fc91-d271-4caf-a91b-557a41396650", "value": "6144:d9/sLPqL1rl233y0OBEpOTGc4di2fTPWplaP:f/sg1Rw3y0yEpOcdzmaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653834291, "uuid": "054d1180-c2a4-440f-ab73-e67a3f9cc6a3", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653834291, "uuid": "8fd5d908-c6ea-43d2-a718-b6b33eb0a7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653834291, "uuid": "a210879e-af3c-425c-b346-68ba26db64f0", "value": "2f91d05a9d217fb2cae1ab57b9c01fe8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652b4754-df0d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653800916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800916, "uuid": "b0078bc7-b4a0-431c-9484-41e6f7ffbdb0", "comment": "Malware payload (Mirai)", "value": "1129480d27acc2a9e3158376589d3f8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800916, "uuid": "a05b94fb-61d9-4296-9b4d-6a6a20cfe36c", "comment": "Malware payload (Mirai)", "value": "d32795e1f2412fe41d7c580c4b5ce4b2dcf43cdfca23fa819fd4067ff8153bb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800916, "uuid": "c0eb02e2-b285-4871-be60-5de118ba86be", "comment": "Malware payload (Mirai)", "value": "65e91da66ed2ae101903b174b040ad04e07ae928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800916, "uuid": "65093911-bfcc-4c62-8f00-86f30933c593", "comment": "Malware payload (Mirai)", "value": "bfa78c6ffb044fe3af1e16f30073dee3a44069fc85a98f097d7fcec30841404a71f509c9b3bbbc157648880cd2a3c5ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800916, "uuid": "713d69af-7280-4745-a9bb-9dbefdb9f594", "value": "T127337C7AC06D9DC4C65C42B8AF288E7C5763E40086633DFB675A86669007EECF50A3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800916, "uuid": "0c61d648-2dfd-4a3d-a31d-f3cfe342a543", "value": "768:9ae/tYS3BCHhKZYFEkUVNlfIfw8OrcHuZZt3nnD2k9K/0CaoDSBi4C/h:9ae/mUBCBKZYoNFIIAqXbos+Dn4C/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653800916, "uuid": "2c245770-692d-476a-96db-2b6a3b37ac72", "value": 50832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653800916, "uuid": "6778c801-a5e6-4801-9333-88ff71e9baeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800916, "uuid": "894e9cce-e9f6-4c71-ae43-38dd83224d3b", "value": "1129480d27acc2a9e3158376589d3f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6435e749-df24-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653810793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653810793, "uuid": "0f30aaa2-c1b9-4028-ad90-2bb4b315ab50", "comment": "Malware payload", "value": "54ea7481da1446aef625f5d2c8cf72c9", "object_relation": "md5", "Tag": [ { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653810793, "uuid": "a494614b-8dc1-4d0c-9903-9949f7251ca6", "comment": "Malware payload", "value": "d3e90cba2cb33e10e136acd6dcbe945e501abd90e93f2baa2a64ed92f881d33f", "object_relation": "sha256", "Tag": [ { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653810793, "uuid": "bb4313f6-fbfe-42f3-8c30-35ee610021c9", "comment": "Malware payload", "value": "2fef4769701d9c2520d30055ecdd45cdc6aaf338", "object_relation": "sha1", "Tag": [ { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653810793, "uuid": "33705aef-9408-48ac-bd5a-e27b08c6a421", "comment": "Malware payload", "value": "912d6216a1dcf060e16bca8d2542388350354d6b2922d92028f7b11efbcfed37149128783ea6d44dee74407038d26f31", "object_relation": "sha3-384", "Tag": [ { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653810793, "uuid": "87411e12-b713-42d6-b40f-49c77571c515", "value": "T1C9E2830D74DCA46A0263324BB4320A07F92FEB3192459491F6FEE77B37D6864866B1E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653810793, "uuid": "47d2b226-7469-4a1d-9c27-b1111044533c", "value": "384:91+ViqPDF3SCKhn4Qoy43I4CTs+y2G3gdgT+fGpWqjhiHqiqHbnuiR7Ldwft0bCB:91+sqm+TnglkC76ZK1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653810793, "uuid": "31d9728e-c589-4529-b3a1-8053f0fe26a4", "value": 33165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653810793, "uuid": "d661ac13-9afd-4b85-bd75-55d2cf373f04", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653810793, "uuid": "685391cb-84d1-470f-8db5-4c4b81e80ab9", "value": "54ea7481da1446aef625f5d2c8cf72c9.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2032755d-df42-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653823564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823564, "uuid": "c41b3f87-d985-4709-8b66-f16cba4ab808", "comment": "Malware payload (RedLineStealer)", "value": "a8d42e1ec931ffa5b1f6c4003c443c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823564, "uuid": "f63a651f-6b4c-4af9-9561-d7cd7699dce1", "comment": "Malware payload (RedLineStealer)", "value": "d4c7e9843be5016c1833f44f57de3439967d9b0e07b86aa7f3ff6571c7139ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823564, "uuid": "16043d62-4498-4c7f-9a37-881ed5210875", "comment": "Malware payload (RedLineStealer)", "value": "2262a1a46d94cf1e1360e446029c628fce59fd5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653823564, "uuid": "0e687ca9-14b2-42fb-afff-2880714d7f28", "comment": "Malware payload (RedLineStealer)", "value": "2a77e1cb6d533a5ff0f0fac62bf47b1371ad198ac8a354068cf5d1db47ba6bcc947212a2843b9f697143e619861c5b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823564, "uuid": "590b9fb9-9d92-4f65-a85b-ef02bea7d3aa", "value": "T1DFB508139B8B0E75CDC27BB461CB633A9734EE30CA269B7FF608C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823564, "uuid": "5b3aa72c-c3f1-43ff-9fc4-5c9590db1415", "value": "d0dfe559e003c7370c899d20dea7dea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823564, "uuid": "f3f361ab-4408-466d-b522-ab2af6eee592", "value": "49152:AmRQEdJh904FEOBJ0oV4jPyXH2Ik/JaT23L/:AUQEdJh904FEO/09PCH2taa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653823564, "uuid": "dac8905d-b9c6-47b5-b720-238b89c7b95d", "value": 