{ "Event": { "published": true, "date": "2023-10-15", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-15", "timestamp": 1697414582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f5fba159-3bde-4711-9fb9-a9a180f32db1", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb459d2-6b66-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697379924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379924, "uuid": "40cca58e-8b88-4f4f-82ce-5e2d83a218de", "comment": "Malware payload", "value": "806170b26a29858572713c4925e769ab", "object_relation": "md5", "Tag": [ { "name": "194-169-175-239", "colour": "#D5ED11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379924, "uuid": "d4f0bccd-08e8-4e3f-b7fa-e64a03104df0", "comment": "Malware payload", "value": "004e576edfdfb1b8f31a65e4c6e43edc17d194835d3142269f9456de83fd83c8", "object_relation": "sha256", "Tag": [ { "name": "194-169-175-239", "colour": "#D5ED11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379924, "uuid": "f727be52-df19-4285-a946-6e5003b099a5", "comment": "Malware payload", "value": "55e2aecda6f1b799b0285aa4cd5941023e801ed2", "object_relation": "sha1", "Tag": [ { "name": "194-169-175-239", "colour": "#D5ED11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379924, "uuid": "626635da-0ba3-4b7b-992f-edd3fc2b982a", "comment": "Malware payload", "value": "1a61287bb451d87f817218bb80689e10cfcefefc56619d2b00b3e4c9dc47934afe3f951b6dd1b91a062bb3a34629f8e6", "object_relation": "sha3-384", "Tag": [ { "name": "194-169-175-239", "colour": "#D5ED11", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379924, "uuid": "ad6e011a-c591-4d04-bee9-210b888a8513", "value": "T1503633BD23EAAAE7EEE887308CB187695104DB0510E3BF08D157A55FD843520265BFBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379924, "uuid": "6305ee09-6bd6-4f73-9e71-236e392d2d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379924, "uuid": "f1a0ce61-e2e2-4385-9305-7afe14451e67", "value": "98304:t4rwGXWJc838/TjjHP5SWsaTdP3AxPi72JvoVRRH6l9EaBGiDVnRwwzUs:t8wGQc8s/LRSWsQPQJvCvHm9EVi9RXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697379924, "uuid": "4046a865-870c-4eba-b439-87d05465aeff", "value": 5040640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697379924, "uuid": "45d20b8c-e6e6-47bd-be66-727ce9693dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379924, "uuid": "9eca4e0e-d3e1-4888-9ff4-bc6f654e313d", "value": "42500fb76d3881c4fa2e66f1f670aaf80f747b1a02d9fd52998aa331", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922ab854-6b23-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697351101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351101, "uuid": "ed21a7cd-deff-4923-ab3a-c3e0d1f47bdc", "comment": "Malware payload (AgentTesla)", "value": "a40bfb2ebfe0ae6ac1511d07360c274e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351101, "uuid": "4454055d-700c-4dcd-9788-a5fc98b384ae", "comment": "Malware payload (AgentTesla)", "value": "01a504a7571ac5327c01f0ee385af81a1351fba34b0945e5ace45848170c60d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351101, "uuid": "350831f9-aebb-4598-81d8-0ff58ac7ee31", "comment": "Malware payload (AgentTesla)", "value": "94b84dc82ddeab45ae436cca3b760b993fc9e03a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351101, "uuid": "b0ec3e1b-c5a8-4679-8c45-41fc22410983", "comment": "Malware payload (AgentTesla)", "value": "82dbdeba7327378792c1a725a3d5d3fcc2c1d3384269e888ac06e87ba215197deb8de4e0a3ae0b0eff43eded2e574219", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351101, "uuid": "630bcda6-1a9a-40e4-8867-bceaf4cc018b", "value": "T1F386372439FA501AF173EFB64BE479E6DA6FB6733B076469109003864723981DEC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351101, "uuid": "f3284853-62bf-4427-87b1-3d90adee275f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351101, "uuid": "22aaef61-91ea-4e2d-98bd-979b08dc9416", "value": "12288:34cvPMUdz7Neiu7GKwkfYaMh95p8hNtPqK7FZFUIi8dJfXrxFCfzlbBOo:ai4Szx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697351101, "uuid": "684f4e04-410b-409a-a0ed-377766550a07", "value": 8000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697351101, "uuid": "1ee5f339-22cb-4251-af7a-e4b92f37266f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351101, "uuid": "02be847b-b39b-410b-907e-16d7343053b9", "value": "ChromeNaverGameStarter_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac647510-6b30-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697356728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356728, "uuid": "30e4adb0-46dd-4960-a8a5-e7919557ab33", "comment": "Malware payload (Healer)", "value": "c3db948a2f5d3c222f9765880a13becf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356728, "uuid": "29a55aa5-04f2-4985-9e9e-d69f17f6a731", "comment": "Malware payload (Healer)", "value": "01fcc207b82abf8b833a8c63d79f3aa448c563bedd29e430d7a7eb306f102cf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356728, "uuid": "983fe8bd-31e4-44ac-ab30-93a654ed8efe", "comment": "Malware payload (Healer)", "value": "cff5b6d7a7a61f55fd168c180e551e2c56e3326f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356728, "uuid": "0f38830b-eb1d-4aae-948a-f39dc970b158", "comment": "Malware payload (Healer)", "value": "0eb620e18d2129f2617273ceca4f4963f0ff24123a445585e2a0834e78914cbcb5dd62f6856b60f807f02924a9560b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356728, "uuid": "08d96c0d-e838-4f95-aaee-5fe41fbf22b8", "value": "T1B5151203AAE86973D4B067702EF707C71E35BC625934937F278A699A4CB3150F83176A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356728, "uuid": "b032543a-3ff0-47d0-b251-583546d53c4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356728, "uuid": "af9be197-2cbc-482a-87e5-b6773109ef5a", "value": "24576:oy7yqLG+0QglMZcRWf0HdeDSbWTlrRtPKYG3Xuv4:vuf4WRWf0sxrOYG3+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697356728, "uuid": "0df2db69-bab3-40b8-8e6f-33513851f85e", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697356728, "uuid": "acf852fb-0177-4dae-86b4-bfd0ccc0f98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356728, "uuid": "52f19e88-51e1-43bd-81be-b7ebe4ea7f9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5983417-6b45-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697365737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697365737, "uuid": "ffc1f730-b405-438f-ad91-59d6b08e06bc", "comment": "Malware payload (RedLineStealer)", "value": "29d901b1d78d29b2b09f54f0c80095c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697365737, "uuid": "cdedbe06-f29e-4acc-9c96-0034aacad6e0", "comment": "Malware payload (RedLineStealer)", "value": "02fa85eb8eeda88516e12aa6ff29d988a2e2aa34c12a53a08ce518f92764454f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697365737, "uuid": "a9e69cb2-00dd-4ac5-902d-fe0a28eee677", "comment": "Malware payload (RedLineStealer)", "value": "48f8a476a2335dc4dd04b8f1c7f8cf59abcb2383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697365737, "uuid": "e64e0bd0-3180-4af0-bf15-6cbf0574867f", "comment": "Malware payload (RedLineStealer)", "value": "4ee7f89d307d6a76ad7ead2ce5357a1ba0de3d9abb753168045ba4657963258755f4a01a0c21b32e641fa0e32d2db7de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697365737, "uuid": "424e0ebb-a1c6-47eb-97fd-890e7db96a22", "value": "T13F152226B7D884ABE9B1233068F716970E313DA19C71972B77856D1E0C32790E67932F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697365737, "uuid": "926bf174-b2c6-4745-b14a-657f76f450eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697365737, "uuid": "24259776-afa5-4a15-a2a8-abd00b2d3656", "value": "12288:4MrXy90btyMbQhSMUYOnpNDVyDQA/CiIfp6NN4x6ctUOPTu6bOn7UfV3248:/ycbrjpNDVmqiIfkNEntHLb6It8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697365737, "uuid": "b4956153-3880-40a9-87b8-9a912d21a7ff", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697365737, "uuid": "61ab3041-38c4-484a-809f-06ec4bccbe7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697365737, "uuid": "49d74113-0817-4736-b96f-4cc58451aa7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb71d913-6b9f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697404455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404455, "uuid": "f43eeba3-05e7-4e27-9c95-547e46440d32", "comment": "Malware payload (RedLineStealer)", "value": "9d2f1065fee0a4b84ac0973c5c855add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404455, "uuid": "a825fb18-7c27-42e0-aaf0-9167ee390128", "comment": "Malware payload (RedLineStealer)", "value": "0423c18e5f792d4efc6279afec16c6e135b470eb2f8ac51469a2b31df740faa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404455, "uuid": "9bd644a2-55f5-48a4-aae7-7d8459d04f92", "comment": "Malware payload (RedLineStealer)", "value": "36d76c9a3f1ebfcdaa491497425cf0ad7fafff38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404455, "uuid": "62c9f51b-8a23-4c36-9b63-2f769a98290c", "comment": "Malware payload (RedLineStealer)", "value": "53b0b7746181fd11c424911d618c34220d4b67866053e1b5de483d7294e77053669f07ea6631865f94bbd4bac1756bf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404455, "uuid": "66965f14-8b63-4fd8-b51f-34080a8c76f8", "value": "T102252302AAD5A023FDF51B706DF603830F397EA1987443972795E6491CB23E8A87177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404455, "uuid": "5b6b3136-6874-42c2-a312-397eb2ce8af8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404455, "uuid": "1005a05f-dc58-4306-a53f-2cd219c12479", "value": "24576:pyXPdpDLvLZxqxwRjzechotSTw59P7wTi:cfdpXLZx7R3eKjgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697404455, "uuid": "a9ad1b44-6ad7-447f-94ce-3bd97a35d14d", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697404455, "uuid": "28507662-070d-4e32-ad19-bf482aa7fd3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404455, "uuid": "8b8828a0-e95b-4228-868a-3b96b2c9862e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe551d-6b91-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697398245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398245, "uuid": "8384efae-9a37-439b-bc33-eb55c5fb6866", "comment": "Malware payload (RedLineStealer)", "value": "a008945008029d0f647a97aefaa27e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398245, "uuid": "57cd6349-7326-4a07-b51d-0c770a003471", "comment": "Malware payload (RedLineStealer)", "value": "043857a395cda67516ad1d27eb86a8cb315c28588dc3368a394dab411cecb493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398245, "uuid": "cf0a457b-e810-4f02-aa02-76d28fa7e5c1", "comment": "Malware payload (RedLineStealer)", "value": "3dc038e6d17bb9b2ecd705ca9c481f7e5993583d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398245, "uuid": "d0b4d6ed-373c-4467-93a2-338550daf447", "comment": "Malware payload (RedLineStealer)", "value": "7be19d1603529e34b917ddbc007993e3b147756c04432a955a3eb089cef6d1ea5d3ab28e22bde8969fe524b79aec3c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398245, "uuid": "3c6a0b7b-5efa-4057-a6c4-4550b07f6e19", "value": "T120252353ABCD44B3E8B40774A5FE07C32A3A7CF0597A862F2586552E08331D6A57633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398245, "uuid": "1b0553d2-3df4-4672-a88d-ca396aa04e32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398245, "uuid": "2e842743-d00d-4d7f-b27a-78c50a32d00f", "value": "24576:syj9mqJFz+BPyIRCwkbd6P7OdyzfH1kN:bkqJx+BKIwP3yzH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697398245, "uuid": "b5bc21e3-ac8f-47a6-8ccc-926d2294c041", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697398245, "uuid": "3ffe8dcf-4470-4076-93d6-59c42bf9891c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398245, "uuid": "df8e9ad6-00c2-4f12-9687-8992bb819682", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b773fb6-6bb0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697411595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411595, "uuid": "45fe54ef-b0b1-4689-9517-fb09cbf80a4e", "comment": "Malware payload (RedLineStealer)", "value": "ea2eac7c0568b47c0777d6e93db9f69e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411595, "uuid": "cc46705c-6c89-46ff-bd44-a19c2bbf40ad", "comment": "Malware payload (RedLineStealer)", "value": "067e3015fb1eaa28cc22e0d0260e8bee853c7e62d60c8d1c67b92d83befdc03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411595, "uuid": "47b3dc27-c44b-47cb-b0d9-25ad1b00a811", "comment": "Malware payload (RedLineStealer)", "value": "5dcf53a2e5b3184f7b130c6477db1bd2399d5d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411595, "uuid": "b06514f3-5e6d-4d6a-a9aa-9e956a22d695", "comment": "Malware payload (RedLineStealer)", "value": "75b489c7fabbb5b0f80c2376fb95c737db93316318ac59d71e2e36e60077bc0ab6020201bbd7ecbc4dd1676a0fd541ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411595, "uuid": "b2a15f5d-4f4e-43b8-99ce-32ca2c4b76a7", "value": "T1FE252343ABD846E3E9F4277008F603871D367CA05D78772B2696A65A58733C4A9323F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411595, "uuid": "f73212d9-85a0-435a-8c59-4e28b7e09ae4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411595, "uuid": "973bca87-a8c4-4a8f-980b-1c54c1be268a", "value": "24576:zybpM26do6f42WnpRYsi53SHuSMK4sSQ1Na1+:Gbl76ANTYqHlxyga1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697411595, "uuid": "396d5a5b-819a-40a5-9345-51ed584c5c74", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697411595, "uuid": "0582e999-d77c-4fbf-927c-dfb73415d71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411595, "uuid": "fb00939b-142d-4b29-96b4-2de278cd0780", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd552c2-6b92-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697398557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398557, "uuid": "ded340dd-0ddd-44a6-93da-451d617de7c4", "comment": "Malware payload (GuLoader)", "value": "aa23da1c620a1f49ab0aba852c8ecb5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398557, "uuid": "780880c0-a3c8-4c70-9657-6b535fd6fc1a", "comment": "Malware payload (GuLoader)", "value": "06c17e93ced6c6afed70721d94e87cda26ab3ad1d4ac9d866d38878dc7ee22aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398557, "uuid": "04323fb8-05e9-41ea-a1ff-2e931455f87d", "comment": "Malware payload (GuLoader)", "value": "686eb45ae27b1a0068070d2c302cdef8bc578730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398557, "uuid": "cbe37c4e-5edf-4f36-b6d2-78543d104478", "comment": "Malware payload (GuLoader)", "value": "a1fbc870334eb94737fc435fb5bb753a8719fb9a10c4166897a64dab9a7167ddb92db84c6a851f75e6a672c8a456e594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398557, "uuid": "64fd9710-2d3b-429d-aabb-2ef3515bf9c2", "value": "T16325012927530297F4487C710068FEFA37D09C2D59A5BF9652807E973AB211C4A7FE2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398557, "uuid": "cd5718cd-4053-4ee2-b111-460642046f5a", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398557, "uuid": "83c4440b-1e42-4854-8938-6c7224891b91", "value": "12288:Tn5DpCBhnc5HLPSTKr0wRQ77rD6mY8cCS2mjlWhz91U6qxAtch47jm6d1gZYnCLf:TnCY5TS+rWKmG2IUhjU6FBd1UDqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697398557, "uuid": "caab388a-f469-4e91-a2bd-2b1ab8f86d52", "value": 972072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697398557, "uuid": "73376e21-b2c7-4f02-b773-8ddb21d6161e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398557, "uuid": "41f0ba44-5279-44ad-9e00-a5772a378cea", "value": "SecuriteInfo.com.Win32.Malware-gen.10191.7591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a4b342-6b99-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697401553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401553, "uuid": "b5bce428-11f1-4f5b-b0cd-10fd614c6bf3", "comment": "Malware payload", "value": "fe9ae73089d3b399f8a6e0506e18806d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401553, "uuid": "863d2251-d630-4292-b7c3-c0a79d44c9f0", "comment": "Malware payload", "value": "078ecfa66cf7c2c474c3ccf595e4758984e36c0fa9bde28fdc9e04d0dccacf8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401553, "uuid": "b67fff07-268d-4951-b34f-a18988351b41", "comment": "Malware payload", "value": "3535998e49e5732ebb103da888320cf7386462b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401553, "uuid": "da1109dd-1470-4de6-a1ae-83acab7042ea", "comment": "Malware payload", "value": "aaab796caea2eb8982b52561aeb4ce71a05fd7408b980a9a0ed80c675fda4e19c9a8f0e2ee2b5e36b8a5b648853c3696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401553, "uuid": "6c62d7ea-04b7-49a8-9208-caea71433434", "value": "T193252352BBD48662D87017F068FB56C309377DF09A7D826B3385EC095C7228AB67173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401553, "uuid": "47cceb3d-c89c-4a1f-aa39-b00cd557ec81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401553, "uuid": "b6cf8462-280f-4e56-82f2-d1a50e9bcda7", "value": "24576:OygmttAlBXeFvi1oTAjhG9ql51WjPdb9JQxajqjQd/VeuVfoS:dgmtqlBXeFvYoc0s/1WjFwaBlVeuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401553, "uuid": "c525c697-afba-4bfe-b056-11385c133543", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401553, "uuid": "2de896f4-5803-487b-9e4e-dbd6df491076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401553, "uuid": "73c82222-c08e-476e-8511-531b8d0b931b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685234e9-6b85-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697393122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393122, "uuid": "b7f11c6e-8782-416c-8ccc-e28e099ee0e4", "comment": "Malware payload (RedLineStealer)", "value": "a93b37b36fc6c656a935a5d6e99b9b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393122, "uuid": "a8c036e3-02ac-4ea1-bf61-e56126b8fcbd", "comment": "Malware payload (RedLineStealer)", "value": "0b51777ecc57fd5b1fc1c7fe8adf8b90464b4ef5a7e716cf34363a8e7030d568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393122, "uuid": "d08e9550-1ad7-4e23-a12a-639ade9f6f7d", "comment": "Malware payload (RedLineStealer)", "value": "c6e9acb930d5f47df4725afcc3276df0170a5fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393122, "uuid": "77d41c3a-e8ee-4aab-9aca-9e7b6973f692", "comment": "Malware payload (RedLineStealer)", "value": "b43a517d55a44dd4d9ec0fc599a43b981831083757b3a0188a46073edf1a838845f0ebd2286059ad3c6f7b047bddd84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393122, "uuid": "1a595f3f-01a4-48d7-9348-1e9c4794ca0b", "value": "T168549D117491C873D573053209A4D77E8A7EB9E10B615AEBA7940F7ECF702C09A31BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393122, "uuid": "e8458048-4a84-4030-9a32-71f60328bac5", "value": "1fdb483a64848e64a255e6c6ea658475", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393122, "uuid": "6315e4e3-0e47-4d29-acd8-a6e567918a5c", "value": "6144:IW27fNtImNVyVRWc3IF1I2/+rU9BleAOw/Lmrm:IlfjImNkKZ9Bwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393122, "uuid": "9bfc7078-cad9-41f8-8f27-b5ed2b07d2e5", "value": 287056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393122, "uuid": "9eab01c1-2bab-404c-9956-659d21dedb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393122, "uuid": "330b7926-7a8d-4479-8be8-a7216d703597", "value": "a93b37b36fc6c656a935a5d6e99b9b5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b841cf72-6b95-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697400128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400128, "uuid": "42a947d6-5e9c-4b3e-a1fb-220753a2cb8a", "comment": "Malware payload", "value": "75480631edd629ff1a30c16f5354a4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400128, "uuid": "ae619792-d2d9-48c1-9827-4de9356afcf6", "comment": "Malware payload", "value": "0b9df74c24249905637f0b3390d658a52dd45170dc2a9372ab624d1699381b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400128, "uuid": "5c1516b0-9e28-4e10-b4f3-a1af58c9a791", "comment": "Malware payload", "value": "10889588e9056e376690e79fd4cf7c42b94651c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400128, "uuid": "20f7b0a1-e771-4552-88ef-68b72a459c09", "comment": "Malware payload", "value": "3c93bafe7b149894a06c893f1d1a2531654d4e13e882d23cee604fc7aaf46fbcac46a98c366771103538701757b1f9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400128, "uuid": "6f59c377-6686-4d2b-9afd-3b8963ec38a9", "value": "T158252397EBEC4472E8E517B068F60AC30736BD900DB85727234AA51A0D736D0A97237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400128, "uuid": "9e97e4f2-037b-4ff8-ad89-ef37f06db096", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400128, "uuid": "3d6da408-5bb0-43da-a457-6657fd78a694", "value": "24576:DyV2A4hBsDIeBaBqfpjobZqXe3kQnR1hONxWS:WV2A4hBsDIgaBWjYse3kQ/hkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697400128, "uuid": "42175c59-8e62-4343-9c38-b730018da5fd", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697400128, "uuid": "4efc2941-6b2d-4216-95b4-fa9ff6f4ba93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400128, "uuid": "696fa722-5b06-4245-8ee5-b47a58857148", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91421e7-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367165, "uuid": "603367bc-4cee-401f-8f6c-b0261e07f4f2", "comment": "Malware payload (Mirai)", "value": "72d6b5a5e00032e477a4662bc7175128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367165, "uuid": "b5659f30-f6fc-4eea-b410-d1301bc6fcff", "comment": "Malware payload (Mirai)", "value": "0bad71aca7bc77cd4c9301c65b173d15d49dc582a81146ea7df97ae12da9421c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367165, "uuid": "4eb932ee-5587-401c-ae17-301d3ea47149", "comment": "Malware payload (Mirai)", "value": "21c052c451ccdf951b7de9da000a3f98eec18110", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367165, "uuid": "d1cc3589-ffc3-4aab-8a40-ec65f7b8c5dd", "comment": "Malware payload (Mirai)", "value": "1b10daea98ab643d00ef36012e27bc99a6932fc782825392a8306180185581740860aec6b10df3a31669a1c039fad87c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367165, "uuid": "b5fdac9f-64a6-4188-bfb4-d3d1b5768114", "value": "T11363AE38F1249D74C81105B47ADCDE7407537CD051A12CB2EEDC8AA958BBABDF188FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367165, "uuid": "95a7c7c3-d9bc-45c7-ad8d-bc5cbf59200e", "value": "1536:k5vP7W928EycisZGODv4X/h1UmTHqOSQ:k5n7W9283cisZNDiT3SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367165, "uuid": "5d405c32-c46a-45eb-bfc5-0858c53a59e2", "value": 