2348099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653823564, "uuid": "903f0f51-900c-46f0-b30b-32f826943651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653823564, "uuid": "8e3d3716-5a2c-4fb5-b7ee-9fd330e775f4", "value": "a8d42e1ec931ffa5b1f6c4003c443c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8df3b3-df18-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1653805812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805812, "uuid": "80148b88-e1d2-4407-af63-af3d40163c81", "comment": "Malware payload (SnakeKeylogger)", "value": "6a8b336736fbb267032ac5afd6426f9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805812, "uuid": "d418dd60-c9fb-4943-a156-76939d2bf416", "comment": "Malware payload (SnakeKeylogger)", "value": "d4edb1acc2e1f9f4a22a7e82d69d27a58028f12b6e9a3df7625e0ef8895b3fa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805812, "uuid": "f84754da-49ed-4e4d-ad4c-64d30e6fedaf", "comment": "Malware payload (SnakeKeylogger)", "value": "2305463c4b3d0ca9827599f1882ef12761da24e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653805812, "uuid": "23a22adc-0f9c-4895-9619-8bf24761edfe", "comment": "Malware payload (SnakeKeylogger)", "value": "b65aa215f20f25d077fa79cf7301aaf6f05db278b3bfc2078b631377ba3a731ea358d09c2d04c5ce050a623c56ccb723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805812, "uuid": "ba8c3d8a-bf5f-437d-8d51-589e8a409a4e", "value": "T14FC4E0849367EE75F07863B3B164901827742A2DC0E5C57ADA9CB0DE3472B0A1EF5F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805812, "uuid": "8ea28657-133a-4439-8ddb-869001600150", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805812, "uuid": "f3557bc1-bbec-4762-b71a-973837b2523a", "value": "12288:H6QMmlqo/j30a4cNkv7IRhC8y5t//kA+2YLuPFvbHox:a+VgdcNkvVp/kA+1obHox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653805812, "uuid": "d00b516b-876b-48b3-8822-4f32c164426b", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653805812, "uuid": "b6dbc7c3-80c4-41b7-b188-1f7b5a4c261f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653805812, "uuid": "13b44a54-570c-4370-9608-248b8e87d377", "value": "6a8b336736fbb267032ac5afd6426f9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f849b43-dfaa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653868203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868203, "uuid": "80409f74-7f11-4880-a415-238837e086f4", "comment": "Malware payload (Mirai)", "value": "20b8a7401d031bb47e790f1c8065f280", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868203, "uuid": "b7bdf6fc-e809-435a-804b-91a91c872f88", "comment": "Malware payload (Mirai)", "value": "d8418ebf45fe4c433abbcfc9e89a8ef98232e2c5c75d37b7a1c88333f1be0e82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868203, "uuid": "8c3a5d3a-a940-4c4c-a520-86f4fa144222", "comment": "Malware payload (Mirai)", "value": "d165dcee0b302e46813c62cd73fc333c736aa07a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653868203, "uuid": "d1983ed5-ec24-421e-9ec8-9f659513c09a", "comment": "Malware payload (Mirai)", "value": "2e2230067b2807a6206c81c4f38f49462b393f3072511cc3047379b310b47822f2ca4fb3ea907cbb91c921a21fdc845c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868203, "uuid": "3b540ca7-4fd4-47b1-899a-5a359f7e8c4b", "value": "T1083301BEA1527E73C6B1143B78196688243EC66CA1EE3237E7200345D771E4A927A9D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868203, "uuid": "5ad95179-9281-438e-914d-ebc8f55d0538", "value": "1536:d0qB4/UyCs8pT1n1Jsj4g9V/LEr0ni5YZ4d:S44/ss61nal/LKd55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653868203, "uuid": "40d7aacd-2b7c-4af3-b78f-f98072f2aa98", "value": 53644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653868203, "uuid": "bc66d2dc-f396-450b-a830-82ef683b3e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653868203, "uuid": "53e8b08d-f22b-4887-82a3-0514ecba661b", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf41169-df4c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653827959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827959, "uuid": "09090a80-ec98-4eb7-8d0e-da5e329c6369", "comment": "Malware payload (AgentTesla)", "value": "c8df0448f576cb1e28e27c78a5214a46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827959, "uuid": "b2b85e44-313d-4416-9ff9-df96365c9a6f", "comment": "Malware payload (AgentTesla)", "value": "d880050f2f068d580af51fac3b5258a225d93c243f3a6baa621daff162f1d792", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827959, "uuid": "f15d4b1c-7eb2-483c-9398-c74dbb3c4dda", "comment": "Malware payload (AgentTesla)", "value": "c877598e0dc3a91c946b55a1e5f4a6109f49323b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827959, "uuid": "4f58256d-c067-4154-9238-e7ab8837d3e4", "comment": "Malware payload (AgentTesla)", "value": "dd40723e3b1e41fe6d02e104e9a065a09cef1caaf35e4b63e838115fddc556d0de90ddc14fd04d04e93fe105f75d3265", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827959, "uuid": "3336f40c-d61f-4d14-a33c-b42ca39aed65", "value": "T15DE4F1283BA69E22C57C06B1C1D3812447F1A543B276E7933ECE52C61E06BE55DCA7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827959, "uuid": "a8f553e7-7be0-4fc4-9719-27c23d77eb64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827959, "uuid": "4f5f0015-5c0b-4a01-9e05-c1f90f14b153", "value": "12288:5Uu259kJuv8YT6TN0V8zdq5apvHiUJAot76o+/Y0fHa6f:PokMTTmOEqFUyotOo+/Y47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653827959, "uuid": "dfe2583f-5434-4a8f-9c81-b4c0b15ef61e", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653827959, "uuid": "b5d427e1-ee73-4d4e-9146-225028863858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827959, "uuid": "c38953f6-2a3d-4eb4-b245-5ec59514750e", "value": "RFQ 6565987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8813633a-df10-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1653802263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653802263, "uuid": "96a05093-2167-4b11-a053-015bebd1ae20", "comment": "Malware payload (Amadey)", "value": "a65efd91456155cbc19e4e97e5bcb664", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653802263, "uuid": "22215904-3cf7-45dd-9a83-972f8eaa3539", "comment": "Malware payload (Amadey)", "value": "d8eb0cd465f3e4cef6571c08b8468a8ddf4a95bf1c8eb482170c85b7803c6b49", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653802263, "uuid": "335634ef-53ea-4e90-b8bb-b79babae0102", "comment": "Malware payload (Amadey)", "value": "c651d3c2e2167cc85dfb1abaa84a9eee9fb30e45", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653802263, "uuid": "47c8fffe-a42c-4c0c-a06f-6512a585cd81", "comment": "Malware payload (Amadey)", "value": "de0907ff88d2c3fb7435844f67118ad80a04995b50d18e7d1b74fb19a05a88e08a6d338c220ac2124c3bb41480700109", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653802263, "uuid": "31f067b4-b049-4346-af73-a8b494cba33f", "value": "T195D5229906E91101DAE33E77DB06D4885D0C62B07FA1D5F9A0295BA8D4B839EFC270DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653802263, "uuid": "6da0878d-1be9-439e-b17a-424f29c3d796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653802263, "uuid": "83e0518b-51a0-4243-95eb-0160c1763dff", "value": "49152:pJi4Rb9b2W3qdWIXPmixGa0fIbXXCzDGcNUElSdH8+6Mzl2fUCAMmFa:pJi4LasqdWUuxa0gLXcDGcplSdH8+604", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653802263, "uuid": "f9e13dc4-f359-4796-ae4c-adf631239512", "value": 2987520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653802263, "uuid": "cd5b2f4b-dc78-4421-8b11-289b49e5de77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653802263, "uuid": "d96a57af-ac79-4cc0-9433-56e7b651c456", "value": "a65efd91456155cbc19e4e97e5bcb664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f458a3-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799819, "uuid": "ed3e3b29-3a64-4a43-a4c8-2dcd3f46b109", "comment": "Malware payload (Mirai)", "value": "25fa9b308d5b786439f53c92cd2c3690", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799819, "uuid": "12b1b153-1c4c-4786-b37b-256ea6aa95b0", "comment": "Malware payload (Mirai)", "value": "d94db3cd18e7a8a2b7857b16055780bd14487a8e580804fac48a6dd535826c75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799819, "uuid": "b30c5155-3f77-40c2-a1b8-c1abe5f9a55a", "comment": "Malware payload (Mirai)", "value": "d1acbbe90ce5a59e0382d3c71fa998403775a59c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799819, "uuid": "cc29c2b0-7f78-4509-85bd-2115d8dec4b4", "comment": "Malware payload (Mirai)", "value": "469c87c5958538393340b71c5dcd51602050d81b28b9b23723394b2981050c38ea8a611905210bd7e29e3280831f83d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799819, "uuid": "27a302e0-32db-4679-9ff2-16489f3186c9", "value": "T14DC34C46FA418B03C4D5277ABA9F42493323E754E3DB330699189FB43F867AE4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799819, "uuid": "087e1a14-4c98-492c-b929-6dacf983c246", "value": "3072:3/bCIZACZzzin0zSsylaMl3Q8H+lkEM/9zVV:3/ZZACZzzO0zSsylnlz+l3M/9BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799819, "uuid": "74678e1e-8096-466b-a682-fc632a949e40", "value": 129709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799819, "uuid": "2c6dd149-6a4f-4906-8e01-d63b9fa5f828", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799819, "uuid": "50195d9a-1192-4d1e-a502-446bf26727bc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b6dd20-df5d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653835173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835173, "uuid": "99accce7-1e6a-4db2-8923-5d5f55cf91a9", "comment": "Malware payload (Mirai)", "value": "0fac0880e76499ac0ade0a659456dd04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835173, "uuid": "713ced7a-392c-484b-8046-52b01ca6ad5b", "comment": "Malware payload (Mirai)", "value": "d9c99b0543728609f9fbf112cbb68d6ae5d81f4f78ed216c2e74e2de238e3ecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835173, "uuid": "f2b6ee52-2803-44d3-9e8f-6abb67fecd55", "comment": "Malware payload (Mirai)", "value": "abdcef695c13336ec2b39664a88566219d6a84c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835173, "uuid": "66fbf3cd-5941-4ea0-9957-5c949a5d5a1b", "comment": "Malware payload (Mirai)", "value": "8f8735d61e7c0c452c5759a6e4365a8ed0e1dc8fddfe4a56d03710ac5535b5351e8e5848795cc6b436270b61aa1dc01f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835173, "uuid": "fc73a357-1ad4-4a05-9480-b56af51a5c1d", "value": "T1B1C2E10F00DED96FC6508332F3A8D59EA53254006F6DCE427E8E878454590B6613EEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835173, "uuid": "4f29450d-f2b0-4fbc-a1d0-4775996ea33b", "value": "768:3xCfVUCpi6K/XMMTKHIaT4dUgfi8O+7/U:QVU4EXMMlakO+7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835173, "uuid": "b86a24c6-1e8e-47cd-a61b-a7b3057e9673", "value": 26252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835173, "uuid": "40a57f7e-9283-4600-a650-d1178e5296df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835173, "uuid": "c7240390-a1bc-46e5-be99-b639a97187d3", "value": "0fac0880e76499ac0ade0a659456dd04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dedb65a-df51-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1653830137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653830137, "uuid": "4c6b41cf-c411-4391-84b8-35cb50031d39", "comment": "Malware payload (RedLineStealer)", "value": "d95188e614c5ea4d2f636737479118ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653830137, "uuid": "74e706d9-1216-4734-982b-8b3fafe3f249", "comment": "Malware payload (RedLineStealer)", "value": "db017ac087801df93355452c6878af51127b2902ee80b69d0ec8e1d192ae553b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653830137, "uuid": "34f5af32-812d-43b1-918a-39de956c25cf", "comment": "Malware payload (RedLineStealer)", "value": "1668834befe284e570ac28536648281247eb6393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653830137, "uuid": "ee7beac9-c521-47e0-882a-b2ea63da0d34", "comment": "Malware payload (RedLineStealer)", "value": "442f3b12971b94d634f30688f48072fcf2e20ee99119f7e1bf3a7cd6ea0e7057e294217f18819682f61af6a9e8d62e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653830137, "uuid": "c8e27131-35a6-4300-902a-c5f22e8f6d81", "value": "T1E9C2D7C432B8FE66F11A1F379566D2311B356F094826C33E67E06F0BBC266E14694EA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653830137, "uuid": "af939b97-04a3-46e8-96ce-4b03bc797636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653830137, "uuid": "b5e4c9f0-c18f-4450-ba42-2066bcee94c2", "value": "384:3H7AzurPKg4H8bsk9b5U6CG9afgeCtuX:3H74i4cbSG9a2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653830137, "uuid": "e38f451a-21a9-4891-b7ab-b04083812267", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653830137, "uuid": "5768d451-9008-4181-b430-3a46b1f39f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653830137, "uuid": "64186954-46e8-4c41-a0f2-81cd182eede6", "value": "d95188e614c5ea4d2f636737479118ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4202c883-df34-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1653817608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653817608, "uuid": "4778207e-150b-4696-9cc0-c2fc93b5faf3", "comment": "Malware payload (Heodo)", "value": "1f9a68461e4eb711c6f3fc1d85aa34b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653817608, "uuid": "d5a3e208-8c5a-4a63-8b94-5ac4601204c7", "comment": "Malware payload (Heodo)", "value": "ddd9d2b16b38e452113c1d53b307debaa6326f3eea80f1ace0f8fdf4c7988c9f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653817608, "uuid": "4f06da56-7098-4471-85d0-cd2e783423f9", "comment": "Malware payload (Heodo)", "value": "891feca46bf519dfab0b07d8d92e95c57b9aa1b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653817608, "uuid": "e3b2afbc-f00f-4ca5-a46c-a35658a91171", "comment": "Malware payload (Heodo)", "value": "c60c822bb5c2fd1db5af20acb5fb3621ce1affe20c4f9e12a08c0d2e3b2917200fc95afa867321a0387a6c635668bf35", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653817608, "uuid": "2d884994-8309-4b42-8e0e-00186fd6936b", "value": "T1A9D4DF25F3E404F5E07B9234C862C946EAB5BC1A07A0E75F13F656A61F33B60A52F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653817608, "uuid": "a457a6c9-97a0-42d7-9e7f-fe4a4104ea5e", "value": "cb676bd597e1aebe0c403ed74bda8dc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653817608, "uuid": "bb32a846-d5d6-4f46-ade0-ec98be6acb8c", "value": "12288:pPr4x6wcVPdp9Fqwcqdl+EOprU1Tq8Vr1EhBLEn:pD4xXcyLE+U1TqUri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653817608, "uuid": "dda58fe0-4c0c-4605-881e-8e8c5c59399d", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653817608, "uuid": "5398a191-8b76-4efb-8678-17b280662340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653817608, "uuid": "74bee0d2-be85-4796-bfbf-bd599f1c6119", "value": "1f9a68461e4eb711c6f3fc1d85aa34b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95634dde-df0c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653800568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800568, "uuid": "e1f85f0d-eaaa-4960-98e6-52d88b826e25", "comment": "Malware payload (Mirai)", "value": "1d84e52893cccf49954232d10113e10a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800568, "uuid": "75d6fa34-e269-4cc5-9eb5-d1630d08c7f7", "comment": "Malware payload (Mirai)", "value": "ddf8f5804d77441434c563e55d5d393288d040f989548751727e63f138ce0eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800568, "uuid": "50d9b6c1-8973-442e-8d7e-62b2350ba21a", "comment": "Malware payload (Mirai)", "value": "24df04f4b49c556ce8f15516a23ec20595bbebd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653800568, "uuid": "7dca9f5c-b31a-478b-8cb4-d169f1008bc0", "comment": "Malware payload (Mirai)", "value": "21e9a951bf2d58c1d148137299486d774badc79b45a0e2d2d950a61b1f6e8f17f0eb7316e6826c0d37758cc23bf5f10e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800568, "uuid": "1546bcaf-82ab-4b5f-9576-488fe3dbe51d", "value": "T186B3AEDBB7475190C96386F40BC75B9D7E2322219F2BD8E76D0E293E58391CF4A0A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800568, "uuid": "7ba70f96-c181-41f7-bac1-ee90f1778f0b", "value": "1536:2pgHaq+kJ+x8OqfdM3cQKfxMLyjb/pdg2/LW1:0caq+kJ/OW6sQFLyjb/pdg2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653800568, "uuid": "b88f91d0-0050-4f3e-9395-e29417f12553", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653800568, "uuid": "c812d251-20cf-452d-891a-069f6bcdacef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653800568, "uuid": "c173450e-0ff8-4b1a-96eb-22ab2fc5daa0", "value": "1d84e52893cccf49954232d10113e10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2844c4-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799826, "uuid": "c8b1b6f2-42b3-4c30-a549-fc973dea0703", "comment": "Malware payload (Mirai)", "value": "ea913c91f705d15978108fd570c76241", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799826, "uuid": "b51b4a68-d0e8-48b4-afaa-0077fe4d3d1f", "comment": "Malware payload (Mirai)", "value": "e432ababc952ca1b6038f4beb3fbb34d91cac7f2de762dc932dd2ee13105ccf3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799826, "uuid": "504b9097-dca5-45b6-98e6-fe0df02a3239", "comment": "Malware payload (Mirai)", "value": "2dd1aea81e4b6647a0baa4c539b1289a943a0232", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799826, "uuid": "60a26aa2-36b2-4f7a-8cb7-4c0ec53a179f", "comment": "Malware payload (Mirai)", "value": "d9e77ac80c97f2f1c1f01cae57ee4ed346782b977362158e44741a63d2e5f0e6f8480da8c094b8e9f06dc60c306a4a0d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799826, "uuid": "abcf2ac3-7de1-4d17-943c-44ff60cbe370", "value": "T131431907A98481FCC05DC274437BB63AE86339BD0239B59727CCFE1B6D46E619E2D848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799826, "uuid": "10f19f85-2984-43fd-82fa-595053c32817", "value": "768:h52wVbytUrXeOcsbzCZRa6wrGOxy7eubWxZAopH7iz0IduZx0mt87HvZ+JmA:6UbytKcsbmDa6gGOx1iCnIIZx67Hvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799826, "uuid": "02c903b2-c951-4f8d-8118-bdd51a134b68", "value": 