70996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367165, "uuid": "f2340290-396f-44cf-956e-d1646bc8b5ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367165, "uuid": "f97cd4b4-872d-4555-a588-6cdb453057c7", "value": "72d6b5a5e00032e477a4662bc7175128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722c37b8-6b92-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697398721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398721, "uuid": "1286431e-9ed8-4135-a8c6-b8a9ba40356c", "comment": "Malware payload (njrat)", "value": "5625356013ce35f46dcdeef257cabbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398721, "uuid": "9f66cadd-9b77-45ed-b77f-875eb207531a", "comment": "Malware payload (njrat)", "value": "0f2bbbbb7057f520b8d3574b856fe7ffe58eb98752f559b3ce456f6c98f9e9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398721, "uuid": "2aa96558-0031-4fd3-96a9-db1db19a3e7f", "comment": "Malware payload (njrat)", "value": "48fa159d87d77eab274c82189109ad956af2ae96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398721, "uuid": "ff879b4a-3fb1-4f19-baea-e8901eebb772", "comment": "Malware payload (njrat)", "value": "2aa661837f9c0ad92159a32bcb3d963b3934fc9d658366c0f46dce394a2dc224e4c148a33d6b7ac279d924c885d9f439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398721, "uuid": "75417cb6-0307-41af-a836-d8e564b385f4", "value": "T1A0B5230122D45A02DB55B7FB1089BDAD53D676FB9566C11FAF0CBFA81F23B0809DA132", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398721, "uuid": "35f8b893-60ba-4e9f-a12b-b36611fa9210", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398721, "uuid": "7645eff3-46fb-4fe4-9b4c-d72e753b7740", "value": "49152:hXE2wKffMk7thyuZsV5O3Y5Q2PWm/7TD0NEh+PBqydQzXTLaikfMq:NE2bskWSwAV6WE+5qydyjLAfMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697398721, "uuid": "1b184194-1c7c-4f75-8e94-446c42c9493f", "value": 2407936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697398721, "uuid": "026ccc9e-6c1c-4162-8a8e-ca482134d847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398721, "uuid": "27f11ae7-9c47-4d06-9f10-fdc2632ca8ca", "value": "Storm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f806261-6b40-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697363498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363498, "uuid": "37fb249d-c531-4ed1-adc0-df8643494c22", "comment": "Malware payload (RedLineStealer)", "value": "d3fb7a5bd7457a58cac99d74a7b2aaf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363498, "uuid": "b3115b3d-83c3-408d-9470-afe073cb8fe6", "comment": "Malware payload (RedLineStealer)", "value": "101a5e5f26d1eb12148be6c74b122ff31d3673c022bff87cde6c268b6c2a95e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363498, "uuid": "159f9aae-4d43-49c3-a00a-a7536c334041", "comment": "Malware payload (RedLineStealer)", "value": "a554f9b3aaab083a23955f19cbfae2ba608de3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363498, "uuid": "9518c0fb-2e23-44fa-88e9-5ae0238dd30c", "comment": "Malware payload (RedLineStealer)", "value": "6e466838f55d8ffb288542385317bad22046b6d27180b9b1e40e71713187ec5654b5f7459b3fad716a6fb383ab00ec65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363498, "uuid": "99d027d8-61fe-4684-a0d5-f6e60ae286f1", "value": "T18E152305ABDC0173FDB2277069FB15930F31BCD0ADB8836627456D5E0C72694AA3672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363498, "uuid": "a96de246-f1bd-442e-867d-18f5eea85401", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363498, "uuid": "f52f0225-babf-4866-8de2-758b2c748da7", "value": "12288:mMrvy90po7FQh21jqav1cknadRothybD5qSRsakJhWOYe1m9pQbwaDg7rXw8hfrx:JyW+iutdwdRwstq1f/YYJgPXw8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697363498, "uuid": "9ebfb685-4cc9-42a2-af22-751321f6ba99", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697363498, "uuid": "c6c35664-0b52-4032-9e36-535681f0e9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363498, "uuid": "234acf56-81be-4367-9c8d-8a504c45e6fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658c6312-6b26-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697352315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352315, "uuid": "0048e4fe-91e7-4a95-899a-bfe6ca3d4182", "comment": "Malware payload (RedLineStealer)", "value": "3e01b8b3128dbaf07484fa35e3ac0980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352315, "uuid": "00832956-e573-4685-916a-dc7b6de6713c", "comment": "Malware payload (RedLineStealer)", "value": "10b41b67448a0b6d43561c2d48ac6e97dcf5904c89e96ff8d9a3eb4b4f2e0a2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352315, "uuid": "52daa993-0aec-4b3f-a657-10e4e1107eeb", "comment": "Malware payload (RedLineStealer)", "value": "1188372033a847ade898ebb83f4486b9c2c83e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352315, "uuid": "32e62b1f-b53b-47c7-bb55-cb6fdc712023", "comment": "Malware payload (RedLineStealer)", "value": "71d80568775e113f9d071dc65c2328ef5442692cf7efa55b042e070615607f595813adde66ece861da554004711adcc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352315, "uuid": "3dc75e04-8cef-4d18-beaa-e1ea6d303136", "value": "T1F7452353B7D85467E8B1A7715CF703830A363CA149F4EB2A2755A97D08B7B80E832357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352315, "uuid": "0189bb9b-0037-4a98-aa7f-e69651056bde", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352315, "uuid": "424265f9-1f06-493d-a338-b2478f27991e", "value": "24576:4y5iFIuK23iptf0ydyJblbktPVfZ4PmlMi9bmIH2aK:/gLK23iptfoJb1odfZ4PC0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697352315, "uuid": "564a0b1c-f98b-49c4-aa96-fbf8871600a6", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697352315, "uuid": "2bcb4490-11ab-466e-8cb4-3c745e3d5407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352315, "uuid": "063e8eb5-077f-4b67-958c-b3a20a19ffd4", "value": "3E01B8B3128DBAF07484FA35E3AC0980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bce8cb1-6b13-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697344165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344165, "uuid": "cc0db327-ac2c-4426-a6ae-6803cde357fd", "comment": "Malware payload (AgentTesla)", "value": "30c841a6ac5220486e391cb20cde2211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344165, "uuid": "02c15cdd-8937-42dd-86db-f84e1e150af5", "comment": "Malware payload (AgentTesla)", "value": "12772e06601fe7d3317b20284e5d0668ce41f51829c1527d8d042e735f9a7b80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344165, "uuid": "70fde2ac-bc72-46e4-9073-e2a25f68e90d", "comment": "Malware payload (AgentTesla)", "value": "16bfdfedc72ff4057f217f022b1cfc9801c5e75e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344165, "uuid": "c3942c0f-065b-4c96-9975-4f11c2538c51", "comment": "Malware payload (AgentTesla)", "value": "8e214ee9af039c07f56b4ab5f999854ac4093f2091eace8453c5b0c40412187093fc19c866fc3c3ff951a319fdea8c28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344165, "uuid": "360d70f7-1def-43e7-bb67-e88f5c12cbf6", "value": "T1D196E02229EB109DF3A3ABB25FC8F8FF896AE573191E70F5214107468722D45CD52B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344165, "uuid": "0ffff871-3219-4a89-b35c-1e955ea2f4b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344165, "uuid": "1a0f6361-d530-4f7a-a6be-597073fe5c27", "value": "3072:o2n8lTxrUzFUG6+FQjSApoL/px3pZ9eHttqo+giutF/s028t6iNBIFT96q:o2nrzuJpoL/2D/+R96q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697344165, "uuid": "76343ade-c96a-419d-8eb7-c3021476db67", "value": 9016896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697344165, "uuid": "5b945c95-3ef6-49da-867e-c24fe4a11746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344165, "uuid": "0aaafd07-1ace-4205-a57b-26bc14743cff", "value": "sexemulator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5bc5de-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697401259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401259, "uuid": "225b7591-00f2-4b8e-bf5d-66b786bd9fc6", "comment": "Malware payload", "value": "397440e70df239b58295087d5609c15d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401259, "uuid": "4895d655-3eba-4c35-9c17-d73984b7c325", "comment": "Malware payload", "value": "128bb07438a0e95fe46981f400eff92dff7a7da91286364260b7962b6b42e169", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401259, "uuid": "4270ac53-76c4-4e09-9127-f52729903839", "comment": "Malware payload", "value": "35a1941ab1773f794eae60944d8cd8399ac4abaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401259, "uuid": "09725d64-6b89-49e6-a6b0-82c850d6c2aa", "comment": "Malware payload", "value": "202d02139104efa051bd97735f267f39b26a7e2a8b25167adfbba8427b2b79c0450dd0266d00d34a9e926b9ad80a5fb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401259, "uuid": "3af17b87-b857-40e6-8bd4-70c3aabcbcb0", "value": "T107332AD6B4019D7CF90FEABA8413490DB671A74112830B3667ABFDD3AD332996D13D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401259, "uuid": "0d019901-7724-447a-ad58-9b3f14272801", "value": "768:qTeJ1GhkcQO0FTPtsR8Ezj/+86YAHgI3D2e5tCC3qHwoQkGi:yQ1DTjTPtsR3r+8tAAeD2e5sCanKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401259, "uuid": "0f39a033-c2d1-46e7-a830-bc99c45c0596", "value": 52416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401259, "uuid": "36e56aa5-fd68-461d-ac9e-187afbd38b7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401259, "uuid": "2f651ae8-a50f-4159-a21f-5ed449dd9771", "value": "397440e70df239b58295087d5609c15d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5d0f4a-6b1a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697347142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347142, "uuid": "c146ea5f-70de-40fd-9e38-eb1f9fa95f29", "comment": "Malware payload (RedLineStealer)", "value": "08a384dc109c81c32c7eb7afe08664a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347142, "uuid": "b528387d-d292-401e-b6bd-6cd797a06057", "comment": "Malware payload (RedLineStealer)", "value": "1646b6d7c774d1e0dff2074733df10b97733cb3e0be6c3e5bcc667e866a2783c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347142, "uuid": "3f4111fe-7198-4f7e-86ff-365481b5c41e", "comment": "Malware payload (RedLineStealer)", "value": "764551a5dc39961fcf42e67d1a22334d9e50830b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347142, "uuid": "c5b18f74-6bf0-43f4-902c-defa414f653a", "comment": "Malware payload (RedLineStealer)", "value": "cefe4b779fba5c14f36d4680caae102a6a4c47baf79f946b90022bf1b5fd3d6af02e7328adc3ffa3d34ae276c815c87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347142, "uuid": "900438d4-8d55-4039-9b68-8b13f13f78d5", "value": "T177151291EBD55872CCB167F054F902C306393D9598B4872B27899E4B0DB2AD4BE3272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347142, "uuid": "13457d54-8b86-471c-8c87-8b0832bcbcc6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347142, "uuid": "ed89631b-6607-408d-8154-656200e9654a", "value": "12288:pMrby90x1IqXNSjw9cxUvI7klpZkoAI3mAZzaflRVQZEPOKHX:ayvCNSDxUFlzkoN7ef/SyPJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697347142, "uuid": "c1659f7f-19f1-4d50-91f7-ca3caaf1af5b", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697347142, "uuid": "5a163f24-93a6-429b-bc05-c27382482e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347142, "uuid": "2c2085f4-d27d-4d8d-ae01-2c64f20cf104", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1187006e-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409726, "uuid": "2d53c00c-5920-456f-ba23-7fbb7868e082", "comment": "Malware payload (Mirai)", "value": "e63e85445429b97f77ae663d2a60bc7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409726, "uuid": "ff14053f-9a28-4113-bd25-9f5275a6144c", "comment": "Malware payload (Mirai)", "value": "167efe997b40c9a89975982a16d8e1a3b582733eca165edeeba6a2d39ffadd78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409726, "uuid": "345ae5dd-b674-4dd6-b732-9dc1a59ca6da", "comment": "Malware payload (Mirai)", "value": "f82b74ca345efd83091166229a56dc428f36cb87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409726, "uuid": "d444ee61-8549-46db-8906-74707bd4404d", "comment": "Malware payload (Mirai)", "value": "9c0f6a03a181681ca4031805239f03bba51cd089361544f3077b5c241907f23611682ffbb663b5633b96bc3da977da8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409726, "uuid": "8114a032-c4b5-4b9c-bcac-ea87f4c69553", "value": "T1D8A2D1217F1DE98FCC37B23886D6E9C6A2D07D24D3DCC9465781C15BABA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409726, "uuid": "7133f2de-19d5-4ed4-ac7e-3c1b92b32b17", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRtLnSyI:O98o08kxofBE+ZkXaT47C2EpitLtI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409726, "uuid": "0c6492ab-aff4-44fb-8414-24ee56454633", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409726, "uuid": "86d63429-11f8-4cf1-9e78-51d614501094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409726, "uuid": "2610831b-ef5c-4730-97b3-35a4d7db0c47", "value": "e63e85445429b97f77ae663d2a60bc7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f23383d-6b60-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1697377215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377215, "uuid": "818de754-c942-45e6-9700-0d55cb0d54d9", "comment": "Malware payload (AsyncRAT)", "value": "b0a15495ec02ccb10176ab73e7ced919", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377215, "uuid": "7317722f-b1f7-4371-b706-890a96eb2f4f", "comment": "Malware payload (AsyncRAT)", "value": "18ebda8387135efa43426a671e53c0c1e6bd9f0d90bffdeb753d35a19397631e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377215, "uuid": "7979b831-2f23-4931-9fc1-84352e9494dd", "comment": "Malware payload (AsyncRAT)", "value": "ace88cdc224ccdfda1a846e5aa46ba61ffbc646d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377215, "uuid": "5d20ebb9-bc3d-4db4-9874-ee34fd8dfff6", "comment": "Malware payload (AsyncRAT)", "value": "53dde07302e62b29481501ce0f22cd71ff63518fd752a447fd910f7b5371478f8ee08c8e268ac921aa9d3a8250a85ef4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377215, "uuid": "2c8de429-add2-42fa-a4b2-649482f9f2e6", "value": "T1546307053BE9812AF3BF8F7469F6628446F5F46B2D12C95D1CC501CA0662B829942FBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377215, "uuid": "61d3b6e1-a41c-40f1-8620-84f1d3492af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377215, "uuid": "50c991cb-1bef-4019-b163-0c537d8d68e7", "value": "1536:emfuSa/dSkDVMKuJUYFXp6fyATbcNcQP0NzrPlTG+x:emGSa/dSkOKuJUYFXYfyubcNlKdVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697377215, "uuid": "4b466cbe-d48e-4d38-b073-d08ac7570b55", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697377215, "uuid": "7aa8d541-310f-4054-9490-0af1bd6a98f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377215, "uuid": "c078e1b1-264d-45bb-89c4-40b2e0ff4996", "value": "b0a15495ec02ccb10176ab73e7ced919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8f5d1b-6b1e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697348833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697348833, "uuid": "cfe2ab9d-bfff-4602-b666-bc5bc42b7868", "comment": "Malware payload (RedLineStealer)", "value": "b1d76d2582af0d87956397a4dcde404c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697348833, "uuid": "1003030c-84ce-44f4-909b-5c3fd814bc16", "comment": "Malware payload (RedLineStealer)", "value": "19841d4bf762605703c70a3e69104f9302c9ef30268baec518e4d09c943d98b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697348833, "uuid": "51e4ece4-4767-4210-be5b-9510a745a60c", "comment": "Malware payload (RedLineStealer)", "value": "04a4259c6121d20cd64391e56aafdcfe6932c8a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697348833, "uuid": "1dd2fef7-e61c-470a-a187-46dc8e3daf18", "comment": "Malware payload (RedLineStealer)", "value": "9de0ebbc9b0b927fff612b8d950cb9c3e475bdc2012e3e5f5dc9cd6cb4a1e52a75d9b39eb221c9090a343fa47ca310f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697348833, "uuid": "09eb169e-62ad-4945-91c2-3064e0b16638", "value": "T15E152343BBD84035D9B5AB3159FA01831B35BC968C6CE79F7356FD8A1CA1680643A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697348833, "uuid": "f816ad7d-505c-4b27-b530-c039652b784d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697348833, "uuid": "2e9cd7c7-ed9f-4d2f-90d5-16f140fe9adc", "value": "24576:Hyy+etF1Zhqkmyve0KWsxlCopsVbdYxYPn:Sy+gZ3mym06fCo69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697348833, "uuid": "22a8ccf2-d692-4981-83a1-35a9f7f0ba88", "value": 896512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697348833, "uuid": "8639bc1e-efa7-4cec-986a-9297915cff16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697348833, "uuid": "da09a71f-2b24-40b9-9d85-0c15569957c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3e2008-6b82-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697391922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391922, "uuid": "d5e35c7a-de8e-41ea-b2a9-a725151e40ea", "comment": "Malware payload (Amadey)", "value": "a881e7bfcb4f6fb9589aa4d8e6292e78", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391922, "uuid": "f780e16d-521b-4dcc-b5ad-6f1a6225a5f2", "comment": "Malware payload (Amadey)", "value": "1be606b9c4aa9a251746b7f606e87411b03369b76d62123063bbad2d0a1e7bfa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391922, "uuid": "72381ee5-2b9c-4c8b-b50e-3b249a3aea8c", "comment": "Malware payload (Amadey)", "value": "e5927579c12593281d3ecd9e7f3f25d7b599ec27", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391922, "uuid": "887daaec-9798-4615-9878-cf7af972bdf0", "comment": "Malware payload (Amadey)", "value": "d332c04b5beb4087e30c365b367823f79d1e0e344572ca9ffea3783078cae8f7cf45fffd9b5ad0515bd89c1f91177ec6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391922, "uuid": "fc5f1fa3-4782-4591-9840-abdd0a311ce6", "value": "T13644AE0075D1C473D473053209E4DBB69E7EB9610B7189EF6BA40F7E4F702C19A3AAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391922, "uuid": "79c8eeeb-a944-4c44-8313-08ad026bfdb7", "value": "cde9adcbea0243fbc6ee703199b5c401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391922, "uuid": "9f95845f-fe75-4094-96ce-39d1f3cc5071", "value": "3072:YJG+imz7uospGahWcy23rT1YCj2AFnKFCWWCMLfCpBJqs6uRtNeAg0Fuj1neEAmf:wNtK3RlYo26KFCW8m3JqxAOpeEAmVzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697391922, "uuid": "ccae3eb2-fc0a-491a-8200-5ab77be80e75", "value": 276816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697391922, "uuid": "6b220030-1610-4381-9ec7-9e1f7e5346aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391922, "uuid": "5ff7b987-d806-48b7-af63-483c2811104a", "value": "A881E7BFCB4F6FB9589AA4D8E6292E78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef065b39-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697377027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377027, "uuid": "ef266f41-a6a9-485a-8533-cc625c0cdfde", "comment": "Malware payload", "value": "7ffc2c115b41e58123ddaaf5f05cf593", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377027, "uuid": "48df080f-54bd-4e1e-8e13-5ac652170d36", "comment": "Malware payload", "value": "1c45b930ab2c7dda5bfd4a4583005b363b9e121751ff0ab3cbc4f18df0388a6e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377027, "uuid": "8aab7fa3-3a7e-42bc-a183-4dd1c46261d8", "comment": "Malware payload", "value": "927b41483de9cff57772c174df35a0b137702e72", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377027, "uuid": "627145e1-2da3-4a19-b12a-72d5d83bd7e5", "comment": "Malware payload", "value": "5e79a507e03e17922f2db043cd142deeaa78d97f449e70c3762d38f660c77c89c087817c246162f23e4ac4027e65e078", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377027, "uuid": "6a8fe24f-9801-4d61-bcd5-3b182869e8ef", "value": "T1933159C2C877081886B397A956FB04C6565D3C425C10DDE5FA8E78950F51EE12EF0B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377027, "uuid": "e2211319-1d33-48a8-afab-b41de804eb65", "value": "24:B0w8+FjnoQWtxC/7o++r/lEy6hhBBiwY4iJYoR4EaWwHcJ:29+doTxC1+r9Ey6hhu+iJYoR4EPwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697377027, "uuid": "21cf2312-aa58-4451-8060-340085ff30fd", "value": 1528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697377027, "uuid": "19eb706b-6da5-42d3-aace-82461362c757", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377027, "uuid": "10a4d603-6d91-4720-96c4-0efab73e387f", "value": "7ffc2c115b41e58123ddaaf5f05cf593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad439295-6b81-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697391519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391519, "uuid": "e688ce01-533a-47e5-a6a8-d7b052a01414", "comment": "Malware payload (Mirai)", "value": "fcfc61f01919517ab4c713465ca444ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391519, "uuid": "fa1ab7f3-2292-4ba2-b31d-c1f92bdb51df", "comment": "Malware payload (Mirai)", "value": "1e312fed931f0ff83527e2dc6f0afd4a909b7264faf2ab71e6ed03d7efb5a785", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391519, "uuid": "f7cf7142-cac9-4fa7-97ca-9a82e72398f1", "comment": "Malware payload (Mirai)", "value": "5b02ff14bf6f39f0172c832fd9be495e626e1405", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391519, "uuid": "0dfac712-b5b4-4b3f-a9d9-dfabf5ed5d41", "comment": "Malware payload (Mirai)", "value": "28192348b9e32afd1cbfee60dd3b177dcf1009343507c1a7d06727fe103bc45e260eecad31e4e02bb21f942de043d288", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391519, "uuid": "175e2086-06f2-4aaa-8c0e-26eb0d84c1f7", "value": "T108235BC49643EAF4EC11097520B7FB329B37F47B5169FA87D368A532AC41B11A20B2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391519, "uuid": "8b37a217-38b4-444f-8ea2-89a3b8f5bcaa", "value": "768:q8/sjSNWYGBs82WECbFR5QkN/eZj+EYLEX6qRg+5dH:q8/sjSNWYGBz3EcJesH86Yh5dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697391519, "uuid": "bc0b47a5-9d44-4f2c-aad6-bac651b4b0c7", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697391519, "uuid": "c37d299a-d5b0-409d-b8ef-e673427e3b2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391519, "uuid": "11cf0496-410b-4065-a004-fea72a198d46", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091195bc-6b94-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697399404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399404, "uuid": "ad8bf1b4-d732-431f-b64f-3e0c03df9d06", "comment": "Malware payload", "value": "a3a36d6ed4b0956dd1a3d0ff2283f5fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399404, "uuid": "c81af0b9-3b74-4952-8e56-873ecca20ab2", "comment": "Malware payload", "value": "1e3e7c8e272953e94de9591a4b61004e518135d47b4bf80229d27ba0060d8d0a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399404, "uuid": "268e400e-d0e2-4bd1-9469-6acdf525006e", "comment": "Malware payload", "value": "4d5e3cb5b01996e4da21b1714d940029ea17aaef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399404, "uuid": "f4c1ceae-c7bd-4708-8be8-5e56dff0ca50", "comment": "Malware payload", "value": "95f0e70235bc322633faf7044024896850360dae449fa95a4f1fa41e5ee7e8622f8372eccf3017b6347e6bd5ade63b30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399404, "uuid": "624a2946-751d-4f11-adf9-e606fdb0c646", "value": "T1E8C32B46EB418A13C0D61779B6EF42453322EB65A3DB730695287FF43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399404, "uuid": "10c4c642-58bf-4f55-b123-211bea50c829", "value": "3072:g+NI2/blIGmsfJUIifn1dRBGbbJM/9OQQXKP:zNIIbaGmsfJU7fzfGb9M/9OQkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697399404, "uuid": "cfd77127-88f7-4f34-b8da-7ca1ac8bdf9d", "value": 128708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697399404, "uuid": "59c9913f-30ce-4f4b-b6de-6d1ccdeb1dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399404, "uuid": "ad12a612-ee9c-4fca-b265-f97f5eacdcdd", "value": "shindearm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55710afc-6b83-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697392231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392231, "uuid": "56dc2208-4753-4c5d-8ce1-5797aea538fe", "comment": "Malware payload (RedLineStealer)", "value": "a9efb71a209120a8e623f58160ea0fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392231, "uuid": "eb40f3d1-8ea9-4ac2-9775-5bdf2b2a9a6c", "comment": "Malware payload (RedLineStealer)", "value": "1f7274b1da7f1fb048cffa3e761cc4acc7cffc4d66ba82d1bfd603549b815a5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392231, "uuid": "280d6e30-98dd-492f-9ce9-d47f068c6735", "comment": "Malware payload (RedLineStealer)", "value": "beb2e6d3a0d8c616960befb37681238294d023bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392231, "uuid": "5480e955-3dc4-492c-8d49-e9288c6cbeb8", "comment": "Malware payload (RedLineStealer)", "value": "9e16bf524e804eca65ea218a8a961ae52435f267c9078778c85bca637faa32ceb067dc48e7b93d51b0eb3aaefc52719a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392231, "uuid": "e8bb77e9-110f-4190-a850-10611d4d68b2", "value": "T13D644AE5A5874D9EFE3BA171C1FED4EE41D4ACBE8E5C0A861A8C54BEC884172F70414E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392231, "uuid": "4ef722c2-a325-40e1-9406-ac574c4fc01a", "value": "fec5e3ac8231eb123a87c533e215da11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392231, "uuid": "fc6c17c1-bb68-428a-9e25-6d458c280f57", "value": "3072:2SA667sQ+P/7/jy8zLfnbfOLRCS6fCN6sXC0Cg+26Xu9rLuxeePDj9jIux:2ST6mnJz3f2CS6fq6KCuzUmeND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697392231, "uuid": "a76d4036-2640-4ba2-b637-4b03c0ed6715", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697392231, "uuid": "a2b47108-9555-4a86-8285-dea8e0407a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392231, "uuid": "142176e5-a783-4d33-8a65-468648d5a116", "value": "a9efb71a209120a8e623f58160ea0fbb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e62c8a-6b99-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697401821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401821, "uuid": "87694d16-d02e-4c6e-a9fb-ae605f4ce458", "comment": "Malware payload (RedLineStealer)", "value": "5226e76873a9bb5a3a25a57dc50b6a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401821, "uuid": "bd83e53e-486e-4262-b04d-0257acffc614", "comment": "Malware payload (RedLineStealer)", "value": "1f729bf9676900b33265168e69accb412b83a0ee6bc524e392c0c5596d6b02a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401821, "uuid": "5dbf7248-4865-4a18-a1ea-902b11ec930a", "comment": "Malware payload (RedLineStealer)", "value": "15914db153c3432e13395c4a6455938f9d447a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401821, "uuid": "2df25a64-01ad-4511-be24-69c78bd241a5", "comment": "Malware payload (RedLineStealer)", "value": "6b84c797f96b4cef550ce5e55f80b4be23ba0472580efe05e9ad6eacd747fe068eafc1699ff14af33d426e7dfef6825b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401821, "uuid": "e75f6a91-f10b-4751-baed-2005b9c11862", "value": "T1C1E3AE01B6C1C472E53219350930DAB19E7EFC300F54AFAF639B367E5E642C19929DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401821, "uuid": "cc137dca-c1a7-435c-96ba-46ba559d89b4", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401821, "uuid": "e71122c9-b97c-40d1-9d9a-c48af4118cf8", "value": "3072:pM5hnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQRd2nVuWiWZ8o/7cF6nI8TJn:shZEe3bpi5aaYH8C8q7OQI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401821, "uuid": "c1512a8f-593f-4300-accb-8e1a0703175d", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401821, "uuid": "8e405568-cab3-4ee1-9b8e-fab00a44a10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401821, "uuid": "863a847a-db4d-4ec7-a2ae-b97b9223fe60", "value": "5226e76873a9bb5a3a25a57dc50b6a44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506c91db-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697401242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401242, "uuid": "1403670a-5481-45d1-adf3-5a7801b5ef45", "comment": "Malware payload (Amadey)", "value": "5f8fed8ed4d54bad01996a24518ac017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401242, "uuid": "a6602996-5e11-4bf1-9139-2a92c44ff059", "comment": "Malware payload (Amadey)", "value": "1feff228dfb2f6fbf82a98dd6ed4bef9902bf1e6fe6c207bc0647e475eb540b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401242, "uuid": "b47b80b0-59d1-4733-b29a-270132810d85", "comment": "Malware payload (Amadey)", "value": "8bae22ddabade96489ebb34770746f2689ae4b96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401242, "uuid": "5e73c1d6-b79c-4963-b90f-24859bb6e00c", "comment": "Malware payload (Amadey)", "value": "014d1e490bb7b3d1e5637bde0068b11d78fc90341e1e8788e3584b62839802e439847e956d3f5a2fe7f0f46b08387bb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401242, "uuid": "5e9b4fb3-0648-48bf-9ecd-8b1039400c19", "value": "T142452395B2E8446AC87617315CF357A3173AFCA04A38D72F3741B68A0CB278499763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401242, "uuid": "051146a9-ecae-4d37-a6d0-a5dc03e47289", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401242, "uuid": "3a2982af-f4b5-43ac-a31f-c6059c3e5836", "value": "24576:HyrlV7kTMzMcseMjC2mEAhWYJFfEKLsg1RyHTeKKxj3:Srl9kTtcseMjLHV6fEMsg10yKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401242, "uuid": "1249ed32-0ef5-4b0d-ac0d-a2509bd50596", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401242, "uuid": "47c34846-76e1-4f07-8915-39a78c0cb4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401242, "uuid": "d71b8c79-d641-4512-b473-ee70f0a0fe02", "value": "5f8fed8ed4d54bad01996a24518ac017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c501f1b7-6b7b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697388982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388982, "uuid": "9b2ca9f2-f358-457c-b233-513278aa16f6", "comment": "Malware payload (RedLineStealer)", "value": "c613b8d63a574701c825bf2e04f80475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388982, "uuid": "3f877267-59bd-4b6e-a6d0-be7893fdd05d", "comment": "Malware payload (RedLineStealer)", "value": "20b694707587f5ef4af631f01bf80fd80bef323cb1907ae4a0fedc3828026d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388982, "uuid": "71ae79b0-5e12-4c88-992e-d9330bab1aaa", "comment": "Malware payload (RedLineStealer)", "value": "2bb55534e7768e73e328c5261f6e7bb314c2dd8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388982, "uuid": "c5ff0fc5-88fd-435e-8a1d-c25fa334d4b0", "comment": "Malware payload (RedLineStealer)", "value": "b43123efaaed34f71f5e64b55f682e007403ec62cb30877140530c51f507d8c258f19e96f35fb916eb555ed1bf43e41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388982, "uuid": "4b457aaa-4bb2-499c-91b8-81f00231c0b8", "value": "T185152302B6D95532E9B963B099F34AD30F357CE09EB8C26E37464E0D4CB2684F535326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388982, "uuid": "d06634eb-b5d3-4bdb-92d5-1523906ef338", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388982, "uuid": "733193bf-30c0-4895-8651-a4be6a0f87a2", "value": "24576:MyezeIFICZHm7NAiQko230vTs6MXa9S9POYOr:74jFdZqNR4S0vca0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697388982, "uuid": "3f436f44-ddb9-4d65-817b-640fba3d6660", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697388982, "uuid": "4718a964-941b-484d-9e22-308956f35582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388982, "uuid": "1e681eb3-d743-43c3-9e36-f01fbf52404f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c620887-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697366848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366848, "uuid": "42988f3c-fabd-4bae-9cea-caca49f8d3a2", "comment": "Malware payload (RedLineStealer)", "value": "f3162ceca07b1cdb4b0ad5b617837984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366848, "uuid": "0c17ddbc-4e5f-45c1-8e66-8e8e46c054ef", "comment": "Malware payload (RedLineStealer)", "value": "2271bf80772214c3c9b8d0a3dd7b5fc40bc08b69e649c444fc82a035505a2d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366848, "uuid": "15fd486f-c163-410f-861d-c646f86ffb37", "comment": "Malware payload (RedLineStealer)", "value": "53d02441021e11731c4d7cea0d3910f4e9d37e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366848, "uuid": "f44f0684-229c-4f9f-aef4-16f8c7380aab", "comment": "Malware payload (RedLineStealer)", "value": "84279fbb8919bc851792f61128734794639d940a5bfcbcd272b72512375a395057ebe34bd983d640edfd0101a8442fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366848, "uuid": "8fbd53a2-7dbe-4bfd-acb5-f75bc0132093", "value": "T1E2152243A7E844A3ECF5677158FA538B27323C53ADB4C32B27499C6B1832A48A571377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366848, "uuid": "ecb7a9fd-95fc-4580-92dc-729f1e9bc1af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366848, "uuid": "29c53aab-4237-4a00-97f2-84e2fd10d2d5", "value": "12288:SMryy90Rxid7K29KBpS0yle8Tg/3Gmm+It1jplNhUo5eKSd1g/Pj7GSq:YyOQEpLIQ3GmYjp3hUo0/g/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697366848, "uuid": "f23dcfae-5340-4d2e-aa47-389ca3fb4668", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697366848, "uuid": "0cce6508-2313-45c8-be70-907787cd3a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366848, "uuid": "d0ddfdd5-1e17-4f24-9a9e-877cfe35da15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee075e79-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697377025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377025, "uuid": "4477ae7d-7d44-4b1a-8002-0de32b68f034", "comment": "Malware payload (RedLineStealer)", "value": "e41f341e03b4e44aee594b4624005f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377025, "uuid": "3172027b-f6eb-4b2f-8626-53453ac9fdd3", "comment": "Malware payload (RedLineStealer)", "value": "22c6f82bfa80963a217e9b27f993fd1e45c5e18eea1bf61d755f9a270d50bef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377025, "uuid": "9be67020-b764-4f7e-93e9-8f759662a8aa", "comment": "Malware payload (RedLineStealer)", "value": "3a056c94a9d3c41b5f97736bc2edf6ecf3ede7cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377025, "uuid": "b700234d-0062-49ec-b998-734f52ab86d7", "comment": "Malware payload (RedLineStealer)", "value": "69745ca0754313437fc921541839ad50cae9664d9a9ad1f796fa1ffb0ddb6e051f13a4fa6e6c529336ec460d64fba57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377025, "uuid": "bed69b17-9dfc-4413-af7c-f1ea666d321c", "value": "T1FC152343E3DC8832D9721B706DFE07CB0E357C21AC7843266B594AAE4D72295693672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377025, "uuid": "b89e4bc6-f80e-4627-be3b-70b71edf7793", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377025, "uuid": "c93dcd50-2cf9-450e-a8c0-c6538d9b9221", "value": "12288:SMray90F7owNTLTD2rb/1fbzZCmIBI3uaouLqOhWtm9hb3aK2ngqaLwFDsGgdAe:4yyTNT6r9bkBI3XoHOhvtaK2nnIUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697377025, "uuid": "16575340-3538-4eb5-b535-969d5f0209e9", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697377025, "uuid": "754dd795-e391-4a62-b7f4-0f10ba63024a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377025, "uuid": "6e3ed540-277d-4175-89f9-735dff21cf4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a0063d-6b7f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697390399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390399, "uuid": "1b4e410c-6cf8-44b0-94ce-18874960b795", "comment": "Malware payload (RedLineStealer)", "value": "28e6d3f39458ede4e84afb4f646dabf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390399, "uuid": "6c235a33-e795-41c5-9171-6b5271e4b25c", "comment": "Malware payload (RedLineStealer)", "value": "258bf939271da86546ed1e7fec703c63806dadff8d46a88879c50ce9598d1abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390399, "uuid": "2b6d60ea-3836-448f-999f-85928a6ba280", "comment": "Malware payload (RedLineStealer)", "value": "bf13cf7cf81eb81c61e3166b6f3b0ac627c471b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390399, "uuid": "23f7c3f9-08fc-4e25-a5b9-c3a47df95adf", "comment": "Malware payload (RedLineStealer)", "value": "a3fa8f2b21c93011ce5ede9a4b0478589206ab9169d9ad1c7c14aa66d1e9306a0db6b5c9768d318bbf96f9fe9fee6fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390399, "uuid": "b5b424d1-2c4c-44ce-8e6f-b4ba970b4f44", "value": "T123152252EBEE4133D8B457B024FA06C30F357D619DA4439A17E5A19E18F36D0A93A32E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390399, "uuid": "3a0f8967-eb3d-475e-8a46-e6635d75baa0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390399, "uuid": "839a8191-b785-4417-a03c-d1313ebec178", "value": "24576:xyCJZIuigGFkDvNT59gGIMr9nKw6wB6t4L:kELi/kR5WAKwnAt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697390399, "uuid": "c3501ad2-a9db-4d59-bde3-46a7474a3cb9", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697390399, "uuid": "651d0c63-ae1d-4a4b-8008-436b85001e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390399, "uuid": "0f2cdb8d-520f-443c-aece-e0ce79c78cc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21193ad2-6ba2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697405457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405457, "uuid": "7e2c1ae3-c120-47c7-beff-c27298766cb7", "comment": "Malware payload (RedLineStealer)", "value": "861926aa51496d99323f6a3ff8079fec", "object_relation": "md5", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405457, "uuid": "6bb29c49-46eb-4d65-bd8d-f869ac953db6", "comment": "Malware payload (RedLineStealer)", "value": "28bbbf76890fa69397b827328ce1e275b3b1c430560fc2ba15e29ba6329b3a11", "object_relation": "sha256", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405457, "uuid": "3af20a6c-34b3-4b4a-ba4f-e762f70d6dbb", "comment": "Malware payload (RedLineStealer)", "value": "ec22ef2d673c36ba95691d04221b2cee2ec7165f", "object_relation": "sha1", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405457, "uuid": "001a528a-e817-437e-a9cc-192ae2526655", "comment": "Malware payload (RedLineStealer)", "value": "4c69a1429a4e26b69e2a33d50163bcd99cf1f0b589d7efd580258d01047e36890adcf22a36b41e06695209ebe89c50f6", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405457, "uuid": "3cb494a8-7bc7-49ad-98e0-ff499f5a8f92", "value": "T15B860133F0DA2471F8731A36B8A25432393E489CE0862DA929B46BD7F572D4D4F4B791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405457, "uuid": "e320302a-fb76-473d-8b67-6665f0d19e67", "value": "6011984d7c1f1b97a34d7517a498bff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405457, "uuid": "0b5acc6a-becd-4128-9926-f3be418b5883", "value": "98304:Zg7msAw23oMK1D724XlngFd8eTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64Q:i7+dSvflngNTVHJack+YlGlSRRbCvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697405457, "uuid": "b28ea32b-e3dc-4835-a898-64ec56fc07d8", "value": 8527440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697405457, "uuid": "b19758b4-3370-4974-a2f7-bb939dec8034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405457, "uuid": "af400bd9-c402-4d22-8830-282e05036775", "value": "LauncherChromium.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa66ae6-6b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697368215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368215, "uuid": "9d07d98f-c55b-4ae4-94ab-cf1cc87fbca9", "comment": "Malware payload (RedLineStealer)", "value": "ef8e76b9dece4df7a361f64677182252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368215, "uuid": "9f98ab1b-00ac-409f-8fba-9642f83b56f7", "comment": "Malware payload (RedLineStealer)", "value": "29ed7a204c3fe03395215a72fedc232afa55758d49105b6b3aae6e3853270512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368215, "uuid": "61e00ef3-12d8-4f44-9045-4999e87f3be4", "comment": "Malware payload (RedLineStealer)", "value": "1c5d0e64c5132ba201092fa8527119a4593a24d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368215, "uuid": "1a680a75-9661-429f-a64a-ccf1bb5370da", "comment": "Malware payload (RedLineStealer)", "value": "d8ea428a98276bba81e12c33e1cdac43208365b8c3e51b82b2698a85df946f50922b8b43c5e150eb7e2afc7ff0b8189a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368215, "uuid": "14a8b2ad-77cc-40f4-9845-67c51a331f4b", "value": "T167E3AE1E75C1C4B1D97369350970EBA19E7DF8700F506E9F23980A7A1FB02C1993AE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368215, "uuid": "c3a5ebfc-6180-4d6a-879d-914ba3a685ee", "value": "c7c9eb7dc16fdf30c39a296c30ab2134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368215, "uuid": "ec607b2f-6cce-489b-bfc8-b9cfe5f3dbe3", "value": "3072:Ys23z98m/NtBuu3P7gKOhiqvleDT2xns0yjzYQRK29By/HmcbTXl4TJn:0d/gu3PkiaRnyYk9aTXl4TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697368215, "uuid": "27ce3b87-722c-4541-b121-acc0e9088a0a", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697368215, "uuid": "2944b244-3cba-455c-a5b7-39250a683e31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368215, "uuid": "40e08709-454f-4a0f-9c6f-109c0ee9707a", "value": "ef8e76b9dece4df7a361f64677182252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c57a6f2-6b81-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697391276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391276, "uuid": "01ebfb77-d44c-4977-b6b3-75854500fe36", "comment": "Malware payload (RedLineStealer)", "value": "4989c672297bab6e998388ef3f1915e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391276, "uuid": "a725b9b9-cc8e-4a2c-bc21-b113fbeafe06", "comment": "Malware payload (RedLineStealer)", "value": "2aa42adbd94bfd8ee4f10e7a52641505477663baecaf1204add40460af3d9e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391276, "uuid": "f2b7010b-194f-4906-a104-bdf42ad63734", "comment": "Malware payload (RedLineStealer)", "value": "9ab0bee8c4a371eebbff9d18b4a896eff735377c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391276, "uuid": "df819268-203b-4054-bc2b-119d556096d8", "comment": "Malware payload (RedLineStealer)", "value": "f25895168c090f56737886a126e8270e035b1b885a2682d888d78bde4ccab586f2eccc42f038994363a7b14fb06d9f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391276, "uuid": "620c437d-8131-4da7-b5b8-b50a2aba7501", "value": "T1FF152303FAD86172D9B42B702DFA07C329757CA29834837B3355599E0DB26D8693237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391276, "uuid": "7f3bc2e2-61a5-4ca0-b08a-e55da54b204f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391276, "uuid": "4abe5d9b-e1fb-423f-9a47-c8bec3bf99ee", "value": "24576:MyrpCojhhg65Id64nI6mlK7vPerGd2wDSWpcT:7Mkg6Od6Vl8neuZm2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697391276, "uuid": "640f2558-1821-4cbd-881a-0920cedac5a2", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697391276, "uuid": "a5a3b82d-43fe-4ce3-9dcf-4f5b2a4ca6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391276, "uuid": "b1d8715b-3770-4670-8be6-95f24e672ade", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0fe82c4-6b13-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697344361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344361, "uuid": "954907f0-9e74-48dd-be9d-c96acb04ace0", "comment": "Malware payload (RedLineStealer)", "value": "2b44073a207517f11a30aba2cb9b2305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344361, "uuid": "a2fd56ac-fa45-4aba-b86f-2df6466df717", "comment": "Malware payload (RedLineStealer)", "value": "2d1c13712be921c45b049203b4639e13e9f79b409d0bc84105f245c34276fe32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344361, "uuid": "ce0c3945-341d-4895-8b3f-4366b442c987", "comment": "Malware payload (RedLineStealer)", "value": "46396caf7433e9a7b13ba65d8c74590f2a339c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344361, "uuid": "1d1853b1-734f-4406-9900-7f5e5bea9ffb", "comment": "Malware payload (RedLineStealer)", "value": "5481bb85d025fc2ab930b99abf54ca00872f568c29c1e608f8c86da1b5ae228232c3264cfa174e911ad307e5ffbf2476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344361, "uuid": "256fcc2c-1632-4dd6-b5e2-0e21f353c146", "value": "T1B4152286FFE94062F87827B4A4F713D30B36BCB259B4135B1B94684A15336C4A57372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344361, "uuid": "ec7d1958-25aa-4ca8-8c7a-0699a2cc724d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344361, "uuid": "ab4c2473-0482-4b0d-adc0-0fb0408188d6", "value": "24576:tyKddAweZAwnIfSK+oKFU64kV/wlbMXZ:IvAwI67RFWqMbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697344361, "uuid": "68f924a3-3325-42b5-a4db-7e3f6527f198", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697344361, "uuid": "90ec1bc5-f0d4-4f19-bd03-7ce17383dcae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344361, "uuid": "88c4fc8b-6cf5-4727-904a-d2bd1d42c057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4344804-6b03-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1697337387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697337387, "uuid": "6cbac9f1-1295-4dbc-9c5f-28d51631b50b", "comment": "Malware