58624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799826, "uuid": "fc4a4213-db33-42b0-909c-6d74fc39e7f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799826, "uuid": "a48669dd-7b2d-4ae8-9c21-6f2d2a60f479", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ec3281-df1d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1653807957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807957, "uuid": "54bcff9c-9e2a-4c33-8a14-24c79581df32", "comment": "Malware payload (Heodo)", "value": "7d83d7565ceb3f3c55333f7f1ba19740", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807957, "uuid": "5701f005-2cc4-4c84-b09e-a37d1e079258", "comment": "Malware payload (Heodo)", "value": "e51ef72eba009c8b9c06381c22b6669a4300c98c31a08415e72fe62687e22eba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807957, "uuid": "fd819a68-09ec-4103-9cb8-62f4ffa8b66b", "comment": "Malware payload (Heodo)", "value": "653fc31d886f7ec98ddcd1670044f5602613122d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653807957, "uuid": "2e2dfbfd-312a-46db-b851-0d82e25aa20e", "comment": "Malware payload (Heodo)", "value": "6095e9c62c1b1069278d9db91c7c4c7e5dbd78c2c0c5069a749a0d9359569990be49b4e02d87dffff050873c797af35e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807957, "uuid": "55b62970-6369-4daa-8293-8485f77d0f4d", "value": "T16C94CF57225148ABE3537275B4235649FF327D81075486CB3280EF6A2EF7351EC2AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807957, "uuid": "c1e3335c-30be-4ba8-9b48-20fe61310f98", "value": "384ceb9f996fee01f9246edaa0cc74fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807957, "uuid": "eb5dd9a3-1e5c-476e-b023-e12b81ec7bdf", "value": "6144:I9wEpo6/4WaPgMIuxqq6Au/CwrQ8nRw212Uu9VrHnnCzK9N+COF80W89K6rT:lGo6/4W6QQqq6AQQnOuzTneKKCEWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653807957, "uuid": "4189956d-da13-4cf9-bb53-1db75bd48716", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653807957, "uuid": "5c597cb4-c8bc-4f4f-a7d3-e3c6d385c78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653807957, "uuid": "982f9f8a-ea34-4f85-b9b6-133d7e504a8c", "value": "7d83d7565ceb3f3c55333f7f1ba19740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b490e7-df5d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653835168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835168, "uuid": "18a2f703-f92a-43f9-93e2-abe17666f982", "comment": "Malware payload (Mirai)", "value": "458a9dd19c4c0a9e3d838a7b3b17bd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835168, "uuid": "a91390ed-57cd-46f8-9708-f1d35db58477", "comment": "Malware payload (Mirai)", "value": "e9f879fab5b8caaf3ce47c38b3706dbb6dc094b81f480666aeb7c51abe440832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835168, "uuid": "646f3fa1-4624-4814-bdda-b81a8fb7d82d", "comment": "Malware payload (Mirai)", "value": "b29cb9ceeac2ded17f8f6544f3ccdd849644d6cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835168, "uuid": "c3960966-953f-4bad-9a63-e0cf233466e8", "comment": "Malware payload (Mirai)", "value": "08598b3c8eab2dc4407751a32b5c946b26d56a05f540042ab6ff791eeed77155fefd7ff89ae412fc4919377deecdb7c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835168, "uuid": "814c7ac3-6816-4fcb-b91e-6b92e1362230", "value": "T181E2D053AA1D59A24731D872F9D90D834D490FFCE9F2367B2BF040AE1EE41492BDA193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835168, "uuid": "f39350f4-fc1c-4368-94bf-09e51e1f68fb", "value": "768:IqfTGLKLT27wZj5h7oc1mnpXRp9wh8gZQUAeY7IL8LZB7/9q3UELtc:IqrYKLvh54p39cqekuLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835168, "uuid": "8da5b06b-8c0b-4f69-8789-99eebc5c5c30", "value": 31192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835168, "uuid": "c8ef9e35-c214-4f42-9980-f4e93ea819b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835168, "uuid": "3b0cdfa2-442e-47dc-9cfd-c1c8bee1fca0", "value": "458a9dd19c4c0a9e3d838a7b3b17bd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9aae15-df14-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653804123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804123, "uuid": "42ec9078-8ca1-4cd6-84f1-50a2f9bbaa38", "comment": "Malware payload", "value": "b76b916cd06c826463132254bbc97a31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804123, "uuid": "7f1643a5-c81e-4fea-a7f0-e2c5b1d408b6", "comment": "Malware payload", "value": "eb0afc9954eb17112e1ea30ea1478eb8578e4cf090c41e49380fae309e07a19a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804123, "uuid": "8bb30415-43f5-45a1-a1c0-60998d8d776b", "comment": "Malware payload", "value": "8930a156538bf688d016810c79a7a4c0462d4211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653804123, "uuid": "57c45792-340a-4f81-8d01-1ebcbe7e4992", "comment": "Malware payload", "value": "7e537d0fda6a30249e1cc24ad815289bee6debe1a34f2b09147b5b71c6340a08288e0faaa0a0f5aa44547407dabc74f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804123, "uuid": "33c6dfa7-2b02-4d31-850a-98523c4a66e6", "value": "T179A51212F2E4C0B3D1B613719EA58239B26BFD309D38420F57D0F6ED5A716539E28B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804123, "uuid": "76ab4619-cc8a-446a-acdb-5e648dbfdfc5", "value": "b5f7e0f141d30cb0afed498f1cf11e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804123, "uuid": "aabbc38a-bf7c-490a-a64e-492d6fbb47a4", "value": "49152:GFeYiysdeZlVpaSG6ghRTaWqGyh60T8mJ:GwYydqle36wqs0T8mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653804123, "uuid": "553cd1a7-53b1-4fa6-a288-af4c0c46dc36", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653804123, "uuid": "c5e4b597-8796-4bd2-993b-2e8593700982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653804123, "uuid": "d1accac9-f026-4121-a8b6-374b0ff006a8", "value": "EB0AFC9954EB17112E1EA30EA1478EB8578E4CF090C41E49380FAE309E07A19A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69189dc-df55-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1653831976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831976, "uuid": "b6bc8533-ed13-45e4-960c-762efa29780c", "comment": "Malware