payload (Vidar)", "value": "128833df1ad9ba0fff0b6dec6005763c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697337387, "uuid": "50fdac7b-8402-4d74-9f30-2c2d4cb4a07b", "comment": "Malware payload (Vidar)", "value": "2d22cc60481e1f25e5bf703cf6d8bd1d4c386036e595e6ada518eea110036332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697337387, "uuid": "30828b60-563e-4802-bb0a-458f19fb7e06", "comment": "Malware payload (Vidar)", "value": "608737e7b26ff4928a59be900c61972842dbcdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697337387, "uuid": "15b8374e-a1ae-4b1e-8bb3-7d0f719296bb", "comment": "Malware payload (Vidar)", "value": "4dfa4d4117c64284b6055f446cbfac47f32341c084b410ca2ade7b3bb6942be6e50a12b1b492acf467386440f9f6e2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697337387, "uuid": "5574d191-cb43-4279-a620-531f860125db", "value": "T11C55DF31A9BFC249E1FD45359C6452E0DE326C33B612D65BCD13B1EA2C696D38AC0F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697337387, "uuid": "95427111-0cb7-4643-9b57-1a8452e53c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697337387, "uuid": "ec27444e-0f6a-4118-ab69-9760b8734e34", "value": "24576:eYiY3byk8gRn94kF/FltV6ivdJ9F5CDOrbr9dC9T1pbYisTSv60TinHtA4DyvT+e:eYio8a+kfRFsDSe1p8tTWBTt4W7+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697337387, "uuid": "a125ebae-6143-45cd-968d-104ecb9b3ec7", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697337387, "uuid": "67ef48f8-c5cb-4433-9972-427be0f297de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697337387, "uuid": "529e3037-084f-474d-a6d1-1c3409872567", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e209abc-6bb2-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697412539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412539, "uuid": "0bbd7484-b623-4864-bdd5-b697c96b5a01", "comment": "Malware payload (Amadey)", "value": "5678c3a93dafcd5ba94fd33528c62276", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412539, "uuid": "41b0b859-1e85-4554-89f2-37ae594ce056", "comment": "Malware payload (Amadey)", "value": "2d620c7feb27b4866579c6156df1ec547bfc22ad0aef00752ea8c6b083b8b73d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412539, "uuid": "fd0dc2a7-95c7-436d-ba64-647f07eba811", "comment": "Malware payload (Amadey)", "value": "8cdd901481b7080e85b6c25c18226a005edfdb74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412539, "uuid": "73db7655-6612-4cf1-a49c-00afe610bc4a", "comment": "Malware payload (Amadey)", "value": "179e818f5bb324fac2aad3e02e44323e32311ce72cdaeb2bfc573237bda13cb02b18d3fb1661f610db9eabea1a8d6219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412539, "uuid": "dba79816-5426-4cd9-95db-448ecc2db658", "value": "T1A4262360573C7317CF8ADC38EEA5AAAFD43B34130221D6A7598B914E5D7868784623CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412539, "uuid": "4ac0b26c-b492-470d-9b7e-f1d344cdeafa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412539, "uuid": "435f4634-1f01-4bc9-aab3-d2182dcfde85", "value": "98304:wPV7xffhhY8gFARZhPbY9qyC+KU/2fHIZvrRpOTx+qgm1g4DZoYP:wPdJHKsrPJD+KXIZvrRaUQRDZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697412539, "uuid": "8f3e59ca-17f4-427e-9e87-df2d837a191b", "value": 4527616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697412539, "uuid": "64cdf6b8-871b-412a-9965-145062c2943e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412539, "uuid": "3c1c04ab-0bec-439c-bd81-88e157acae9a", "value": "5678c3a93dafcd5ba94fd33528c62276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6aba9b-6bad-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697410177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410177, "uuid": "9f40c9c6-7bf4-47df-a6fa-a4c8cb7f2e1e", "comment": "Malware payload (Amadey)", "value": "ed169daf4f3bf4c2173920efc462f921", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410177, "uuid": "53b64f1b-0462-4954-b3b4-7e8b2cd67a72", "comment": "Malware payload (Amadey)", "value": "2d937402ddee15a50bb3701f7ec3c9af3037fd4ab786a34e8ec9a98b41bd64d1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410177, "uuid": "73257b8e-f973-410b-9909-19337c90ce57", "comment": "Malware payload (Amadey)", "value": "630245b4454cc9063318581a9c903017318946a3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410177, "uuid": "6de1e2dc-6b29-433d-a2c6-b3613c920657", "comment": "Malware payload (Amadey)", "value": "2181d91c627701e5350b810f2114988f51b9e8aa245996b861104bc64c133ed116b503c33ac3dcdc7407f1a95d761b16", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410177, "uuid": "70ec8a32-c9f7-4775-a4b7-973e3967cd6c", "value": "T1D2252213ABE944B3E5B0577148F383932E397CA09F78572B3FC9A94E0AB16815479336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410177, "uuid": "490a62fb-6290-461b-9345-526a6c89bd9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410177, "uuid": "8789550c-c5cc-4089-859d-4f8ecd109951", "value": "24576:NyY7zst7tfv882lyUHupmLBhYBex81Y/cv:oy67tfEjl3AEIeC1Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697410177, "uuid": "9b2628e5-be57-4259-b56f-0c5fef311c5b", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697410177, "uuid": "4d8b0b7b-1e5d-444f-897e-9e5ab8d99bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410177, "uuid": "07f8d5c5-372b-470b-85fe-02f53b4bbed1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427dab40-6b5c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697375449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375449, "uuid": "60d099ac-ca61-418f-903b-4c2b2fff050a", "comment": "Malware payload (RedLineStealer)", "value": "e495ae3d3724d88f32018daf3f1a7a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375449, "uuid": "51e2b771-882f-4357-8d8a-f6a37eedd2af", "comment": "Malware payload (RedLineStealer)", "value": "2dec90f1e5e6c7c18a8e99ba35c592090491f70647258da667bf9850e4ab55f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375449, "uuid": "f90585cd-f017-402a-a926-7ae1b49b9ad6", "comment": "Malware payload (RedLineStealer)", "value": "5cd1548c388437e126f380db2864405f0e8a2501", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375449, "uuid": "e84f2ebb-6d86-4ae8-9e95-d488fe9aaf8c", "comment": "Malware payload (RedLineStealer)", "value": "56fd69a1ba2c12dc3596de9c6f5eb45ac77a11950b593553bf6a099b33b4b7d768d964007744258cb614a7fdde2d4f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375449, "uuid": "de3c3a4c-9435-4636-ac73-91ef5ffbc7ee", "value": "T19015230297D9A5B3ECB6677068FB02830B3ABCB2DC34875F2755E8165872694783533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375449, "uuid": "01cf2404-cd08-4047-a369-81619c5e9492", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375449, "uuid": "087c99cb-d1bd-449d-a033-35e2a79e8653", "value": "24576:xyDnkZ0auEshnp0Zxp2uTJ3Y9/bCcfNZF:kbSuP5py/2ul3uNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697375449, "uuid": "71fce89e-cdcd-442b-a104-05734cc524f3", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697375449, "uuid": "db33bbbc-acf6-4f29-b4e8-babb49466dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375449, "uuid": "99d272eb-d340-4555-8f8d-62dc91384f6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09925296-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409713, "uuid": "54265e89-b7c8-4150-9c9e-1f83cc37f272", "comment": "Malware payload (Mirai)", "value": "f83ffb2e22ee61914b5a94d86c419954", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409713, "uuid": "7d3d81c0-e94f-4d2c-b8ad-a1db0fe6f138", "comment": "Malware payload (Mirai)", "value": "2df073812b424423007ecbb522191fa30548e6024f71769ca569162eda17e5e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409713, "uuid": "022ea7d7-1d4b-4fe0-9bc4-a8797e51478d", "comment": "Malware payload (Mirai)", "value": "6255b8fe8a90704a8aae8bbc5d1e505c7fb841a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409713, "uuid": "4ad74373-e9e9-4b36-94b7-23f83ca5dbde", "comment": "Malware payload (Mirai)", "value": "ae5912608e96199f696b90398416d59afce8ee37dfbfd7c275166cc2739694e167c6c7cec626b80d7c79ec4e8b0cc1df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409713, "uuid": "16f93b0d-c544-425a-a169-8208c390bf3c", "value": "T14533FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409713, "uuid": "66de9876-8f9e-4108-93e6-ad98c066f114", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oGt:r/hqaJMeteqK806MHdkfQX6HuCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409713, "uuid": "4de50160-230c-48b6-80ac-252470522db7", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409713, "uuid": "f5289634-c162-4d6a-85db-9bc05e933918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409713, "uuid": "6784a567-a44e-4177-bde9-958ea1912f3f", "value": "f83ffb2e22ee61914b5a94d86c419954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad22781-6b10-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697342982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342982, "uuid": "544d9917-325f-43c8-a384-569d2a1a1c2c", "comment": "Malware payload (AgentTesla)", "value": "a2bf39cc9b1a772c4baf012335031d12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342982, "uuid": "5fe1d987-4f2d-4d65-9eda-e40ea70cccea", "comment": "Malware payload (AgentTesla)", "value": "2e333b9f1df15070e8e9c7cabb25150ced7ab93fe2d6e2d328f31b484fcaa1f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342982, "uuid": "70d623c3-e43c-4079-bf54-27f7a654ef3d", "comment": "Malware payload (AgentTesla)", "value": "27e85e0fcf9e9d168450e624484332887aae15f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342982, "uuid": "af243f0a-fb37-418b-8b09-dac510a36d64", "comment": "Malware payload (AgentTesla)", "value": "2afa542b0b20be26d75555016958a0046f250b839588910f7cf9cb989fbfebfef1045c0a955be30e966b236db1cf80ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342982, "uuid": "33db013d-58a9-4874-a0a8-397635ca1262", "value": "T121341217E75EEECC68F1DD599B83A2E16E4349DC3F4927E88A40CE58C249F88F1D8194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342982, "uuid": "1488c581-b487-42d7-9919-8e93349f252b", "value": "6144:Ughe8ZKfsF6INjvw9g6UnFR8G57U0t42YXfAmG5K1+eW:UghelfsF6Iw9gJnFaGBNO2UAr5Ksl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697342982, "uuid": "9ac18f3e-2e15-4ee8-93ab-d571cfec37c7", "value": 242573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697342982, "uuid": "260075c6-b904-453b-b401-a2f10c7344d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342982, "uuid": "40d32a58-f9b9-4543-be4a-536c62a196a9", "value": "\u041e\u0432\u0435\u0440\u0432\u043e\u0442\u0447 3\u0414 \u0425\u0435\u043d\u0442\u0430\u0439 \u0410\u043d\u0438\u043c\u0430\u0446\u0438\u044f Overwatch Hentai & Porn 3D (13).mp4.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d725e3f-6b15-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697344919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344919, "uuid": "0d265c5d-1273-4293-a5e9-46ee5285ada0", "comment": "Malware payload (MarsStealer)", "value": "ea90ad0eff7026613e7ec2b865606a7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344919, "uuid": "dd5b5837-b81b-4cb0-b3c9-304ee0b1c14d", "comment": "Malware payload (MarsStealer)", "value": "2f1dbad2bc8a6b152996dcb415f01ff0350e75119663914aade45be5beb3f024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344919, "uuid": "e0887f61-70d7-44cb-86d2-28931945b84c", "comment": "Malware payload (MarsStealer)", "value": "ecf19163b425c94cfee2d39c83ee02763a6dd022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344919, "uuid": "549f5f68-a587-4c24-b008-138566d16358", "comment": "Malware payload (MarsStealer)", "value": "63ade17c5a2e46373dfa0350cc5af357637d1dc2602f4314b1198970a9703648d848b466d37baaf9d5e43ba63015289c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344919, "uuid": "f9a32a1a-6c35-40d2-974f-3620e8065c91", "value": "T15CC6E82839EE501EF3B3FE759FD4BA9EDD5FBA732A065459108103034A12D81EE91B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344919, "uuid": "3ba6127d-054e-484d-a024-ee49a7ce47db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344919, "uuid": "2dfbb2c6-4a6d-4e5a-8a0d-201fea071c6d", "value": "12288:/T9t8OedF3+2r2gnz+YJtOsuXUHmT3eSFnOVyFsH:7ofnzTtCJPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697344919, "uuid": "102408b4-4c4b-496a-a302-f5fe483e6dd1", "value": 12000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697344919, "uuid": "9979e008-becd-4fa4-9e27-02a0d927541e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344919, "uuid": "bcc56bb4-d3f0-4310-8187-8d833cf65f09", "value": "\u5c11\u5973\u88ab\u5e72\u5c41\u773c\u7684\u552f\u7f8e\u809b\u4ea4\u8272\u60c5\u89c6\u9891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faf1211-6b9b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697402422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402422, "uuid": "599b21a3-3aed-48c2-af26-72d5b645977c", "comment": "Malware payload (RedLineStealer)", "value": "cb07875d4b389ce13c9952d29452ac1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402422, "uuid": "dbce3bdd-b8f5-4d7c-b2d5-88349ae1b8e7", "comment": "Malware payload (RedLineStealer)", "value": "310ef3ae2768d8645906603e74776b3605faec82ef83a71b3e27e1f49bcc6bb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402422, "uuid": "a161a28a-3e9d-4fe2-9df3-0f678ce10a06", "comment": "Malware payload (RedLineStealer)", "value": "2a6fe3dce99da3ce3a65884111d2966fedb114b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402422, "uuid": "01755352-0446-4038-ad80-9c441dec4a7d", "comment": "Malware payload (RedLineStealer)", "value": "653be1dae37b84c06436ba943840f23cfa18dd607809dc495e518fd6272d79816dae769b0bac8ba22c86c25a38090a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402422, "uuid": "56816cd8-19ca-4a61-8076-c933cb76f185", "value": "T1F9E3AE1175C1DC72E57329350960EAF18A7DF8300F64AEEF6398067A4E746C0993BDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402422, "uuid": "fa27923f-1536-4d26-a405-55c532203266", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402422, "uuid": "ea797d5c-e1c1-42ec-a2f1-b1bd3b707bec", "value": "3072:LMEnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQRl2gNLpTPuY8w0jI8TJn:lZEe3bpi5aaYjgNhPuY8PjI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697402422, "uuid": "df864c1a-6f9b-44a1-b40b-5fae054387ad", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697402422, "uuid": "b98b81bc-498a-4283-bd09-8afb834be42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402422, "uuid": "df40e35b-55d5-4d34-8225-370c312e1e7c", "value": "cb07875d4b389ce13c9952d29452ac1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d0a29b-6b07-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697338954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338954, "uuid": "c0115855-9711-4aa9-92c0-4d35040b3d5a", "comment": "Malware payload (RedLineStealer)", "value": "785dbf44fa6a6d1a438f45b88da6aede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338954, "uuid": "41b83de5-bdd2-488c-8a05-403dd30c5d0c", "comment": "Malware payload (RedLineStealer)", "value": "3147096f23bdeb1b86ea980a07a4c85b5a1ca0a2432564dcc9f9679f9befdead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338954, "uuid": "dcd8532e-fae3-4497-98d0-51b9e970a457", "comment": "Malware payload (RedLineStealer)", "value": "b84f21d9c7cecb6db0754756a0d3475678671d08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338954, "uuid": "e67d2f54-b92b-4da1-bc22-8788c522965f", "comment": "Malware payload (RedLineStealer)", "value": "87093dbd65e59d24e9d373baa44d03df79c19b674ead911cfed14024967053e420503da71505e9820d74cbf9bd09a055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338954, "uuid": "07cb3d8f-f775-4199-9f61-93632cfe660f", "value": "T140152206BBCC8433EAF5237099FA13570A357C219CB4C75F23D91E9A09A2654DD36B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338954, "uuid": "22afab5e-7263-4e91-b945-6909aa3efd73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338954, "uuid": "a6f400ad-ed05-42a2-bdcf-d61105b60389", "value": "24576:1ybEE3Z4bOk/5E/yyuQkkrDGUFbJAYgj7:QbE64Bo/6CbJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697338954, "uuid": "05184583-889f-4466-88f3-20c34f2d7b12", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697338954, "uuid": "46ae2fcb-5eaa-4a51-9000-5e53397d5d89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338954, "uuid": "a8a10d16-e8f9-4fbd-9318-80c0a551b00c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80697f94-6b50-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697370399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370399, "uuid": "b00c78ab-db04-4cca-932c-4b36ab65a551", "comment": "Malware payload", "value": "2565314adb70533b26deb546a7f28be1", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370399, "uuid": "bf1e807b-fc26-45c7-b2f2-43228f927efa", "comment": "Malware payload", "value": "31aeefcdd86fe77fb3652743c8871dfcb33900660494b644bb7fb3a7f8bdfe36", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370399, "uuid": "69a9cd84-8a67-4346-860f-4da9b83a840a", "comment": "Malware payload", "value": "04b3c0f95413378d483ebd4b165c74a236e3082a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370399, "uuid": "36c9a209-50b1-43c0-b166-4f0dcd90637d", "comment": "Malware payload", "value": "2c9a6874942f4b7a48bdaf251a77b0ddfb0ec03d7933c20e81f9ceb229ff88c8d5dbc79d5076a04746af15a387cdfd8a", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370399, "uuid": "99a98fcc-9e58-43f2-95c7-b78c98ae193c", "value": "T126240205F68ECC0CFCC3F6279DB9380A8A7CF44B91CCB8C52079D959E5459ADA74329A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370399, "uuid": "5f954450-31c4-474f-a8ff-0b04eb85ecba", "value": "3072:c1rcMLGJdgt2V0Nl4Qaitm/sG31gh3lgobh7YcjXYRTS3Jvix3BRxwY7g8hx0W6S:w3CzHFufOTShAbxwXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697370399, "uuid": "b32b758d-2518-47cf-9081-67c4bea8f27b", "value": 215380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697370399, "uuid": "8922e733-5f65-484b-ba4f-611bd61f614f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370399, "uuid": "92999d66-c965-4599-97f6-909e7af6d6cb", "value": "#893045.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786018fb-6b0c-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1697341179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341179, "uuid": "34ad2f44-8f1c-4a33-be15-c8c18c2bc542", "comment": "Malware payload (AsyncRAT)", "value": "9f0f8bc109ce19c06619aaa46641764a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341179, "uuid": "2016f207-9fbb-453b-9c1a-b1a09c08c014", "comment": "Malware payload (AsyncRAT)", "value": "34cd6c33f1627be5fdc1c27109e23173a1b1358d03b8fc8b876d9c459552a6dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341179, "uuid": "5c93ee2e-c98d-4aef-9d21-9bb1524c8673", "comment": "Malware payload (AsyncRAT)", "value": "5a8d5a9beaff064c18bbc6a6f8c440e95cf73608", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341179, "uuid": "21343012-4822-4df6-bf8b-f7a3780edc83", "comment": "Malware payload (AsyncRAT)", "value": "bb0319be16b255401a46e63431d059110abf86e2221e96051093aa2052f991544fba52f1e028bd4a79920de082727310", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341179, "uuid": "808f052c-41a6-4bc0-ab8b-34b3ea34162b", "value": "T17FA30213DF8A6280E663AD7B28045E841FB44C0C2DF9E50B973E3352DC98EE876479B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341179, "uuid": "1cf0f0b5-9ebb-460a-913a-8dcfce131293", "value": "3072:qvG52ng8A5brOv+zKWybTJLw2OVDCal/htX:qvg8A5+5WKTBORndhtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697341179, "uuid": "5d0068c3-4208-4329-b290-b1a3ac0a1c35", "value": 100497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697341179, "uuid": "9ab2fcf8-0807-42a8-b14a-4e79d456e903", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341179, "uuid": "e0b56406-582f-4512-8004-5649492dbed1", "value": "9f0f8bc109ce19c06619aaa46641764a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fda2c2d-6b9f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697404140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404140, "uuid": "60c9cea1-a1e8-4d72-ab07-6bd5f8713dc2", "comment": "Malware payload", "value": "7e79f5e299d76555b1cf554e2d9b7e83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404140, "uuid": "86174548-3a73-4ada-87d0-aad1bdb87822", "comment": "Malware payload", "value": "34f2caa08c72909033efcf3848fda6766b679d99545193dfcd23301a838a3181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404140, "uuid": "f180bcc9-d79c-411c-9aff-6cce79a1d279", "comment": "Malware payload", "value": "a4ec51de741561de402934f6082c3690aeb484a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404140, "uuid": "873a175a-31c3-4441-99fe-ec61a153eda5", "comment": "Malware payload", "value": "925c7043db3eb7dc71f1878b32d8d5364b66fec8131013508f459c84573d42c6f432a5e126e964fa3627f80b6f32cb7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404140, "uuid": "066d6c1f-25b4-44e1-9dfb-5bb4c8486329", "value": "T12A452396A9D894B2FDF86F7018F713830637BD108E75C2673684D8670CA368541BAB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404140, "uuid": "8e6b8c3c-81cf-4d35-a320-c58010197431", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404140, "uuid": "56dbe9e9-01a0-4517-aafe-0c8d82be8321", "value": "24576:lyoq99XnNePFopLizcnTY0hcXCjMO9tQkbfHgnnId:Aoq9FsPF9on809MO9ttbYnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697404140, "uuid": "78b3b36c-7c45-4e8a-80a2-c577d76b0c4c", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697404140, "uuid": "b88bb802-3d5a-4d1b-95db-bf5b93fcd0c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404140, "uuid": "98b570ec-c5e2-4ef5-b3f6-a61e9da7f94d", "value": "7e79f5e299d76555b1cf554e2d9b7e83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777eb861-6b47-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697366518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366518, "uuid": "621924e5-306b-46d5-b1db-eb6bd23afe9a", "comment": "Malware payload (Smoke Loader)", "value": "42ba0a09b3277dec1312f8c9799bff14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366518, "uuid": "a4998b45-7cf2-45a4-bf25-4d2ab039cf29", "comment": "Malware payload (Smoke