payload (njrat)", "value": "aabaed817c34e880ee1a64ca9d08901b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831976, "uuid": "23538e85-1c87-4117-89ad-0edf80383063", "comment": "Malware payload (njrat)", "value": "ebbfa09bd5659cfd281fa3d27b6e8be14217a2933dae10e2dfb4669253cc03b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831976, "uuid": "b4c3c6c7-c8a4-4d1d-a380-6ed784b2680c", "comment": "Malware payload (njrat)", "value": "6a9157a8fb5b4202a71199d197853113430cbce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831976, "uuid": "67f1fa6c-e4b2-47f0-828f-ad1b2086e264", "comment": "Malware payload (njrat)", "value": "4bfaf2bc0d9111ea7281813b48486745192b7e326f496a25bdaaa12c7d853a095bc1c585e7801e4d779da0fe61cd5967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831976, "uuid": "a61a9f52-56c2-46a1-baec-b1e01634950f", "value": "T12D94012D32B85F21C5B55BFC22B1305603F6723B7112FB6D8CC5A5EAA861F104B49EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831976, "uuid": "97a7056b-fdb9-46ca-b65e-d995e952cf22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831976, "uuid": "3917f5fe-3847-4420-a191-badf8ca7e2f9", "value": "6144:+x2LAx4vnfSk7uRVckqSVlaurgDN4zlxmqjcCtJA8oI5XZb+Kdg5JqXv3lnOJKqC:+jPnVLrgGzlxmqPLzKjJYaKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653831976, "uuid": "51df8708-25b5-4b19-b7f3-c1138ff097dc", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653831976, "uuid": "9889779c-473b-42f2-ac75-29c30eb11d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831976, "uuid": "4159df56-0017-46f1-be8f-64509fc30b66", "value": "aabaed817c34e880ee1a64ca9d08901b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b6f9ac-df54-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1653831537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831537, "uuid": "3dfd6fc0-ac0f-4504-b523-8c80083d784e", "comment": "Malware payload (Smoke Loader)", "value": "553a36be9a0f6f4e384e4c1c64721050", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831537, "uuid": "6d50be1d-3dc6-48ce-b3f2-06a0b11e9c02", "comment": "Malware payload (Smoke Loader)", "value": "ec2e6f3e0ef4ff00389444dd676356000fb45b9335164ea9e26b75102367f4f5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831537, "uuid": "42fe9c71-6294-4f36-9d7e-0339b5923697", "comment": "Malware payload (Smoke Loader)", "value": "d9d408abecfbcf17ffac4273254dd24a800795e8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653831537, "uuid": "f54a80ca-3ce3-4f2d-ad70-acd504dbb4b7", "comment": "Malware payload (Smoke Loader)", "value": "9f135976d32e60bdff6c54c54fbbc8e5b4c79ec5587733b9cac1979413f68eeef4752b439ce08624558e93ad66bd9c1b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831537, "uuid": "9d34ba4e-346f-4896-bf62-999120b9207d", "value": "T15A646C1077B0D436F1B712F4897A9368B92A7DA17B2461CB62D46AEE5634ED0EC3070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831537, "uuid": "90ffdfe8-31e0-4bf4-a7f0-eff9c35d134d", "value": "1d41b9069c5482c12d37b3d8408fd8e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831537, "uuid": "c98b7965-d08f-4074-88f9-e55e9130fdb2", "value": "6144:5GiiW9GApZNAbqByjOP05heEFI6izzVQO8hjvY3Ba7:Iii8pZO+ByjIOheCiWxheB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653831537, "uuid": "599cfaaf-31ce-4f43-a7d8-2c4024a73747", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653831537, "uuid": "e5100448-6271-411e-ad12-943f470e513f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653831537, "uuid": "9e388eb9-9288-40ed-add1-9c975e81c06f", "value": "553a36be9a0f6f4e384e4c1c64721050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d827355b-df0a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653799821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799821, "uuid": "6f185da7-3a3e-4cbd-a146-fcdb5e4975ce", "comment": "Malware payload (Mirai)", "value": "5c312f615e37f687cd048d3c406ea9ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799821, "uuid": "b55c74f3-6e83-458a-b5d1-d40ce2099f93", "comment": "Malware payload (Mirai)", "value": "ecf843b66828b9aeee306bbe6da74b94d87b0c4b16b04f3d2f5d87a31a68363b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799821, "uuid": "125ad31e-c260-42d1-950e-ef7edf748952", "comment": "Malware payload (Mirai)", "value": "5413124d06c9145684f0b482b9d5b3524d53ae31", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653799821, "uuid": "fa7971cf-bfa7-4a05-9780-cbe4568ec20c", "comment": "Malware payload (Mirai)", "value": "c94bf38eee6ca85b7eceac1263019c28ad6aa40b1ded28396e0ebdc89667ea8376faa7ff6699958268d8d1c74f8ffd25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799821, "uuid": "6d486b24-c5a4-411e-bbac-6c0cc847157f", "value": "T1F763A50E3E719FBCFB9C863547B78F20924933A626A1C685D15DEA011E7034E345FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799821, "uuid": "b81ba2f2-a673-4395-a786-53ebf62c357c", "value": "1536:t8cd7Y1je1aVQ7pHenXFnXaEnX1Qw7vdD4+wUwCDwxW8lZ4eamg:BpAjwaqJchNwCDwxvlZ4eTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653799821, "uuid": "7525a2c7-2ffe-47f4-89ad-f234cb4e1c3f", "value": 72744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653799821, "uuid": "406b075d-b3e0-414e-8e75-9eb9e6384578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653799821, "uuid": "6b44a440-7b2a-41e5-aa65-932e2d876db2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea65c364-df90-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1653857404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857404, "uuid": "7b6d9f10-1575-428d-8e86-5998481fd375", "comment": "Malware payload", "value": "103c8e46b6673a7a05ea36c155b80837", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857404, "uuid": "0ea865c4-79df-432c-bba3-63bf32cc7f0c", "comment": "Malware payload", "value": "f219a45b40d7d5f77b2d1a6e2ff8f217497e1b8ce33073243d0fa328751fc31f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857404, "uuid": "7b79a352-c9f2-4adb-ba02-482be68aac61", "comment": "Malware