Loader)", "value": "354d0f574652207b4b396e45effb35d4948819b926b9f968fa713e03726f08e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366518, "uuid": "925c0d5f-1b0e-4338-a057-974ec512b800", "comment": "Malware payload (Smoke Loader)", "value": "43d2484e20e4707537ef36bc05f47feca6f6212e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697366518, "uuid": "1594d8fb-fd9e-4fa2-8e96-93fce7b03497", "comment": "Malware payload (Smoke Loader)", "value": "2dde26f01b285fa62b891ef2bfcc82b24d3a4e8183a5a9284fc6fb06cdcb6f8aa6ad65581676f89e86d632d10cad53e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366518, "uuid": "ad3f18d9-c662-40ed-99c0-4b33a64add8b", "value": "T136445C13D2E17C50E9264B328F1FE6E87A1EF6604F497B69261CBA6F04B10F2D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366518, "uuid": "1c100b19-10c2-4527-83d8-76c320203fb0", "value": "f8d7b6f4b1be45f1a7c2df1ba9bbc18d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366518, "uuid": "5f97311f-7221-42c5-8401-3f6f72786aaa", "value": "3072:lUcYvYoixNMAMPk0E0X47ZPFWFMcFOiEGYArZ9CqxAu5z61tsU:NSYoANMAMM0E17Zd4McRHNfHL61/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697366518, "uuid": "8c0a87d2-bb2a-47f9-9e58-4a9815c62dee", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697366518, "uuid": "0432a29e-3a6a-4648-a60e-9fb97bf8fe91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697366518, "uuid": "2c4f8034-ce16-438b-8b84-52ee103be87a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe12c81-6af8-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697332810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332810, "uuid": "b437ac3c-45b3-4d83-a149-554e30aaa3ec", "comment": "Malware payload (Amadey)", "value": "1765f04ef88bdb860dcaa3ac2cb3fe80", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332810, "uuid": "e5deab20-b067-499d-8108-4927b211ab7c", "comment": "Malware payload (Amadey)", "value": "367cef0572020252db72812c60050548c8def2a3bba0893ff2d287172992c482", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332810, "uuid": "fe50b31c-98f2-4a29-913e-f930eee1c69a", "comment": "Malware payload (Amadey)", "value": "92097924e677dc9a6a9474ccb094d189b3888076", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332810, "uuid": "b6851118-a16a-45c2-855d-222366d62da1", "comment": "Malware payload (Amadey)", "value": "c56498e1871bbb89c97703c8cffd804f5bd57318491c74bf63358e20f93e6319e401759bab891098bdad47fbb7690b41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332810, "uuid": "b867beb5-2039-4d69-ab33-e161881090a3", "value": "T103158D2138C49176EEF320B787ECBA36426DE0B4071916DF16D817EED7606C27B32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332810, "uuid": "ba935084-4ffa-49da-85b0-2529055ab12f", "value": "4c2ede2d1d1824f0fded580996722f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332810, "uuid": "791c1dc7-7e0c-4e58-a17a-4b1421ae775c", "value": "12288:IO5XAW9g1Azv0X5tHXSlVceJnMa5ifhNYwvumoQ7QAm0:IJW9g1Azv0X5FUHz5ifxzQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697332810, "uuid": "014234e7-fc89-40c9-9b91-02dbfa064545", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697332810, "uuid": "7f55188e-2142-48db-84e1-d5e3f155a449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332810, "uuid": "74c2fc3e-0383-4480-9df3-bf9c43597436", "value": "1765f04ef88bdb860dcaa3ac2cb3fe80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18324eb1-6b87-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697393846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393846, "uuid": "b3ae5a38-f70d-4c47-ad5c-fe4101a712cc", "comment": "Malware payload (Mirai)", "value": "58840a39e5f5109759beedec5a8723be", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393846, "uuid": "82504f0c-7333-4a59-b840-3708711f9bdf", "comment": "Malware payload (Mirai)", "value": "36bf4d8698c9c316772664120bd8cb279e384d41ee0ff333ef7e985e2b88fcae", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393846, "uuid": "ea62369c-7a3d-4271-8ed0-29a3dfdc853d", "comment": "Malware payload (Mirai)", "value": "c2483952e10b728820e0ec93f7fa9d63c8d8f959", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393846, "uuid": "fa192a47-e8bf-49a5-8b06-acfd67f488e1", "comment": "Malware payload (Mirai)", "value": "3133dc3f903e2103240818bdbee9ac9717b802633c613d3b6a9b1c0f30e20719a86779d9a71c8b6cab66963e50b721b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393846, "uuid": "33ae6914-5d5b-4e69-9b52-def2e4c777f2", "value": "T18A044B46EA418B13C0D6277AFA9F42453323A764D3DB73069928BFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393846, "uuid": "279b4890-fe73-47a6-9cdf-b87c97ff266c", "value": "3072:rF4Cfiz3VtYuwaZk3/x4qsKtvfGVgjhsFyzqDM/9ZPa6q4pU+:rF473D1waZk3/x4LKBG2jaFyz6M/906V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393846, "uuid": "dda2a54a-2023-473c-9f67-21248ab6e631", "value": 175665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393846, "uuid": "49527996-65a1-411b-bebc-d4140c319324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393846, "uuid": "02508f23-5df4-4e59-a104-75c098d3079e", "value": "arm7-20231015-1817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff51d3c0-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367176, "uuid": "3f5a7297-f83a-4a16-a538-89c297aefe88", "comment": "Malware payload (Mirai)", "value": "f5343c61f1ee37b7aa8b20b99f010300", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367176, "uuid": "2f9350ee-7f69-412d-8d5c-f9f51078975c", "comment": "Malware payload (Mirai)", "value": "36d6608c9ee6b202bdc33074247351e81c31380ca6a0f14eb70487e48de29e21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367176, "uuid": "3e5a4d43-8d28-41e4-9be3-506075dd73ef", "comment": "Malware payload (Mirai)", "value": "7872a9f9c709e67941249ddd1b8a7c6c4e7e5c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367176, "uuid": "e67a94b8-4ead-4546-8bab-11de6b871222", "comment": "Malware payload (Mirai)", "value": "e3bdbec675eb769a3a286b16ca895cc0b69db2ec7e804a1c0ec2c9edc6bdf8fb5de7a4cf9a4a6606509d7b7e527139df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367176, "uuid": "242b7f88-5ff6-40f8-95ed-c3c87f6e804a", "value": "T127D2F19FF1DA8853FEC092FB899D6AE07C95D29B5228C2023A31089E52DF583D53FD10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367176, "uuid": "928b72f7-045e-4013-b83b-f687f058c615", "value": "768:UtWFcBSyp09oa+AgPnDwJl8tHRT9RQ+zK9o6YTE6:aucBSECoj9fEeHRdSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367176, "uuid": "9d172922-2f3a-4c9f-a312-7bdb74d79bbf", "value": 30304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367176, "uuid": "1b98d707-d20e-4a3b-b51e-62c99731f8bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367176, "uuid": "28fad4ce-b059-4b6b-9c8e-b469a0026374", "value": "f5343c61f1ee37b7aa8b20b99f010300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5946a04-6b2e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697355912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697355912, "uuid": "28ed92c6-6442-4b51-91bf-f7179cad40fd", "comment": "Malware payload (Smoke Loader)", "value": "fa4fc09b8d88926f08e863f2d4115cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697355912, "uuid": "94759091-0869-4efc-8950-19fc7915eac7", "comment": "Malware payload (Smoke Loader)", "value": "375a6895ed6a5786f23202a5b552bc7db2c16ddb5c0bde0a0733461061e9bd6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697355912, "uuid": "7135df60-3c13-4063-8d93-c40c16529fa2", "comment": "Malware payload (Smoke Loader)", "value": "b37a6ded1bfa9b9ad279fe067673703f583b0dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697355912, "uuid": "8052fb71-78ef-4026-909e-20ce4a48f75e", "comment": "Malware payload (Smoke Loader)", "value": "bd8405a2eea5b96e33e1e69c07eb89e817de56a88b66857467178a9706f9f292ff4c87c3a79eb9d2106f2b10bdb140b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697355912, "uuid": "8f4bc80f-55fa-4a81-bdaf-ae01cb142dea", "value": "T1DF15221A97E94832F9B093B049FA06D31735BDA24865876B2788D86F0CF2B95B07075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697355912, "uuid": "3375d92d-3003-44bc-8394-cdae80237ae9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697355912, "uuid": "c5d7c33c-5bd0-471c-b5ea-8eca1976dd63", "value": "24576:3yjO21HRCLrM6X9TjlJsV4O0EJ/dBK+T:CtHRCLIyjsSYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697355912, "uuid": "e6f259e7-ed6e-46a8-9d1f-b3b470bb5dc2", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697355912, "uuid": "1e27671b-0db1-48e7-b274-39bef89552af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697355912, "uuid": "5a601769-e8c7-427b-82ab-34b2be34afec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f81a4b-6b9f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697404122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404122, "uuid": "46a423c4-1197-4bbc-98c0-2f5a9311317d", "comment": "Malware payload", "value": "fc2b9bb7efb4de885c3650cf52e3f073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404122, "uuid": "53c82610-b42c-46b5-b02d-03c87febeae4", "comment": "Malware payload", "value": "38120bdca03441433ad915b13323b20ac07059e50af9fd909d31a33f1d8396b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404122, "uuid": "61819da0-2c1a-4d4d-8b1f-2c6b648c3c86", "comment": "Malware payload", "value": "24bd175148695b24204799cae7ec9e3ee9e18427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697404122, "uuid": "7f6c2ceb-2256-47c9-b787-7d0eec3061e1", "comment": "Malware payload", "value": "09e67decfd424850f12fe9040e78d0757d93d2508ddb6b789b9b2e3f26d770f2793e66aec9a6dbeaad11678ee0ef9a92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404122, "uuid": "930f586e-1b82-4e17-8d6c-0422dc978f06", "value": "T170343A13C2E13C90E9368B728F1FD6EC7A1DF6518E497B69261CBA1F04B1272D6A3714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404122, "uuid": "8ed7f8fd-217f-4ab8-a2c9-27e2b891be71", "value": "8eeddfc6460561367d657cb6880bb0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404122, "uuid": "5574e630-a797-4087-8a8a-9c420e0095a4", "value": "3072:QPXdj6EqoDO0RUBu8X/mtYW3aLWxQoou4m0w5mg/tho:sXdjPqoy0RTidSD4m0HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697404122, "uuid": "15a763fa-bd6f-44a7-9075-121246c42ae4", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697404122, "uuid": "67866e1b-31ca-47a1-b9d1-33324f5496d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697404122, "uuid": "dc5b3d89-4de5-4cd2-9eda-7e85a4cdf0a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cf11c2-6b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386242, "uuid": "db1f30b8-88b2-4e09-a6c8-204a1f4a4869", "comment": "Malware payload", "value": "5508b50b110acf7a152316d5352da364", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386242, "uuid": "4813579f-2bd9-4b9f-a45b-65b7f4cd2b8b", "comment": "Malware payload", "value": "39a11c035e6a1f32241f5df20f55c035f6f61d19f946e5600019bbf9774ba37b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386242, "uuid": "0562e07c-ae16-45a5-a7a3-af84de71ead6", "comment": "Malware payload", "value": "2247bbb5df34280e3546b74497dd3df81d39bf44", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386242, "uuid": "808b7e46-9343-4132-b682-ff98d75aa975", "comment": "Malware payload", "value": "a617266087dad92ba68273da92981cf5c69bb64e737da902ee426b1325d4583832474b6c83aa510ceb796b10a15828e1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386242, "uuid": "a6970185-df7e-4241-80e9-fb8cc2a74a1a", "value": "T1B6C08CB10234139CCDA28D5C008A8334AA67A14A6210E2A2B2A05520FD04009862868C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386242, "uuid": "d4bde815-3da6-414c-a484-9fe9849b7868", "value": "3:oXeqNjMJJLNy1IMwNQqPJH0cVERAIrFnl1d99a:oXe2jIny1xQQO0cbA199a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386242, "uuid": "35569b00-be6b-461a-aebe-dc4c32d62223", "value": 154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386242, "uuid": "518f1b28-40b4-4a92-b68c-4c1bd961b777", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386242, "uuid": "68fcbd95-d2ab-4e60-a77d-20419c43aa8e", "value": "5508b50b110acf7a152316d5352da364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa86d7a-6b91-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697398422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398422, "uuid": "df191f3c-33c5-438f-8753-f29f16e2bf28", "comment": "Malware payload", "value": "5f70fb2cdf26249758373482e2d296a0", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398422, "uuid": "cd873d7d-1d6a-42ea-ba70-0fb1388875d4", "comment": "Malware payload", "value": "3a586493131b5a1784e7da751f12fd992bc41f300a28dcc5021d2127d33cb8bc", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398422, "uuid": "0d79c8ee-9c76-48c0-b72e-90dcec56514d", "comment": "Malware payload", "value": "c4af665bb0e180bb21b0d598902692d0a439f037", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398422, "uuid": "6e28c067-4d93-4b8d-bbc2-815205b2056b", "comment": "Malware payload", "value": "d174366a4387326f959843fdafe5999756b83e5b5e09630dbbc08472fd9ecc6baac62e5c81d9afd24981f3371f5a0683", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398422, "uuid": "e7ba039a-9da9-4c84-853e-264aba8f5c34", "value": "T151F31A0BF948122B49C34696F80775B3AD7DC421A74D22E1ECAED21877CB4ED826E5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398422, "uuid": "3c6f5672-0f36-4120-a403-ddbc4f2379ab", "value": "3072:By+J+gqybZnIsUVsXv0ubCWL/CFGZtJqj5MvQV1:BTWsL/I9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697398422, "uuid": "da4b06fb-80d2-45c8-8249-6cb97f5f5e5d", "value": 158256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697398422, "uuid": "47bc75d6-6b42-47a3-b43d-0167f44003f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398422, "uuid": "36e1d834-420a-45ba-8459-8e33ee4fdbce", "value": "e664858e8b8ff1ac08f6dd812a68d65d05a704262fa13862538c3c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90778616-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376868, "uuid": "7e9561a3-0951-4c82-964e-52ba4f36c48e", "comment": "Malware payload", "value": "174eb1e11a0bd1e7d4738435ed6bedd3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376868, "uuid": "f13151d0-b1a8-48f4-9676-68e24d0c2a52", "comment": "Malware payload", "value": "3b8549e16b13c41662ccdf5cb4b9e3f5c701487da3111aaff96c8bf03efe869c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376868, "uuid": "6ae3ab85-23e3-4f33-af94-3498c2e360b2", "comment": "Malware payload", "value": "2cf51f3774cbb4e0b845dcfd779d1b33ef343c5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376868, "uuid": "b8940ae1-e3c3-4fa0-9a12-1a79e4df5526", "comment": "Malware payload", "value": "323b1a2b6d0f4068f82e43a76561cf31f356943b741ddb2c17187ee96a457fe2aa65b8433902690971668264e4c21060", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376868, "uuid": "afc6dfe2-eb3b-4124-9185-74a07824527e", "value": "T16A1462CB9C76A36C0DB2E17B1C27B48AAA7DE293C4CCD341CAC7F4C615819D9981F1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376868, "uuid": "dadf6fc7-76d3-41d8-ba68-e06327503888", "value": "768:wfWfWfWfWfWfWfWfWfWfWfWfCfWfWfWfWfWfWfWfWfWfWfWflfWfWfWfWfWfWfWF:X0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376868, "uuid": "30da01a3-20c4-4699-b146-8843df6b119e", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376868, "uuid": "0adf5fe8-1fe0-4e24-bdff-8840650c4374", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376868, "uuid": "72517e6f-c7e7-4125-ad5f-f7dbd8cb3993", "value": "174eb1e11a0bd1e7d4738435ed6bedd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543bd313-6b83-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697392229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392229, "uuid": "c4936c98-bc5f-4b30-b922-49585fbc9887", "comment": "Malware payload (RedLineStealer)", "value": "9bb0eb72d32ec101bc3815421314f021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392229, "uuid": "a4840175-ce44-4866-a747-b7bd45db536b", "comment": "Malware payload (RedLineStealer)", "value": "3d5d022325d8cab27839dfecc7bb90cf6b6aa9e98c09f6092f85ed6e048d190d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392229, "uuid": "8cac5abb-fa01-43ab-920c-5f42d68ae825", "comment": "Malware payload (RedLineStealer)", "value": "1d841de7459312d07946eb0dae13a4c87bc0ca3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392229, "uuid": "de1407e3-54e4-4ad9-8651-c2635f8fa106", "comment": "Malware payload (RedLineStealer)", "value": "86382a0a5a1ed01ba84ce8c11423b0c240c5fe513a4ea3fcbfb64766c9163a684e2e566c7d2f190be11f41d94d75d1f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392229, "uuid": "a42e6007-7cf3-4f9c-9110-5204d498e459", "value": "T147E39D1275C1F872D56318350970EAB34A7DF8300F64EE9F2398163A5E646C19F39EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392229, "uuid": "1dcace49-e859-474f-bf02-b24d605e2809", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392229, "uuid": "9920ecc7-92e8-4df8-8ecb-1e7038e62ccf", "value": "3072:PMmnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQRX2GmGXCI8TJn:3ZEe3bpi5aaYBGmLI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697392229, "uuid": "c4a82414-5c08-4f62-8c13-d65ab905beb5", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697392229, "uuid": "8c245289-87e7-4085-b556-d1cb20b9e61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392229, "uuid": "43d1fc89-2924-4bbd-95c8-65392b5041d9", "value": "9bb0eb72d32ec101bc3815421314f021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49b5566-6ba3-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697406188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406188, "uuid": "fe23d944-8f56-44b1-a761-5db0f6746b66", "comment": "Malware payload (Smoke Loader)", "value": "0a2fc5d21bba3cfcbfc6a9d55f6ff427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406188, "uuid": "8da75edb-7481-4d64-a1c2-3b1d6b05b675", "comment": "Malware payload (Smoke Loader)", "value": "3e0d870864e1c75b1cab7299128501866a2e76ba04e2c3b70489fcd235862ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406188, "uuid": "f0d4b423-6e08-46a5-a4d2-146cb19f702b", "comment": "Malware payload (Smoke Loader)", "value": "d145dd6c7c09ca192bc08510b76b76219e936cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406188, "uuid": "adf12a3f-0b93-4c30-88f4-44d96f5afe20", "comment": "Malware payload (Smoke Loader)", "value": "e67024ef7233807cb07348d1ac24bcdee314ce5934c707697db9b15c62c7caebbc92584bdb5888a6383c7198193bab80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406188, "uuid": "5d89d9a6-c798-4386-a430-9fa8de42d2bc", "value": "T1BD252203FBED4563C9F5577018F612831B36BDB14A7AA67B1392B80E0E726C0A53175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406188, "uuid": "d05b48ba-2ee1-4b71-aabf-1c67f0db2351", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406188, "uuid": "7e7f496d-5b9c-490d-8136-e583c03ad028", "value": "24576:byGpKWQU3ELDEQL4KM5n6e8CRQIaS4RPUpRj:Oyb0LJUKMN8Ce5TAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697406188, "uuid": "86eaa96a-36c9-4975-b743-200b9887a87e", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697406188, "uuid": "bd599a6e-53ed-4bc0-b796-f084649ca744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406188, "uuid": "6c6583c3-fa34-4f33-8180-6aa03260a3a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bc4f79-6b9c-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697403098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403098, "uuid": "b4a54cc2-3c7e-448a-a294-368fe0fb4ab2", "comment": "Malware payload (Stealc)", "value": "d88f9cc54c1847d3bb34dc15a2ad14fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403098, "uuid": "72165390-460b-4291-94ad-8a8b231881d9", "comment": "Malware payload (Stealc)", "value": "3e69f19a21cc28d30e419c05f46e759f33d90315ffb4a7a2e123488df96edd75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403098, "uuid": "72f869a8-2df4-45e6-aa4f-9bb8a14a2f72", "comment": "Malware payload (Stealc)", "value": "71fbc184b731aa6040355979723cc87499f4ff18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403098, "uuid": "11704e3f-8185-4d72-88b8-82a81b23cc44", "comment": "Malware payload (Stealc)", "value": "377419d509e5717519adc448f9a1b093d8d7d853749d56daa2aac2d85f2a62c8788e89dd930fce966888389f883c5143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403098, "uuid": "30016423-4ac3-4a79-a64a-e137a5a80e24", "value": "T1C2344A93D2E17C50E9268B72AF1FC6E87A1EF6508E497B69261CFE2F0471072D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403098, "uuid": "6c39f61b-942d-47d0-bf7e-56327cb063df", "value": "8eeddfc6460561367d657cb6880bb0a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403098, "uuid": "66811620-c653-4242-aea1-f0799c1712fb", "value": "3072:LsuNZhUNL2D6swCbK6kYHaHWOaVIr2RP86T5mlRx3Gmo:AuNZiNLu6Qk/CZRUNlRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697403098, "uuid": "66bc3142-c1e9-4eea-b64d-256286be7179", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697403098, "uuid": "3ee9564a-7867-46fe-ae6e-1a1a0ce33b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403098, "uuid": "668b8704-17f0-4251-9199-e3492fd7dc6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e9378b-6b13-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697344180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344180, "uuid": "74a743b0-7042-4c4b-99dc-9e64739a0e45", "comment": "Malware payload (MarsStealer)", "value": "90c5fef5012a883eb695087470a9a429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344180, "uuid": "5619fb2b-8c2d-48bc-801e-968f5fcdd5ae", "comment": "Malware payload (MarsStealer)", "value": "3e8fd15057bf76c51853b4a03f505c85588d13826fd417f9f15b653a9cce49c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344180, "uuid": "577f8cad-7785-4b07-b259-d77b0077bd2e", "comment": "Malware payload (MarsStealer)", "value": "2ad12f8819ac7750b6dc3a98e170b115b2cbc714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344180, "uuid": "3a697f8b-6f8c-46f7-9d2c-146dbaeeda18", "comment": "Malware payload (MarsStealer)", "value": "b39b4cf135335eb832e7b59086ab8a42655a46d27a074401c0f2a28370da6cb44f2f686018b66c17cf6720d0705f548b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344180, "uuid": "5223ad26-c267-485b-82e2-65028b592f13", "value": "T13796C83838EE501EF3B3FF755FE4BA9E999FBA732A065459108103074A12D81EE91739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344180, "uuid": "70b564a3-366f-4dcc-a7b8-2c00be969078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344180, "uuid": "0cf3b7e6-7809-4cf2-bc82-1562de247188", "value": "12288:Me/cwY1icfinL+r3FI4PpJEtpnxnI+UejPFnOVy/:/YTr1IDtpnv9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697344180, "uuid": "fb74eb52-d787-47a5-b40c-88536253549a", "value": 9016896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697344180, "uuid": "70f34aab-1c46-4f30-8c22-333700e98d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344180, "uuid": "bc4fc3cd-a976-4e9b-a2ed-409cce560361", "value": "\u8272\u60c5 \u7ea2\u53d1\u5973\u5b69\u53e3\u4ea4 \u5728\u7ebf\u89c2\u770b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde8cbd7-6b3b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697361536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361536, "uuid": "27a7aaec-c926-4ffc-af8b-78ab021dbed3", "comment": "Malware payload (RedLineStealer)", "value": "e60ae4587fdbcdc41cbaaeb22b6a56e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361536, "uuid": "58e42130-7580-4b33-b929-2857a6f8ad8b", "comment": "Malware payload (RedLineStealer)", "value": "3ec106dcd36d065051b48be3559b5d845bd73f86a3c2d642141fefc586b25457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361536, "uuid": "a3d9330b-4202-40bc-a80d-514c1cfcd927", "comment": "Malware payload (RedLineStealer)", "value": "f808422ae15a2edc8628e77cc8f77d999134e7a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361536, "uuid": "5c72d309-d999-4f90-8d23-3d4612df8312", "comment": "Malware payload (RedLineStealer)", "value": "55af8129fa590751f1d70d84ad490a1fbfe4eb9bb33697fab37e931242214e4db0130bf01d7ac7fc00dabe51934d0867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361536, "uuid": "d307a151-e5a6-46ab-97bf-778b35db8970", "value": "T194152297E6E84032D9B92B7054F207930B39BCE19879C37F2B55E91A4CF2299643533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361536, "uuid": "42accd65-5d7f-4583-9a42-76056baf4496", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361536, "uuid": "dd10ee50-fcfd-48e8-b3a9-5366e69f1d36", "value": "24576:KyfEbvBbXH2gd5GRCd+4clPpuIGLl+nMINJ:Rsbvnd5YCY4clRuIGL8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697361536, "uuid": "c647ea9c-f429-4c9f-9ef7-d3b56f917a95", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697361536, "uuid": "3dfc192b-ad36-46c1-9be7-09bf3756bac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361536, "uuid": "77a5e3a2-961d-4931-a812-e470c183333e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7b307c-6b2c-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697354905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354905, "uuid": "8ca18779-5200-4f75-ba65-f34ea1c5c686", "comment": "Malware payload (Healer)", "value": "066bb534adef3007b59a440df554a6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354905, "uuid": "293d8cd5-b468-44ad-9371-ae47b7a23c9f", "comment": "Malware payload (Healer)", "value": "3fa03f784ec205ddfffcf521bd6cdb53b46ad6ed6fd84ec4ecd85c545c8e2edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354905, "uuid": "44277029-0504-4f05-8e88-2e784049028b", "comment": "Malware payload (Healer)", "value": "2bd0c128ee738a1761ada12b9f097b8fa82a49ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354905, "uuid": "210645cd-8b7a-4423-a5fb-1034c8e3d1b8", "comment": "Malware payload (Healer)", "value": "132dbdaefce9ba91acc03d65bbfc9840f2e6907ec9a11e9e4c19f2fe9f24965b5a65ef0cc136020acb433841cc25ae15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354905, "uuid": "ed59577f-e332-4eea-8c3e-79886f407498", "value": "T1521523039AD98522E9F12FB018FB03930B32FCE29D65874A5656589E1DB36C6E03179F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354905, "uuid": "ad3b5c7d-a31d-479d-ae52-c93011a3d669", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354905, "uuid": "1d76b558-503b-42d3-af09-9ae270a10eb9", "value": "24576:AykgzpSUtBf1kZd2NqLeHdcOBla4TyouFzZRf3gD:HkWpV1kWHj84eTZR/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697354905, "uuid": "b9f2448f-86da-4aec-84d7-0e9cd269cdc0", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697354905, "uuid": "2b6a34d9-66dd-4df0-9251-922363edce9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354905, "uuid": "786fd6bf-d1e1-41d9-bbb0-1e1558463765", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c77fac-6b07-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697338940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338940, "uuid": "1e88b3dd-9281-4bf7-9efd-3283ed621c0c", "comment": "Malware payload (AgentTesla)", "value": "3d5ff0239d8382ce8e71d540c3d755f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338940, "uuid": "e36425b9-dd1a-4882-899a-20778bcdde4f", "comment": "Malware payload (AgentTesla)", "value": "3fa16971fed42e7dcc4bf528ee437ca91d6ac16a1a06d88e48fbf196a828b051", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338940, "uuid": "18239ea1-4108-4e6b-8571-4d8a98e7d99a", "comment": "Malware payload (AgentTesla)", "value": "67b657bf0dda96b8a2b518f43febd252c066fe35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338940, "uuid": "da026147-be29-4871-9898-b667745f99e4", "comment": "Malware payload (AgentTesla)", "value": "5bc52dc45e36e5350b5dc59dfe138deeeacbe99bf6e409f7c79013de51d60be102c7fa435f91a43f05efcfe841d1cfac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338940, "uuid": "cc282eaa-74ed-44bb-8b84-3cf913176acd", "value": "T167B6D12629EB109DF3A3ABB25FC8F8FF896AE573191E70F5214147468722D44CC52B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338940, "uuid": "1865b74b-98f8-4bc1-acd2-d6af6f2bf510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338940, "uuid": "3b046894-075c-4dd5-859e-fed0ffaee66e", "value": "3072:7D8lTxrUhcUGsMSDoS8GsA9gnXeGptE9en27giutF/sM28t6iNBIFTYx4Jy:7DrhrqGsA91In+RlJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697338940, "uuid": "562c8ee0-b1eb-4499-b885-f65199dc40b0", "value": 11008192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697338940, "uuid": "7ee33aba-96b2-4eee-9b70-8c7da7f50876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338940, "uuid": "cc7aae96-edaf-4752-8dcb-a5e8ca02d818", "value": "sister live broadcast setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14096320-6b57-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697373223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373223, "uuid": "e95091da-ed0b-48c6-823d-a4657bb6f282", "comment": "Malware payload (CoinMiner)", "value": "93a83c35a0febf8376a76d36f8f3e1c1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373223, "uuid": "da9966a0-8698-4828-863b-16a721e8d496", "comment": "Malware payload (CoinMiner)", "value": "3fb9b791cb2d5ae79b9332be3b78048c98e957c0804b1f28cdd6f3d0e222f7cc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373223, "uuid": "75734588-e3c6-4a38-9855-b199f67941f8", "comment": "Malware payload (CoinMiner)", "value": "c112ccfcfe63a72595cba83d9c4f815c5f4b36a4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373223, "uuid": "e4599a18-5bf0-4e51-aeeb-deb3ca6ecdd5", "comment": "Malware payload (CoinMiner)", "value": "fecce56b8b73b2ba0435f77e91b7dc0f6a2cf55b37769085869fe6cb04f1f0da74b08e3fc9625ef9343eaa11752515ae", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373223, "uuid": "2407e799-5c8a-4e31-95c8-8ce7d08ccf09", "value": "T15856D00DE1E1EBE5C071666F57ABA1D64E13BA3A4A071088B14B5716C32CBD72F7CC86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373223, "uuid": "3c8902ed-6257-487f-93b2-2026c83f794b", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373223, "uuid": "ce87b6de-f14a-4c0b-8d1b-f7d66bda2625", "value": "98304:ZI377bT5U6pK1g/Bo2oS252St5WZ3D8zcbFX4b7p:Zc7j5I1g5lk2SfW1DNFX4fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697373223, "uuid": "f16f69f4-217c-47f9-b8a0-d860669ecb4d", "value": 6011192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697373223, "uuid": "a21ce92b-986e-4a91-8f56-4346cd415dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373223, "uuid": "fe293b89-52c3-4142-b162-95b4400cf015", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489ba52e-6b97-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697400799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400799, "uuid": "fbb4d4a9-8a51-4b11-970e-789df31b8852", "comment": "Malware payload (RedLineStealer)", "value": "a66325fb7b9a287571fc21459ac925bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400799, "uuid": "10e4d7ce-b1b0-4461-be9c-18edf4a365f1", "comment": "Malware payload (RedLineStealer)", "value": "3fcefc3a1f33b6b65fbad865823d7bc9a2de40854b0c2da1db7c298e4409e00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400799, "uuid": "a2c0fc77-990d-4143-996b-eae8c490d4b3", "comment": "Malware payload (RedLineStealer)", "value": "c93aaa6071af31a3ddc5e0264be4623175d2e334", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697400799, "uuid": "2e633ac4-a271-42da-8327-dd9d5c753f6c", "comment": "Malware payload (RedLineStealer)", "value": "11acd19d9674258a66b4656318a47159112bbea42e6f81ddeafdd100706c7a03f3120f66f7417b4bee24bea068fc4be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400799, "uuid": "d18fb7af-98ec-4430-8e9c-413a22e44273", "value": "T16E252212EADD9063ECB6137048B603830E3BBDE5A4B8522F63D96D4E0DB26D4E571363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400799, "uuid": "ca72373e-ffe5-4349-989a-fcb5486f5a22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400799, "uuid": "9071729e-81c8-4431-aa61-f22935421964", "value": "24576:5yBOHpB3rrH4q4N37ZOVUcFGtZDfC0Uf/ThK:sBOB7L4zr0V4LfVU/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697400799, "uuid": "541f32a1-28b0-456e-8993-91e3f70e754a", "value": 1001984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697400799, "uuid": "29414366-d0c9-4cd5-ba4a-90372556a9d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697400799, "uuid": "7cdb1356-d6d3-4af1-a590-c6e50767561d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e36772-6b4f-11ee-8907-42010a9c0042", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1697370141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370141, "uuid": "c2153414-8df8-41bf-8a87-1cdd2fb95d31", "comment": "Malware payload (Spambot.Kelihos)", "value": "b4bd03f5c8ea7b2f206b516c5277c91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370141, "uuid": "144e40e6-c100-4cce-9663-358691ae3ef7", "comment": "Malware payload (Spambot.Kelihos)", "value": "406d3c343fac7b3b70790be2ee88c7aef0a43c0aa71ee9e501847bb58df9caa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370141, "uuid": "8aac11e9-8b14-41f8-8f2e-e10b4ee37129", "comment": "Malware payload (Spambot.Kelihos)", "value": "47c80ecdd9d6a59eda1af1c496ae32282406c540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370141, "uuid": "595f63ed-4719-481e-9def-49de22698480", "comment": "Malware payload (Spambot.Kelihos)", "value": "035f66f9d6acc54c5fae20e1b4c20ee09955f091a52a8ac906b4bed712351309422dbb2bd5a827dd315f0e951c42dcae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370141, "uuid": "4ad48071-7a8e-4b89-b1c9-bf0207618949", "value": "T184445B17C2E57D50E9264B728F3FC6E87A0EF5508F497B69261CAA2F04B11B2D673B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370141, "uuid": "60c5fd21-0fe7-4002-9103-1fca470d2840", "value": "f8d7b6f4b1be45f1a7c2df1ba9bbc18d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370141, "uuid": "dc41192f-dfa2-47cd-b20b-b9c1a18c195a", "value": "3072:P+ovvaodNN1cjDoF6qwY6HplbcHhQg3YegRkS3GcMbJ5zVfok:pXaoHN1cjDMSJl+QLegCS3VQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697370141, "uuid": "01668ef5-9b74-49e8-ba25-37935ae7996b", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697370141, "uuid": "5d721635-1fcf-4bbb-837f-efa94337b59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370141, "uuid": "ae74a4fc-cc16-4adb-8189-d62b8bc17724", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8851462-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353393, "uuid": "abed92a0-a42d-4c0d-a40b-7984bd7fc668", "comment": "Malware payload (Gafgyt)", "value": "ea569939697df84ef77572541423324e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353393, "uuid": "cc8ff3a9-de98-4d47-8373-d505f636b896", "comment": "Malware payload (Gafgyt)", "value": "40d882f3dab5a7fc2f65758b4441be4f3684284802b0c0bc0351a79c0150009a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353393, "uuid": "92a3e78f-cf78-49bc-aad1-4c9e554df450", "comment": "Malware payload (Gafgyt)", "value": "2bee3270884e7e75417d84293988701602e2cf5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353393, "uuid": "4f9389f9-408c-4c30-91b7-43586182a496", "comment": "Malware payload (Gafgyt)", "value": "48d1c0e30f4a65813a809d7b69b7c2ab7ad671f1c7fa4511a182d5ef67625ced4898aa8f9ef234f5abce78f1eaaf2564", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353393, "uuid": "d63d6e2d-bf13-4576-a401-8f930ebc6120", "value": "T1D1D3C62E7A61ABFEE169963107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353393, "uuid": "4997c8a5-0bbd-44f9-9b2b-2ce6880ca835", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1J8iEHLfPti2dSImNEz7ugf7hoWlNDsOrj4hs29NA:Kx+/PtiJn8ugN9sEXoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353393, "uuid": "54693e48-c2ff-4296-aa94-dd530e0cb6da", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353393, "uuid": "82372f03-9f09-44d2-9f7c-71cf8c036f87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353393, "uuid": "a6fabc2d-38c6-42c1-99f2-e9b2c5b8d3d1", "value": "ea569939697df84ef77572541423324e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4524d0c1-6b65-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697379319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379319, "uuid": "e3cb6367-3f19-451a-8e6e-2104379e8cfa", "comment": "Malware payload (Amadey)", "value": "d591195f45cdc36f9700ae0a93f62099", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379319, "uuid": "f309af54-fd77-4928-b812-2396b7943823", "comment": "Malware payload (Amadey)", "value": "40dcf0fd647bdaf5c8f77150a70e794dff896c21d23de62731d0ffcc3b1af1c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379319, "uuid": "2911de77-33e6-4029-9c30-5a1eb5c06097", "comment": "Malware payload (Amadey)", "value": "f7bfe728de2fa6921fa731c992b6ced6e7e91b4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379319, "uuid": "866e6906-1096-4cee-9814-26c24ed73319", "comment": "Malware payload (Amadey)", "value": "ddfdfa460e66c2458dfcf65cd9f3e12c0b5e516fc4c2892b63b7c2bbf67edafc4996d4b9a621980ad93f54ab4c072898", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379319, "uuid": "2fca5958-5c01-4060-a915-fe2d2ecd0c58", "value": "T145152391BBF89173D9B4073019F603970A323CB6AD78C36F2788660A4DB3694693537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379319, "uuid": "9ef65aa2-650a-4b12-8a28-e03df53648cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379319, "uuid": "8e733643-6ea7-454b-88cf-883a3af8a5fb", "value": "24576:9yGEck0jI9CRU9z4BuWqA7JOYmSz0uUW2:YGRLRkz4AvCt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697379319, "uuid": "6086e0d2-fdc1-4b56-ad14-82d7814a4a58", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697379319, "uuid": "361ed008-7056-4831-b479-f1a205859694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379319, "uuid": "84f0654b-04b9-4d9b-abd0-0852d4b5dd43", "value": "d591195f45cdc36f9700ae0a93f62099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa180f-6b78-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697387400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697387400, "uuid": "260bf10e-f902-414f-9e0d-2e08b40de5be", "comment": "Malware payload (Healer)", "value": "c2874e64dc4a713e5f1a394c132d9382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697387400, "uuid": "a4e3fc4a-96cd-40a4-9458-ef86aec14c88", "comment": "Malware payload (Healer)", "value": "41f0991208cc07eea00889cb551d4f34f6c640459920bdf3bd09346cb300f975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697387400, "uuid": "626d4dc5-5529-43a7-8d4c-c6a4d0d81dd1", "comment": "Malware payload (Healer)", "value": "f8e8f6448660d3bde3affda3a4534e24d2bd6074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697387400, "uuid": "9aa47999-0f44-4d98-9ef1-6f60cac2054d", "comment": "Malware payload (Healer)", "value": "3ab193658267f855175c4338b08e1b103f3a3297cce9492167d5af1b56be348e6c21222d6cc2d4c62582bd7232aab58b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697387400, "uuid": "3b3fad56-9951-4c11-b180-8f145b0966d0", "value": "T109152353FBDD8472ECB51BB05DFA06830F313CA19E34536B2785A90A1CB3A95A1B1727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697387400, "uuid": "f96eb618-2dbd-4f75-b605-70543ca6bb78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697387400, "uuid": "43a93db1-bdc1-4b18-abe6-1667f43d1695", "value": "12288:tMr1y90Jd4rJMuNnRX3l8dI2YcKoPLByw4yNkz1sLw1m5pPT4zVyc8kvjRMbHaCE:oy44plHolDkz1AIeCzAc9yJIixO+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697387400, "uuid": "842ea90b-77f9-4a7d-9dbc-d8d895ba511a", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697387400, "uuid": "6f8d49ab-f597-4cca-ba57-21a04fe11dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697387400, "uuid": "41db0eaf-a6fe-48e9-9f03-1fc182c08c86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbcdc8a-6b71-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697384463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384463, "uuid": "2d8a327f-da3f-420b-b609-54314f247bb3", "comment": "Malware payload (RedLineStealer)", "value": "06e7a2dbee4c5c99820b3ad55d38bbf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384463, "uuid": "446d374e-3252-4654-82bd-9173abae989c", "comment": "Malware payload (RedLineStealer)", "value": "425285af550de927bc8a7bd7ffbb967a5dbfd12f67c988245f18e4226c31ca1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384463, "uuid": "3f507e22-675e-40bc-88cc-6d614a08ec0d", "comment": "Malware payload (RedLineStealer)", "value": "7f1e8448eefb3db5913389497b149e987cc0fb0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384463, "uuid": "1daa18a2-a7b9-4dfc-9ea7-6c4c8bb24d09", "comment": "Malware payload (RedLineStealer)", "value": "ba3c34ff95b00090e19f5ec75d649f2a8b9c57a005d47055079fc49b916711aab7d551a3f95c62440c429ec147bfe41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384463, "uuid": "a3e1dbec-674c-4157-ae95-bb6cd08bdca4", "value": "T1E01522279BE96937D9F633B44CF712530735B885DD74475A2B88E88D0C73A98A032B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384463, "uuid": "46c98263-14ad-4240-ae83-f96fc62a8bb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384463, "uuid": "0f47521f-943f-42ed-a8f3-21ec55b8ebe7", "value": "24576:EyRG+u4bZ/s2d3ZzftGWmoEHBRWEq+U9Z:TPFE2pZzftGOEPWl+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697384463, "uuid": "7abe9af8-5e19-4359-a982-5c648f44e604", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697384463, "uuid": "40f02c44-e1c1-4ffd-93d8-29e16adba5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384463, "uuid": "8f91dabd-ced6-4f34-834b-53965d59e75d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515987e8-6bab-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697409404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409404, "uuid": "1bd4ed44-0e6c-477a-9e96-f04310085031", "comment": "Malware payload (Amadey)", "value": "204b37dddb11cb6bad65fc3b63cba1f8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409404, "uuid": "f6f7d7b3-6e4b-418c-86fe-72e55b6aec1c", "comment": "Malware payload (Amadey)", "value": "436ba540cfb2904edf0119a022081112ee76f66270d86eaff1bab7598e049f6e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409404, "uuid": "f62c4928-a582-4459-a92e-98284a3f5c1d", "comment": "Malware payload (Amadey)", "value": "0a5dcbe68ae8f150e854556dd09b40a91c998a16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409404, "uuid": "51e40314-743b-47de-a6ed-2591715a870a", "comment": "Malware payload (Amadey)", "value": "d3685744559cdee1dc58016e9db4bf80abd8e8698d77452a04de59261f09f9fd4b013deeb15872e317183f45635a1c9f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409404, "uuid": "45156563-a16e-4146-bfc1-63ce76ac597b", "value": "T12C252202BBE19173E8B017B194F643430636BCA2AD799B6B77865D1A2C73B91607433F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409404, "uuid": "4db6b8c5-306c-4619-af5d-ada4543029b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409404, "uuid": "0670761f-74d7-4dd2-9ce4-2c701b1f10af", "value": "12288:kMrry90hRAVrgK8dEeXvG2MX5JuWhyEvg20dS8rOJC799k7jDLl1BDwbetIj4:Hyz0dvTWJ0ddrOJVHLftwaWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409404, "uuid": "c6fcb22e-94af-4780-9bda-afd80f032813", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409404, "uuid": "cf145752-b096-4b2a-901f-c8d9e074e48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409404, "uuid": "c75bbee5-ea81-4669-b075-8b67e533bf3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db579ed-6b2f-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697356221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356221, "uuid": "2982ea81-3ede-4246-9a27-6f60f38aaa78", "comment": "Malware payload (Amadey)", "value": "63cf9677c44bc01674cb4fecb3c4beba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356221, "uuid": "4a92cd91-9a51-4071-9ad9-fdd1505426c2", "comment": "Malware payload (Amadey)", "value": "46f97dc31eef639f6e30effc4f5daf95d0e10e919d99cdb5e8fdd13963b66166", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356221, "uuid": "5e1ad228-46e3-4767-bb94-ccb67cd1f151", "comment": "Malware payload (Amadey)", "value": "48460bda0367ab6649f1a445fdd6dff667b68bcb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697356221, "uuid": "4589b661-08fb-4adf-a2d7-6cec95085241", "comment": "Malware payload (Amadey)", "value": "879210ccb2cf30cb07f03b6647cf74d971e2951529caf59549398aa5ee5fdf5ff5fe9f2abe24a7390749acbfafb26192", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356221, "uuid": "fc066baf-ad1c-47c7-a03e-09e318a43b46", "value": "T10F44DF12B581D8F2F44581348824CEF866FABCF6D99E498377D43F6F7930382AA66354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356221, "uuid": "4ed295ae-d69d-47d4-a156-d9b3553f6172", "value": "672b81f1197fb8c01c300e40d940875f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356221, "uuid": "485c6618-6d74-4189-b323-e46e723d9231", "value": "3072:CuX5cqVtz4Wv3/wrBJp+t8N3PBSMgmG5BQp3fHU4UKD8rA1PocKIK5iT1TG:fR4Wf/wlJIengnI3f04IriQU5RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697356221, "uuid": "6b9059e2-8eef-45d9-8432-6190778a4cdb", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697356221, "uuid": "9999bc4e-83bd-4e0e-a340-7989049b4772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697356221, "uuid": "5e736d2c-c47e-4e0d-b4d7-ad753aa288f0", "value": "63CF9677C44BC01674CB4FECB3C4BEBA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac43c6b4-6b81-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697391518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391518, "uuid": "3e413142-c319-4a28-be70-77d81c6d542a", "comment": "Malware payload (Mirai)", "value": "8ebaa7c48e9d2387507cd4a8488f6e54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391518, "uuid": "0ec8e91d-095e-43a8-a006-6241574beb92", "comment": "Malware payload (Mirai)", "value": "474a12274d2a11deda2d3152d4905da161fba12ab6e41747861024e0c847e184", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391518, "uuid": "f8fb50a2-43cd-4225-9e60-11bfff30bec6", "comment": "Malware payload (Mirai)", "value": "74009d3e01e57db0010543754dc212a1579c22a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391518, "uuid": "4f1efabb-1ecf-4ef3-9503-2b04386901dc", "comment": "Malware payload (Mirai)", "value": "7c036f06367ac324d926036a1f7743d005149defb472f4a69dfec7dfcbac2e2edf1c9786b5f2795fe5e871e1f5710418", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391518, "uuid": "2d4edd3a-909f-4450-9aef-e1149235d4a0", "value": "T1B3C34B46EB818B03C4D51776BAEF424533239754D3DB33069928AFB43F86BAE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391518, "uuid": "f4c1cd3b-ae1f-4947-b66c-7dd578b64296", "value": "3072:QsC9GTRf8imwH7wgwXY5Fj9JlLmz/QLM/9R2U7:QsCSfhJH7wgwIzjz4z/AM/9R2U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697391518, "uuid": "7c8b5d1c-3a4e-45c1-8aa2-87d157a5558c", "value": 126767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697391518, "uuid": "37f2f0db-0962-4c2a-8fc4-708153245b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391518, "uuid": "60047b6f-5868-4591-9e93-2053200658d9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44822489-6b66-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697379747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379747, "uuid": "ca391261-e71b-486b-a232-ae0931570bf7", "comment": "Malware payload (RedLineStealer)", "value": "65c858085dd37720377ad460638406ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379747, "uuid": "c2f12996-096d-41e0-a001-b3fb9fd7b6f3", "comment": "Malware payload (RedLineStealer)", "value": "48e3664b47d3e12de3caa158e85dff0411abbc4a58c8386f209bdb599431eb99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379747, "uuid": "b45d8d94-51ee-402e-84ce-9f779caac0b5", "comment": "Malware payload (RedLineStealer)", "value": "66a8972647584ef07180d39182f25baf84c0b4ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379747, "uuid": "685c8268-9aa3-4395-ba03-2907aabaa124", "comment": "Malware payload (RedLineStealer)", "value": "8b56a75b4abcc87b74151b1fbdd555387de86dd302e75ac1b390b4372942d6360a5f1fffb91540a1a4d1937e817a4de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379747, "uuid": "82ef4524-f0a1-4d59-8168-72ae6a3ebdc9", "value": "T1FE152316E7D89533DA7927B01DFB21A30A36B8611C70834B378ACA6B6C73595D272337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379747, "uuid": "3b9adde0-d998-4ad0-890e-93f59bf972ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379747, "uuid": "cde8e76e-4ba2-4aef-852c-301116b20d79", "value": "24576:ty6n8OtLFBUNQppuRx7HClCscEVSQSXz:I6n8qFBaRx7HCgscE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697379747, "uuid": "6bfb59fd-4a58-4d47-94f4-e72ecc503040", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697379747, "uuid": "eefd1d47-35fc-42e6-9381-b51c71b4168e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379747, "uuid": "37914a6f-df8a-4a52-b690-77b73ed04432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba3e12f-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409743, "uuid": "7f9e5d81-f69e-49a5-bda6-905641db005b", "comment": "Malware payload (Mirai)", "value": "638d227eb89414a5ad0e71f7ba596b14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409743, "uuid": "52e37966-9f4b-42d5-905d-1cfceeffc04e", "comment": "Malware payload (Mirai)", "value": "49964d2b1c2971b54138a71b401ded430fa4ba07a2f64af2558b9161e7e76856", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409743, "uuid": "1bcd58d3-f26b-45c2-9c18-74cd97badef7", "comment": "Malware payload (Mirai)", "value": "de68a8d5c99c709c4cb5d6d625eb8fcac7c92b72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409743, "uuid": "ce8e4921-7606-4359-b795-974abba6b439", "comment": "Malware payload (Mirai)", "value": "0d1e8c2c14879059e2a877228f4b8e344885fca34f93dd0db0569e21fcdec9285a250804412ba4c52bbaae1784d3c58b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409743, "uuid": "b977459a-5a12-457c-9225-4a85252ff7a7", "value": "T198A2D025E345AEF4DFAF9DA056C2C2C276F547C6678AC8F240EEBF012906042F789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409743, "uuid": "495221d3-cca8-4b62-9046-68963c932483", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5JM4uVcqgw05VxJL:MRxsSVsMD6xiJJE5zRWNw4uVcqgw09l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409743, "uuid": "5d810ac8-3697-41bb-83ad-271aa9bc1d5c", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409743, "uuid": "5c6a1241-bf7d-4c36-9c06-5a755ee0e1d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409743, "uuid": "43dc729b-7ba0-4026-94cd-1e82788c2ade", "value": "638d227eb89414a5ad0e71f7ba596b14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67736f8-6b99-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697401923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401923, "uuid": "5398ddad-e7a5-409e-998b-57b9ad5bdd3e", "comment": "Malware payload (AgentTesla)", "value": "14f782ec17cbdb9eda8350ca3c5dc7c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401923, "uuid": "d40be8a3-63c5-40a3-b47a-3ad3625de320", "comment": "Malware payload (AgentTesla)", "value": "49eb0e1d879aa770609e7632bd6840613d3c682b330c6e78b6e69bea0b53fabd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401923, "uuid": "f095c4f4-ac2f-4f42-ac8f-88d04cdd7b44", "comment": "Malware payload (AgentTesla)", "value": "fc27c35af8091f4e0ba6c9f5359b114237d8295c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401923, "uuid": "67dd45b7-ef03-48e4-8e9b-c64fa436a01d", "comment": "Malware payload (AgentTesla)", "value": "6a33ef6bdf1319f561ab20fa96f7c44b8193ea2b8289dcb9ff4ef8af95707ee2a6de77ed36c5357b2358f43dd22f700d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401923, "uuid": "c27468f2-1f0e-4ca5-a99b-5e82424c2148", "value": "T1F1157D3D1CF952278165DBA6CFE9C473B008E46F31A2AE6594D253A68347E4339C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401923, "uuid": "11d86ad8-9b10-491e-9f9a-e5e1887963dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401923, "uuid": "f7f4da8d-51e2-40c3-ba30-d0c1470bb717", "value": "12288:voSZp5zjDAvD4h927tmecgGugHIMO7p0AJcba:voSf5WsqtmecWIAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401923, "uuid": "503c41e8-c2cb-477c-8e6b-d0d1a4433298", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401923, "uuid": "891489e4-5d34-42be-934a-34fd58c53bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401923, "uuid": "777dc6d1-7c61-4c6f-a3bc-c80b73ebb730", "value": "SecuriteInfo.com.Win32.PWSX-gen.19590.18724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6a422b-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353346, "uuid": "37771af4-72b0-49fa-bde0-e3bd2fdcd720", "comment": "Malware payload (Gafgyt)", "value": "0e5e36229f5606971098254aa1660bfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353346, "uuid": "68ef8eb5-6e81-4b18-bf9c-4b44ba10694d", "comment": "Malware payload (Gafgyt)", "value": "4a8cb55cbdceb8ce28793dfd84606a183417a710c120dd99e8b66d4f56149331", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353346, "uuid": "697c4d8c-e1ba-44df-a18d-de59acf0c8a1", "comment": "Malware payload (Gafgyt)", "value": "6a29b959aba3192169286af1fb7138996a1ba847", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353346, "uuid": "2d7bf884-da09-4a0b-bf66-f996f32a48d3", "comment": "Malware payload (Gafgyt)", "value": "5928c256885f03666b42f66c703ba690086cdc4927f9075881cad11a44abdf5cddc0348835a25bb24f20e971c3939817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353346, "uuid": "28ad1134-7c1c-43d0-ba91-b5315b5ef3d2", "value": "T1CED3D617ABA15DBBD80FCE3302E64521109EE49613957B6BB178CB1CF74BA8E09E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353346, "uuid": "c071cf6d-4f93-497b-b55a-fd9eeb57e133", "value": "1536:76ejNyUhayRB4pa4ggYJ7vOTlv7xhxPYsXm/KBgvYYiCh:74yX4pNLdlhx3mCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353346, "uuid": "9935c664-29c9-41c6-b381-438fa48caa16", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353346, "uuid": "9287ba15-1f7f-4220-91fe-d416ac901b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353346, "uuid": "5975f47f-b6cb-4694-8288-89a633c2eecd", "value": "0e5e36229f5606971098254aa1660bfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c3e8cb-6b5d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697376119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376119, "uuid": "b60791d8-3d27-4828-b400-11122ad165d2", "comment": "Malware payload (RedLineStealer)", "value": "4340a2d8ba5490be0aac83049bb1dcc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376119, "uuid": "0d9c8ab2-9c8b-4374-bdca-8499295d61b2", "comment": "Malware payload (RedLineStealer)", "value": "4d2eb762ab2e72eb4a8f4822eb94cdde81fee48e7b7320fd7635de2edb7ca5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376119, "uuid": "c84e0c7b-062a-4f96-917a-9e886582704f", "comment": "Malware payload (RedLineStealer)", "value": "f34d64edd1307598e1adc5e968dc23dc68b81821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376119, "uuid": "803d53a5-7c5c-4261-be49-ca1bb9a965d9", "comment": "Malware payload (RedLineStealer)", "value": "e0f9004ccff9fbf68e7a4cf1fb3ae55c743c16837331c42a9ba4bb546582661444c320b505d17dfca52c987c39762d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376119, "uuid": "c612be3a-3a23-45db-a866-349d0e1fa17f", "value": "T19C152217E7D84063C5B15B705CFA03E71B32BD928E64832F2748AA6E5CF2680E536776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376119, "uuid": "7be7c1a5-1376-4da9-b95c-da18273ad919", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376119, "uuid": "8715a08d-0e7b-474d-9c13-305204646eb5", "value": "24576:DyS4+nN3lQdpq/6SWlG+6W3LE5nuNZJzPb:Wp+N3lQdpq6l1cuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376119, "uuid": "b2fe5305-d023-4e39-859e-c28db4dbd116", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376119, "uuid": "da7d7c4f-6d03-48d5-b592-bc6bbd9ae963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376119, "uuid": "0b7f6163-d63f-44f5-93e6-3d9cd48f2aee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2717a0-6b22-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697350586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350586, "uuid": "e19811a8-4553-450e-ab77-80aefe68aa40", "comment": "Malware payload (MarsStealer)", "value": "fcd9ca1ca87a23403a8a8a8c064bc7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350586, "uuid": "6ef4f1d7-8d5f-4ae0-b0a0-12c79f23ee21", "comment": "Malware payload (MarsStealer)", "value": "4e93192fdadcc595094e30f1173867abf85e2fce78a90585268c52a3924ee002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350586, "uuid": "f5aea20e-f14d-4227-9884-68a0bc19d3dc", "comment": "Malware payload (MarsStealer)", "value": "7a6ba817e6e0d16822d945834db0c3b1b795e566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350586, "uuid": "cca245fd-3a7f-4bad-a256-c82f5c0b8087", "comment": "Malware payload (MarsStealer)", "value": "77c241d4a50c43ed4825f77fe063a6898b963fb1ee95a00af02719346a8f8e3c7c5663b6413a999d129a875b9d92b2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350586, "uuid": "1bacf7d6-15db-4b36-8449-716a668d6e68", "value": "T1F4B6492439FA501AF173EF7A8BE4B9DADA6FB7733B036469105103864723A81DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350586, "uuid": "b70d73e9-fdf2-4925-a4a5-b912d80221f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350586, "uuid": "4219025a-8c56-4dd1-a5c1-609903020209", "value": "12288:GV0zkc6jN5fWgxarK4X5EYGDVCBnr98KFslI0QnUpmA:fg/xt4EVEdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697350586, "uuid": "14b61968-3eb0-49c1-bf32-78e16f594072", "value": 11016896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697350586, "uuid": "00f1703a-52c6-4e8b-b47d-fc84097d92fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350586, "uuid": "e7ec461f-2a1a-4145-81b0-cc5f2040eb37", "value": "yanbaosou.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eae0cfd-6bae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697410580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410580, "uuid": "73418118-5d5b-4f6b-badb-4e25836b3412", "comment": "Malware payload", "value": "8288a37182d6ff45b953e95892b08eb6", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410580, "uuid": "cbe5f324-f91d-4d3c-bdff-aed567424e4e", "comment": "Malware payload", "value": "502bb11fe82d488f5bd39b66263ceee44dd4232b73bc41fa7b9e3c71ad9d8c99", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410580, "uuid": "2d27c3fd-fa68-4bb9-b81f-ff4452cd3057", "comment": "Malware payload", "value": "5d9d3dbe5b3ac12d48e8fd00a59432850bc854a1", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410580, "uuid": "36f65251-fe43-4a64-83d9-725036bce37f", "comment": "Malware payload", "value": "684754a80c6c0190013b1d06eeb3d7d14ffaa2c2fd427df486ea1ba4592a61f0bc8d16fae04808bd83158c189590cd69", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410580, "uuid": "256c6cb9-8c3a-49fb-b612-d50ebdb3ea4a", "value": "T1D703BB35321F16BA8F62211BA07DC25599ACC2635C01B07D78AC949DAFCC44EA2B76FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410580, "uuid": "8c786bf9-69c3-4db1-814c-bc9428b8f053", "value": "768:ArKS7t2vyI0cWcIrCqoOT1HgJlC3HM9g1KBKdJE:A9CbOT1HgJlC3gQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697410580, "uuid": "587aac19-3980-41ef-b1c6-9123e6593f3d", "value": 38241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697410580, "uuid": "6f6e76cb-7af1-4b63-a097-e25677533ba3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410580, "uuid": "3b642cbb-6507-42f7-b6f9-af24945f5696", "value": "77d4d072bd33e659fa53208e60fd26e748b72730ab05c439a60e6d08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96063ae-6b67-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697380399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697380399, "uuid": "caa5a5a8-9f46-4157-9514-010ed0167d77", "comment": "Malware payload (RedLineStealer)", "value": "b6e53965347c7e8359fe0db03a7d905b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697380399, "uuid": "7bcfcd45-8d03-41b4-bd7b-b29cf5ced01c", "comment": "Malware payload (RedLineStealer)", "value": "50b1825f16b82d77b03de5fd34e4de8466608ac4c04954115cf5a7bbc3fe6d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697380399, "uuid": "5df87a1d-b31d-4a74-becd-489c5388c28e", "comment": "Malware payload (RedLineStealer)", "value": "cc2b7e798494ff27d754a51951d3645d25b0f6bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697380399, "uuid": "d7d0c502-980b-4332-a547-ca1de652d15a", "comment": "Malware payload (RedLineStealer)", "value": "4cdd30fda5b905d1d7f2e9ccfa523d25a2038dd61a2e4f7748382133f40f7d06d841b3cdec901d56c32f55646b9c433f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697380399, "uuid": "50a2b339-0d84-472e-bdd2-9bd2ffd7f879", "value": "T117152246B3DD6473CEB28B7089FB06830B36BD528C2183763694996D1DB3B91997133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697380399, "uuid": "7fbb908f-87d7-45d3-98bc-592247d079a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697380399, "uuid": "9c9e9f29-9018-49b8-be5a-c1e885dcebda", "value": "12288:FMrVy90o92e1ceqmk8RMLjnIc04b5pvA9ZuqIk82kL1tGAVXPrnwtvr6ukvxyapI:4yN9gexVsnI6vkKukL1tlVLUT6vs8Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697380399, "uuid": "7369ac7e-3eb7-4df6-86b7-3acdee022fed", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697380399, "uuid": "7b0b5484-2176-45f7-9727-44d0d07612a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697380399, "uuid": "5ad1dff1-ad40-4902-b56c-25403f1169a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b3afda-6b22-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697350572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350572, "uuid": "3d163f33-ec4b-450d-b419-43f1bea2db8a", "comment": "Malware payload (MarsStealer)", "value": "cfda6fb742d5b3e7e9cb05f5c97cd467", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350572, "uuid": "f54b5354-50c8-4dd0-b75c-22090a646d3b", "comment": "Malware payload (MarsStealer)", "value": "511a3e2b12f7ddd019bb50bdbf909c1da8fb6b5bfb9f3faa4726684e4dd96896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350572, "uuid": "620a7fcf-8e78-44e7-815c-e28f4eb9816b", "comment": "Malware payload (MarsStealer)", "value": "94036f8e62d62dcf7c45db9e1497632dca8f9f57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350572, "uuid": "148a5e51-edf4-411d-b660-5578910ed0ef", "comment": "Malware payload (MarsStealer)", "value": "beda45589681ef579f1fe4a7a698e99b29259183601780d0a0b07fab4f6d5601f8d5d3d768930dcd8a0d751356e6f112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350572, "uuid": "4854d91e-8e5b-4f8b-b72c-f4df63af28eb", "value": "T1F566592439EA5019F173EFBA9BE479EADA2FBB733B07646D105103860723A41DDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350572, "uuid": "3f7037ef-ab98-455f-8f10-161d6eeec258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350572, "uuid": "56c08928-3b56-49d6-abf9-0c636a102341", "value": "12288:S410pD8x2Oh0bP8XDJtAG0Qk5bdKjtPbZ2ZbmwxZ4e2qTQ:RhlXn4i6cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697350572, "uuid": "be507363-4ef2-486c-b80d-b9b04d991fcc", "value": 7000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697350572, "uuid": "b1902db8-ca00-4bf1-8fc4-7a5772803691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350572, "uuid": "111f0001-826d-4aa5-b9d6-d401e5f09962", "value": "KinhDown[\u81ea\u52a8\u66f4\u65b0\u6587\u4ef6].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19331a86-6b87-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697393848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393848, "uuid": "3333d23b-26eb-499d-94a0-6e6b398d794c", "comment": "Malware payload (Mirai)", "value": "92daa497b5b38ccc439115aa7de369bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393848, "uuid": "1a0e0727-a1bd-449b-8c4d-651436d27597", "comment": "Malware payload (Mirai)", "value": "52259592571a1e0f69f39f45f8994e000e5eb9d42491138f225436748068c266", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393848, "uuid": "eef6046c-9fc8-40d7-84ac-085b358fbd62", "comment": "Malware payload (Mirai)", "value": "eb13b0b21b1be4fb8eed6b9d55361c49a6c6db2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393848, "uuid": "ee1f9e44-0bef-4e54-9d93-6840637a39d6", "comment": "Malware payload (Mirai)", "value": "f568603b452048db82af5a718662d77d8bdc80ef2e2c07ee62c73f0fb6bad5a9665c9d4a34e100344334fa7c56ce2979", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393848, "uuid": "8add2a25-520c-407e-8939-74d10faf9edb", "value": "T1CC737CD5A643E8F1ED1601752077FB339B72F439102AEB87D7A6A533EC52601EA0B25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393848, "uuid": "9010bdb4-fe08-48c0-b8a5-60762cefe9a7", "value": "1536:QMvalZl4Z8PheEYZLWt0gvTxKJPPrUlH3N/fMg4zdzvlqB4mS/J:QMybl4Z8PhBC2TxKJPP4lH3Cg4JzQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393848, "uuid": "ddbe5e7e-0770-42d1-adf3-3f5400fe19fc", "value": 79028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393848, "uuid": "014a92a3-cfcb-4cb3-8561-53b49390f4c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393848, "uuid": "a5fc1f57-f363-444e-af8a-04e393ac0ed3", "value": "x86-20231015-1817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6357bd46-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401274, "uuid": "1d96e974-506f-435e-9530-968e344db8c2", "comment": "Malware payload (Mirai)", "value": "12463c6b62b26f082396ef30ca2f141d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401274, "uuid": "156626b8-49c8-4672-8b69-a1050b5d25d9", "comment": "Malware payload (Mirai)", "value": "52f5d0c572089efcd6ad888249c92291dd465aa14437eed57b74262af077d85a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401274, "uuid": "eabfdbc0-36d0-4b45-a7ee-491a0e1ede2d", "comment": "Malware payload (Mirai)", "value": "130ed721123a866db7679cbe607ea654a95d49bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401274, "uuid": "321d8839-3f25-48bf-92a4-230b5cda1050", "comment": "Malware payload (Mirai)", "value": "d0fa6609b6923618f966bb60d273cbf653a3ac5f72e1b0a8452a1e8f3814716b03a2542850699d99f557bbc7a714938f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401274, "uuid": "e3471039-9902-4534-85b6-b4f61d70eefe", "value": "T12A03E992B8825A6BC6E013B6F6BE119D3361B7B8C2CF7227CD115B157B8851F1DA3B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401274, "uuid": "650c0250-9d5b-4daf-b3fb-8651b1793f3f", "value": "768:183D5QfXq38rueMDcgagjElbb1nJpaoUikiKoRu+wRK:18SqsruJghb1aoyiC3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401274, "uuid": "ec9b4472-1163-4cf5-8ab7-e458ea389ea8", "value": 40784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401274, "uuid": "485268e0-2f87-4120-8523-1a9b0915659e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401274, "uuid": "04bade0b-b1e7-4f8e-a838-ded5d13a8957", "value": "12463c6b62b26f082396ef30ca2f141d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcf5e1f-6b5b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697375122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375122, "uuid": "5476c4db-e774-48a0-82a8-82ded76f13e8", "comment": "Malware payload (RedLineStealer)", "value": "1c21609b0d61d2bdb6dd718ca71e0ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375122, "uuid": "23c75f1f-ce96-420f-80ef-82db4f0613d3", "comment": "Malware payload (RedLineStealer)", "value": "52f9858d267de6bd71707c083cd0e53543b1847c194314009f1e6ea3bcd84c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375122, "uuid": "e82585ec-e65a-4c71-9018-f42b32798d17", "comment": "Malware payload (RedLineStealer)", "value": "aef6b786e863267342c9025c239b815858f6f40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375122, "uuid": "1c9a535e-201d-40da-aee1-06d72ae81e3c", "comment": "Malware payload (RedLineStealer)", "value": "7db0f5f2c154979f132fcd91b4f04521fefff3d598a979e2095dce22caacc68abc7431be7e22e745c8fdd03dddba30c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375122, "uuid": "9b4af02f-b51b-420b-a3aa-3a024a56f57c", "value": "T182443913C2E17C50E9264B738F2FC6E87A1EF7558E49776A261CBAAF04701B2C663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375122, "uuid": "7990f0a3-03ed-4367-9394-655d0b1c90b0", "value": "2f16a3a753ec35e9c4b47871bbc2a2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375122, "uuid": "77692de7-faf2-442d-9459-e3c19078df57", "value": "3072:g3sLUBrKBIGVMUNaL+KSMhGUcITejk55TGRZzlolrD:PU5KBIG7oJSMw5oegPAZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697375122, "uuid": "fc753c13-f7ff-490a-9cef-4808d5ae73f0", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697375122, "uuid": "9a946953-7857-456f-af34-1046884746fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375122, "uuid": "60d14dde-5cdc-49a3-bfd7-2f40dfa8786b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddfad1d-6b10-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697342960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342960, "uuid": "b5e3f72c-f2be-49eb-b05a-32bac2e1a532", "comment": "Malware payload (AgentTesla)", "value": "91f7131a6d562c0174fa1390e6c6bf83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342960, "uuid": "9521101f-6c29-4d12-af1b-f2eea04e0d7f", "comment": "Malware payload (AgentTesla)", "value": "53b8393fbbce738427c91ba6d5f16f8a98a63d943dd96470ae3d83cf80f4ac21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342960, "uuid": "d63ad931-ada4-49a4-b61a-f71421eff6cb", "comment": "Malware payload (AgentTesla)", "value": "34b3e3c890d768c00a51d77f53e4af2cfa8372fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342960, "uuid": "54a033e2-4f8d-45a5-a267-6a602ea3cef9", "comment": "Malware payload (AgentTesla)", "value": "c12033b2b77820540399eed8e2169b3edcc48591f23ae4840a7d936544c285b7f8855e90b8ca3e4e331160f2622b0c31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342960, "uuid": "51baabe5-879b-4299-94a4-8a358d50ea01", "value": "T1D5E6492439FA5029F173EFBA8BE4B5DADA6FB7733B02545E1091034A4623981EEC153D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342960, "uuid": "d488137e-657d-437b-a117-f6055e56e679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342960, "uuid": "01526884-dde8-4cf7-a942-613ad91f0df5", "value": "12288:VcPnwSwrtP+XW30YWM17vTPxd5QyLPKIwa1prQrdqhu8osYyEGe2VIWY:MnlwrtPZvqQc4lmR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697342960, "uuid": "1e073622-1c94-44ff-a62d-014737889eba", "value": 14000000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697342960, "uuid": "fcea35a8-f176-4e5b-9d65-98ec65783702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342960, "uuid": "db668dc0-1ddd-4b50-a178-041968024f23", "value": "\u041e\u0432\u0435\u0440\u0432\u043e\u0442\u0447 3\u0414 \u0425\u0435\u043d\u0442\u0430\u0439 \u0410\u043d\u0438\u043c\u0430\u0446\u0438\u044f Overwatch Hentai & Porn 3D (13).mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510d8b37-6b0c-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1697341113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341113, "uuid": "c1318a5e-6376-4db9-b342-500fd558266c", "comment": "Malware payload (AsyncRAT)", "value": "364f359c976d170eeec1d59986ef25bd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341113, "uuid": "009f0386-bcc7-4fea-9077-31ebf6001568", "comment": "Malware payload (AsyncRAT)", "value": "54f07a632a4cb325a1a82ec9dc5598bf0df898d65bd7ad885fbb6901357704e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341113, "uuid": "56bf0139-d7a1-4ac1-887d-66371e1f127d", "comment": "Malware payload (AsyncRAT)", "value": "7c1a6eea1bf9cf0467310bd590f435df7a579f78", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341113, "uuid": "90dd7e56-3365-4f11-8a4d-b562674314e8", "comment": "Malware payload (AsyncRAT)", "value": "82136108b841df257ae90d90b251d999ab98a54bc33de2b7970fa91681fd16d6fe5cde7534aae7f86634cea7cf9ce35c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341113, "uuid": "7232f82b-807b-4b9b-bc70-7b8752bb6e80", "value": "T1B863F7053BF8811AF3BECF7469F2658546F5F56F2912D95E1C8900CA0622B829942FBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341113, "uuid": "36d5156b-0d28-4b1b-b5cd-c5377eef1d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341113, "uuid": "afc6de14-a4ac-436d-a45f-f316f9790f29", "value": "1536:ymfuSa/dSkDVMKuJUYFky+PjJO7Nbn4MSkdEe7rPlTGix:ymGSa/dSkOKuJUYF+9cbn4j8EgdRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697341113, "uuid": "ef714255-9658-45e8-8e70-4da0a58a28fc", "value": 67584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697341113, "uuid": "d0a7bd55-c3f8-42ac-920b-fbc6ba700de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341113, "uuid": "5bc08588-3f16-4d20-9355-838dd8c4ee9c", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e353eb-6b6c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697382268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697382268, "uuid": "11ab6bd3-aa24-4f46-a6b7-3325fd876f7a", "comment": "Malware payload (RedLineStealer)", "value": "719fba83d0c2a0617cce99cca6c44efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697382268, "uuid": "24441f4e-5ed1-4a52-88a4-6a5c0392b96d", "comment": "Malware payload (RedLineStealer)", "value": "552cbf920140219f8c82d470fcf6eb9a49b5d0f4d9f336e2f9af30591bcccc81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697382268, "uuid": "617f29a6-bfc4-4032-ad48-38d14ad52f80", "comment": "Malware payload (RedLineStealer)", "value": "72899b462026db9e15ea65cb4cbcf42d4eba49a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697382268, "uuid": "88c09722-adc0-40d6-8f81-18b120d12e39", "comment": "Malware payload (RedLineStealer)", "value": "39ebfb764dfee9f30ede6228ff5ffc59ad80363ab7e6922ecf7a4b0cdad701697062a1979cd08bd28aae46700dd8cf70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697382268, "uuid": "08f5c802-060d-45c2-ba8e-f0481b97449a", "value": "T119152283A3FAC025EDFA677008F70B935B317D5548B8A7572654990E6CF3984B53233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697382268, "uuid": "a8040091-2049-4514-855d-d7f9c04fed77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697382268, "uuid": "e601ad6e-6428-4050-8261-587255cbdc01", "value": "12288:kMrxy90GrlSuUVHd7saGNBdRiLnb5PWKAPAf2Rwrne1d8SKFqU2WQBm+oX:9ytiHdg7K9WKeHRkn4aVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697382268, "uuid": "7e641c92-d3d1-44bd-b32d-c877b06409e1", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697382268, "uuid": "07db6fc4-3d06-406e-b7f8-b24808dfab30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697382268, "uuid": "b098d467-502f-4535-b05a-8c30205692e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccec3a0-6b76-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386874, "uuid": "7c2a7c9d-56ac-40e5-b2ca-19ea0b7804db", "comment": "Malware payload", "value": "433a90c27018c259579e2a72f802bd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386874, "uuid": "63cd5c04-8c13-4b1b-b3d3-257e2d6979ae", "comment": "Malware payload", "value": "55377c01fe10fc33588f070e73b274f925351bcdf6e916579b856dc970db34e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386874, "uuid": "6b77b1f3-17fe-40b5-9cf4-1838de3beef5", "comment": "Malware payload", "value": "a6c795aede725944ac53e7d48f8135baef0db9d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386874, "uuid": "bed13d8c-579a-4589-9774-45d8a65034b1", "comment": "Malware payload", "value": "7cee4a2352622093ebbe4312f3eb0b36547e3f2b22c8b9ed5b7e412a868b67d9ee243c7285b9579514554816d8baa2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386874, "uuid": "ee1a89ae-9297-4c0c-b1b5-ebbb342295cc", "value": "T1D8C58D5B9960DF2BC3A7293952D7E93A2390E535F315E74F0A4C35A884C2176C8F2BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386874, "uuid": "7832f5c8-f6c0-4410-ac40-2f16eff39c11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386874, "uuid": "d11451d7-e848-4fab-a19b-e8c6d21acf6f", "value": "49152:s5eVyAGM9/wFMYzpkWVymtFa1bXPDK30Hoz:bwFZGmymSJ7Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386874, "uuid": "40e3bf76-2bf7-41e7-9e92-40c4cffed3e3", "value": 2619904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386874, "uuid": "f335c2ec-0dda-4775-aac4-a090cb49cb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386874, "uuid": "38b015da-226f-4d51-a2f5-a42ae7ca4788", "value": "433a90c27018c259579e2a72f802bd8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85214c22-6b65-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697379426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379426, "uuid": "4eb59408-8e2f-497a-98cd-fc518032f35a", "comment": "Malware payload (AveMariaRAT)", "value": "7a8e33f0dbb14f9bf7dffe1be47bebc2", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379426, "uuid": "d55d0532-f3e7-4903-b8e2-0f6030560ce3", "comment": "Malware payload (AveMariaRAT)", "value": "57002c7d67a22b0011d3ceb4409c06dea20b25116ae50c97c84b5cc8d19e373d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379426, "uuid": "e045d384-8d91-4686-8310-e8442599cc31", "comment": "Malware payload (AveMariaRAT)", "value": "d9a71511fb0fdb841c42ba524f720c085d661719", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697379426, "uuid": "d07a2a11-8527-4387-8cf6-1921882b21c3", "comment": "Malware payload (AveMariaRAT)", "value": "a64306114f3c8ba0df234d23a62ef95fa75018a8bba6cb7fdc62ecd56721f2e779b8bd06bfede14166e1de79618dcceb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379426, "uuid": "669a5aea-fbab-4454-962e-bebe1e43ba61", "value": "T1AB44AF9277888933E316DD7784226AF09A7AFC304FB858CF434498BB49647F14A3AD57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379426, "uuid": "c656d697-f8e5-4ee2-b2b1-ff1920d9b843", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379426, "uuid": "6bccf853-4179-4e78-bb34-e68a7fa688ed", "value": "6144:fZEe3bpi5aaYnQQZ+RJI4t2mm3IriBPSY+Bx+0H0I8TJn:fZEe3OQZ+RJI4tQ3aY+BxpUI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697379426, "uuid": "9d332448-9766-41b7-a34f-7244f95baf1a", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697379426, "uuid": "68168a32-b4c2-4c62-87ac-34b8bd194a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697379426, "uuid": "cae8d948-bb8b-4754-985b-5f9de6dbd19b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5300524a-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401246, "uuid": "00cef540-2c4f-4e8f-9807-3c10229268b7", "comment": "Malware payload (Mirai)", "value": "578a9de3433d248008564ddc6d320c46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401246, "uuid": "0f4e95a7-4247-4240-894c-56407f7cf5f9", "comment": "Malware payload (Mirai)", "value": "5822a1bf8295c332c1f339e0636b18c953105efbda230afc0e339ea048278dc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401246, "uuid": "e1bbb215-19f6-41f7-8103-7a2d7aaadd47", "comment": "Malware payload (Mirai)", "value": "1b4c1f97d4ed183382b4303235b1beaeac241f44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401246, "uuid": "51ada656-04d3-458b-a4eb-0b0b1a14a546", "comment": "Malware payload (Mirai)", "value": "64d44f6f7ae28b8fd47dd367b7e96fd5e28ffe07331288d56d9c5be9e271e296692c554c2278df8e83fc5e9c2c3682d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401246, "uuid": "281c31c7-52ab-4e3c-8741-42dda8a306bd", "value": "T10A63C545BF650FF7DCABCD3309AA170128CCA61B25B97B367934D828B50B64F16E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401246, "uuid": "9c61393a-6f4a-4700-adca-dcfea3015021", "value": "1536:uwYYxx144FPcxtTo0R8YRtP0rZefp/rVNR:udYxx144GbKrENR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401246, "uuid": "bf0dcdf5-9b4d-4373-98c9-82dc6a13c612", "value": 68588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401246, "uuid": "72ec4f54-8361-47db-95cf-0bb9b1ae6abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401246, "uuid": "b3ce86ff-88d8-422a-a18e-ea82ba05f607", "value": "578a9de3433d248008564ddc6d320c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557542d2-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401250, "uuid": "9346ec76-bc30-47a8-bc6d-1d971f8c3f00", "comment": "Malware payload (Mirai)", "value": "53b7400b903da03503adb889d2a3e1f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401250, "uuid": "27178f5d-48b2-4da8-9c6c-22158318e0c6", "comment": "Malware payload (Mirai)", "value": "5958afdbd11a7aca511baed179840f08001a52c7dccff53a05a90737a4cb8813", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401250, "uuid": "7095c78b-91f5-4c51-8736-bee77ab62d8f", "comment": "Malware payload (Mirai)", "value": "accaee41147d1859aac4b029cf3fa389e78364a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401250, "uuid": "c79b925d-2a45-4fc7-91e1-0f6a681f92b9", "comment": "Malware payload (Mirai)", "value": "ca8300adbbd0193b474dcb6619dbb71ce2ff4a53ec48317afe7aa909e6bf8095df28d234beab93b984a6c40077fd1d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401250, "uuid": "ee66514c-269b-467f-915e-89abe326ddc3", "value": "T1B2236C7BC46DADD4C2554374F8358B780B63F40891632EFA5A5A8562C04BEACFA0A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401250, "uuid": "51e9a7d7-7332-4163-99cd-31beed6083cf", "value": "768:1VaKHwtaYnbiweoioUlcA4GRbsRqwpSR17no+FJUQlCjIwRi:1Vaqwta652H3v7o+EMCjJRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401250, "uuid": "d4a8c68b-0778-48c7-82f4-8b3ae1200022", "value": 46736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401250, "uuid": "d56415a9-4f30-4ae5-83fa-2065e6eb241c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401250, "uuid": "fb805463-f113-4611-8d78-fa2c15cab72a", "value": "53b7400b903da03503adb889d2a3e1f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f26f70-6b32-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697357414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357414, "uuid": "882b8d0b-c330-4d5f-a12f-0e24761a3735", "comment": "Malware payload (RedLineStealer)", "value": "03e449f63d785e3624939ea63d02bfbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357414, "uuid": "91db118f-4a0f-4bfb-b465-9258e178132d", "comment": "Malware payload (RedLineStealer)", "value": "59db4005a4d2c815438fdecae26f0776821d1d9bf74734997c06da03eb20397f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357414, "uuid": "81a724ec-efd5-4bf9-bce6-e2385f1bbbd8", "comment": "Malware payload (RedLineStealer)", "value": "5a6fd0038127a7c002b2292d1700455321ced780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357414, "uuid": "3bcdfda3-72ee-434f-bcef-de9371ee8c02", "comment": "Malware payload (RedLineStealer)", "value": "989ed563114d1ae03628f650e42c32021041cf9415d1b4c9a9bcd99c2ee9ab9b7c47788fcdc4fdb5fe638faff126dc66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357414, "uuid": "6ec5e7fd-4f55-4dbf-ae17-f3bcfe7a3711", "value": "T1CC152382BED58536DCF65B712CFB03D30B227CA24D78425F1755592A2DB3B84A231B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357414, "uuid": "2c517e3a-2ada-4adc-a106-6ea44a5af59f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357414, "uuid": "913bcf07-c91c-4700-a879-93b69e2ff021", "value": "12288:6Mray900Zdrc+DipH/gi+oLzshl19WN5CLS4DiqMkPqA+VxEnwcYRz7G0NihjWw9:4yR1Pipxih9WeG42qNP3kxSwziSioWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697357414, "uuid": "d47a73ca-d40c-4802-a982-7909bcbfad5f", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697357414, "uuid": "b00a4626-dd8e-43c3-8317-cd9f62619f53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357414, "uuid": "71d7b4cc-8dd5-4ff1-8266-880c1b06341f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8391365-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353339, "uuid": "22a85006-f469-4af6-8694-7b58a67d4d46", "comment": "Malware payload (Gafgyt)", "value": "e470228f1ed004abac56b9fd6cdfc8df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353339, "uuid": "ca437372-02d7-4ac2-a1c3-c07e11635e56", "comment": "Malware payload (Gafgyt)", "value": "5a258ef3c2d71f9df9b38ebf50eeef82c62a011a6279475556185a108c49213c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353339, "uuid": "7f4487a6-a0d7-4da6-abb9-3aaf505f826a", "comment": "Malware payload (Gafgyt)", "value": "b196af4eda0262de250e65e6a686a3f196b7656a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353339, "uuid": "3fbed165-8b0f-4d85-84f7-57703c02912c", "comment": "Malware payload (Gafgyt)", "value": "b52ab27beb9801a4ba745239518724d64c22bd2d0b53ad0a8cab3f49f3582945ec1085f2d4fd61c1a6b33c3b2789c1eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353339, "uuid": "e11f1ceb-f30f-4ffb-889e-6e86aa8b2104", "value": "T1F7E34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353339, "uuid": "eec54b0a-41e7-4ec6-a635-980d8d59fa94", "value": "3072:ut8iFDKEfFN+Fa+1sWFh7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaN0h7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353339, "uuid": "df969348-64fe-43b2-ad52-af702bd2e1ab", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353339, "uuid": "9bcf4d4e-609b-4608-a241-1f377cd956fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353339, "uuid": "dd073d82-69fb-4305-80ea-5a6e96dfe8b1", "value": "e470228f1ed004abac56b9fd6cdfc8df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e05fed-6aff-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697335811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335811, "uuid": "c75e969b-5f3d-4569-b6f4-8ab2e18014c2", "comment": "Malware payload (RedLineStealer)", "value": "440f7d4d3059bfc56131e0fa6ee99d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335811, "uuid": "7afe6759-e3d4-4e6b-8dc9-1f1672887b69", "comment": "Malware payload (RedLineStealer)", "value": "5b298c5d4e29d018c8d326971902d302a598a815fae32fbd0dd308b5fa58ff12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335811, "uuid": "a9c59038-3c7c-4339-976c-09da3d9840d8", "comment": "Malware payload (RedLineStealer)", "value": "d9557929d5540b527bcd8fb235cab026e45d952d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335811, "uuid": "af08e974-266f-4791-bea0-508edb805ba9", "comment": "Malware payload (RedLineStealer)", "value": "57686e242e5f7201a38e2aad5f9ce9d24f799fddd90c6dee6b4a2d2d05511c82f2563e931230f54be006780b2b37e5d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335811, "uuid": "bf642678-fe64-4b10-893a-0b0e5095a982", "value": "T1C3E39D01F5C3C0B2D572093506B4EEB14E7DF8700F506EAFA39855BA5E306D09A7AA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335811, "uuid": "0415c35d-7338-447d-a1bd-329a00760044", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335811, "uuid": "272d9bc3-d4c7-4ddc-8d4b-f1f272656f90", "value": "3072:rWQAJsU12HlWCnUewNzrQuUUpBt2973rC99maQzxpADQPgjc8hCDPoJ:BAJsICnU9Q83QzxW8PWc80PoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697335811, "uuid": "458b6cc0-1044-4aec-94a9-c6de1ef920b6", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697335811, "uuid": "52ec8bb8-7697-49cb-b321-5f1116f0108a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335811, "uuid": "2d6f0c42-3bf5-4ae5-93bc-91babc39d25d", "value": "440f7d4d3059bfc56131e0fa6ee99d5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e30990-6b74-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697385866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385866, "uuid": "57ea9e3b-12d4-450f-b38f-9c417e5dec72", "comment": "Malware payload", "value": "41cf2af907230201b5ff89c21ae46d8b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385866, "uuid": "756547bc-c032-4cba-85d6-38f6f1b01811", "comment": "Malware payload", "value": "5ba80acd8c4fd67d42aec5c665d3934b7ecffca1b216e910279a1719f40dcdc1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385866, "uuid": "6ac6ebe1-bab6-4b13-9cee-879250175eb8", "comment": "Malware payload", "value": "15bd5d02f6076f33c9df461a2e24f29dc0968bd5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385866, "uuid": "145e5cf9-c393-42fd-aef1-94e1e37d87c6", "comment": "Malware payload", "value": "1eb1b7049ac180af3a49209180bc07ce07eb96cbbe07769aa89db7523d38593fe68534ee45aacedbbb5de3bf5c254b72", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385866, "uuid": "4483fc07-1aab-4b17-b1a6-59a5989e56e1", "value": "T117417B101FE50724F3B38B76A8BAB711C97BB849DE418B4E014183881472225F9B9F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385866, "uuid": "d370defa-0bfd-4b5c-917f-81c50d876464", "value": "24:8A5/BHYVKVWO+/CWRC7sDdd79dsHXZpvQ:8c5aM7qdJ9GZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697385866, "uuid": "ea1c486e-7098-4460-bda5-72c98c1ae7a5", "value": 1962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697385866, "uuid": "2b643063-b008-46e5-a0fd-959e373d5ef8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385866, "uuid": "4c82d06e-a923-4a2c-a598-b2806f5772dc", "value": "15bd5d02f6076f33c9df461a2e24f29dc0968bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebff47c-6b1c-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697347901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347901, "uuid": "266d62f2-a036-4d44-afce-a05cacb1dc20", "comment": "Malware payload (Amadey)", "value": "0020301f271cee969dde3e0f3423339e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347901, "uuid": "1c5d0839-40b2-4950-a64e-95bc5b7cb087", "comment": "Malware payload (Amadey)", "value": "5ccd3fc1613c48f85aad3fb1946ec858d17e42021e77a1cd681406b6b6b0b557", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347901, "uuid": "06bf49ab-894d-464d-9c45-40201f14bf28", "comment": "Malware payload (Amadey)", "value": "78f3858979dc71020249ac3964159de316da3b37", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697347901, "uuid": "84f6eca4-0fdb-4cb6-9165-90467d218ec7", "comment": "Malware payload (Amadey)", "value": "4c5dd5e459e862944e948545eeddbd40378968943ae2d14058015f7d445a9c608750b28909f35964dbcc0783fc3c248b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347901, "uuid": "8a86c688-8c51-4e9d-b65f-26dbbf83ca68", "value": "T1F0152311A6ED4072DDB923B06CF603