payload", "value": "5ccf5e55c2dc289e83aa1d543e18aa8356dea46b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653857404, "uuid": "f3c5d3fa-4c58-4641-a36d-710bf508502d", "comment": "Malware payload", "value": "6e8d9141e90992141522d89dc5fe345cf81663366a4c10992161a44cf36df385db5a15a1af9839cc19e164c278b3d942", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857404, "uuid": "a0f12c15-876e-4018-ad17-3736a41587e4", "value": "T1C8E18E9BA5C05127C98A00BF7A8969E696B09B000BDDBDD1393D8C4E977739C0BD48D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857404, "uuid": "ea6c3e3f-0ccb-46eb-a536-f81bcb72f32b", "value": "192:M8EpF1lhLM/oiTT9cgXcDZ4+eOfX8AGttwRWY4:M8Efh4/NzcDZ48fXlGsRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653857404, "uuid": "7e6feac1-653c-4a5e-974f-be14b0eaac0a", "value": 6960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653857404, "uuid": "898cfccd-a1f2-4dec-9e4a-de68a55bcd38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653857404, "uuid": "b44e49e7-b23a-4a16-a6b4-9930bf382116", "value": "mirai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f7f689-df3d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653821402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821402, "uuid": "e2e05466-2c8f-480e-aae8-f4f7295abaa8", "comment": "Malware payload (Mirai)", "value": "25ae38913b8795212c3f881b35472401", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821402, "uuid": "27c925a0-27cf-4c33-9897-618c87e44d2d", "comment": "Malware payload (Mirai)", "value": "f61cf9f77b0f112b5c72d5f1d918b2831163f77403d21486106a12a86b1af044", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821402, "uuid": "3304f31b-3cc6-4cc7-a415-c35025e0e73e", "comment": "Malware payload (Mirai)", "value": "84cccbe1ed5670f1a8817d463277b0c2c1892bf5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653821402, "uuid": "c6ab4989-bead-4cb7-9e89-e7aaccb2d9de", "comment": "Malware payload (Mirai)", "value": "f5d3449eeab19c7ceb2adb14bffc4cc3e5b7509ce149b95ce0f14ee8f1b0b5159ed0d7273b3072dc13990a9cc35bc0cb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821402, "uuid": "d678c60f-a271-4e6a-8b2f-8975f8ed9ebe", "value": "T1AFE2E110E95B2073E9F0483DD8BD7AC3629A0BF4537B7DA18D180614E7EA01516F6F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821402, "uuid": "33933537-fc08-45d3-b439-c940cff9f8ea", "value": "768:juL0sYnIDyZe69EMxTIxcZOlf1/V4lJs3Uoz6:juL0LezEWFlfN2Uz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653821402, "uuid": "33bfeeac-5bbc-49ca-a415-747cf39b9b5f", "value": 32436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653821402, "uuid": "05b1c451-6f2a-4a5b-abad-8d15ff4adbd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653821402, "uuid": "f20b50ef-01b2-45c9-b659-9a036ea37030", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6056e9cc-df4c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1653827966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827966, "uuid": "2696563f-f1df-4cd2-a2ab-5393deb66591", "comment": "Malware payload (AgentTesla)", "value": "fefb1b4e29e050178817f80f11efce22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827966, "uuid": "558cb8eb-c28c-4caa-a6fa-c3233ef5889a", "comment": "Malware payload (AgentTesla)", "value": "f66a429adbab85ef580f3b0f07565d3a9df536cd564fe20b2b0822e599ac042d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827966, "uuid": "6aeb9630-06db-433e-937d-72a1f2e3ef23", "comment": "Malware payload (AgentTesla)", "value": "6f8aed1b461af114c292983b788a0c15fd5d1666", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653827966, "uuid": "8d2ac3cb-8bad-43e0-b669-029bbe800741", "comment": "Malware payload (AgentTesla)", "value": "912c4e36fef7ce33b070e3b6db0c64c7d7d5d3396edf49902358d80d42d0dbacc50ecd2e378744b344d9275006766a1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827966, "uuid": "29f83fd5-1d78-4f7b-ada7-0336231e893a", "value": "T1B0255B2163844FA9F87E777F6160018093F5F886D721CF4EBEC580D94662BC29EA7B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827966, "uuid": "2579faee-f112-481c-b9ba-35e855f480bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827966, "uuid": "fc2d5808-40d6-49f9-8641-9ccc7b63009e", "value": "12288:0supSAAokvUupkFq0DO+7ZQ4ZAdJHnIrs+n1Q8YeDowBSF0:Jup+Ppkwd4UHnp+BYB7F0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653827966, "uuid": "ce6a1baf-cb97-42bd-8b65-41e52447eb92", "value": 971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653827966, "uuid": "3bdd6a8a-9ec8-426e-a431-5472d297c1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653827966, "uuid": "cfd1f0e1-dd66-4c38-9a8a-8a42f32bce59", "value": "13TSW URA PP LIGHT PAYMENT DIRECTIVE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0109ccd-df5e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653835804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835804, "uuid": "3ffa5513-05ba-4131-9cf0-de934072a880", "comment": "Malware payload (Mirai)", "value": "adc910c1e00bf3d6f3b8fec773d40b89", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835804, "uuid": "73a625b5-e834-46c0-9eeb-0ffb03e56173", "comment": "Malware payload (Mirai)", "value": "f7a037aa69eed62c7259be85175484609ef2d22d55fa487fc3bdad08db763b24", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835804, "uuid": "b5271172-0170-4b5c-90fb-4f26566ed294", "comment": "Malware payload (Mirai)", "value": "aa14e77ea0ffc02b4fcae57c89fe1ee819c5465e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835804, "uuid": "eea53938-7f0a-4957-9d36-1d75322dc58a", "comment": "Malware payload (Mirai)", "value": "3433206ae6b63c86abf495e19e81c3f40b1ad83401ef5befe10b8e74b2320e757610c448c198cfbbf42db9c7e8ed0f5a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835804, "uuid": "e0a387b0-872e-431c-9fc3-38e9a454d81d", "value": "T12FC2E0E2B092B890C770CB31DA71E502749677F9A07B30FA1422972CE1DE2450DB9B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835804, "uuid": "0addc614-ebab-459e-8a89-d35b4b1bbd74", "value": "768:uZ3dukTibk1RqqgDq4RKNAtJBb85VFsus3UozQ:ytukmbOVgDq4UNAtHboVFczQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835804, "uuid": "a4cf1d10-b879-4084-ad2e-f0bcf7882162", "value": 25988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835804, "uuid": "cd860b40-f0ea-4668-8ba9-60da563d61e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835804, "uuid": "73410097-e3a4-4b99-9725-adaf77e69faa", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2006b2db-df5d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653835160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835160, "uuid": "6dfcea6b-4956-4148-b176-8aa1a7e50438", "comment": "Malware payload (Mirai)", "value": "cc3c96ac5a8152627a0d6ef626c46825", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835160, "uuid": "add598b8-d120-48db-975f-820f6643c7f8", "comment": "Malware payload (Mirai)", "value": "f84a928b60f933f52d7583771d0c743ece127c49ce3dd0f87489cec8d825c3f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835160, "uuid": "6caf7eeb-eae3-41ee-82a9-f3009683e255", "comment": "Malware payload (Mirai)", "value": "b0e5e8d2413244ecb862ed573459f79788d733c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653835160, "uuid": "738594ea-4826-4daf-8adf-6b077512c818", "comment": "Malware payload (Mirai)", "value": "45cf9593606d9150b297991b8fe1f4c029247fce5d11a8159f6b09caa99ef1afb33473be6f27bb36fa18140a852e2054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835160, "uuid": "8e560486-175c-4d87-b028-eae486ec3485", "value": "T104534BE6B401AE7CF41BC7B685670D09B431A3494A820E33B377FCAB6CB21649567F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835160, "uuid": "966c3049-766e-4527-bdd7-b19109e3f678", "value": "1536:HFSrQauQGtXiRRqjzcFwENgI34tnAcpc9urLZ1U8Vkpa:HkxGhAwFPjLjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653835160, "uuid": "05d8a6d5-1229-42e3-ac09-350f8ac8e905", "value": 62804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653835160, "uuid": "d4660fe2-a1e8-4dbb-af5f-01b879894e77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653835160, "uuid": "7bd4c194-94d6-4303-86a6-979870aa87b0", "value": "cc3c96ac5a8152627a0d6ef626c46825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f33685-df80-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1653850258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653850258, "uuid": "a755f45d-74f1-4cf9-93dd-5effa1adeade", "comment": "Malware payload (AsyncRAT)", "value": "96319b62b834a1322131b0e7f38ef590", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653850258, "uuid": "fafb945f-2485-4044-880e-bc6ac7b71af0", "comment": "Malware payload (AsyncRAT)", "value": "fd07acf3326411ce1a0abd2201210c873e330c6801e85153f4f083a372be19cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653850258, "uuid": "e6d7acbc-3bde-44c8-b259-e298218c82eb", "comment": "Malware payload (AsyncRAT)", "value": "2329615dc6dc84d032ef4784eb15a470a824661f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653850258, "uuid": "fcbfb724-7d76-4c43-8c02-1180ba4ff6c1", "comment": "Malware payload (AsyncRAT)", "value": "fedbcd77331599b0e5813426621544a149f98f082ac3b23813e7714382b8719d42a316a7befc6f5457192980dae6f576", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653850258, "uuid": "2bb5c585-e0a6-4f36-839a-a3793425f20e", "value": "T15CB4F10AE765AEE4E57D03BE3030687A3F70972AE4BEEA1D606132974D752C2045BDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1653850258, "uuid": "73caeb1d-da6a-4f83-bec3-f3f3a8996669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653850258, "uuid": "3bfb6c6c-d4cc-401a-9235-efc47d4acec3", "value": "12288:yjGZFF0UhpgtX+3dX7wzLmrecdylrIIHOlp2/Dj2:7wX+NX7wzCqcdybCO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653850258, "uuid": "7863476f-2650-4693-aae6-98e00e5f8c20", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653850258, "uuid": "6b2b65c9-f41b-4088-86fe-ad59c58870a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653850258, "uuid": "7cbb84f4-e7a0-4d01-827a-d9f58aeea319", "value": "96319b62b834a1322131b0e7f38ef590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a259e3b4-df3e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1653822064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822064, "uuid": "87740b8f-c1ae-4a12-8360-8ca8d3d5549a", "comment": "Malware payload (Mirai)", "value": "b17a98b62f68f0f210fcceeaa02ef88d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822064, "uuid": "95fc3ed1-c107-4c4d-ab0b-2b1b732020c9", "comment": "Malware payload (Mirai)", "value": "ff1bb27d8da79b48b9c56c4dadd4264ff1dbf102f08a932a805da8cf5e2ab1c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822064, "uuid": "2d28bf03-6c7b-443a-b995-7f1b33b4daf4", "comment": "Malware payload (Mirai)", "value": "8235615805cceda44c20aae2b0f10769dfddfd5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1653822064, "uuid": "08a869cd-c3cc-4428-8121-642819d841a1", "comment": "Malware payload (Mirai)", "value": "fc053d89bb7ac3280e235699fcd67ccd187f25a1923cf665fff2fd0b660e16f42f57511c4c00e766b26bb94f499d1a7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822064, "uuid": "477f120f-81a1-4918-8b3f-4caa25155b5f", "value": "T1C8E2F13C360160FCD9EAB435DBD02BBB3EB34E260122E947BA89A5D1DC9A1743593CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822064, "uuid": "66bfbfb8-0f2b-498f-a177-cfc8dddf9aec", "value": "768:rc56VhgMGhlCR/MWFsI9AwNYVmQTZJgGlzDpbuR1JV:+6alhlCTFb77oLVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1653822064, "uuid": "3eae8607-aafa-4ed6-b671-e4b7d759efe0", "value": 33188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1653822064, "uuid": "19e2854e-af76-4667-9f12-4cad24280bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1653822064, "uuid": "cc0c3413-e284-4833-ba75-c9052e0ce2c3", "value": "b17a98b62f68f0f210fcceeaa02ef88d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }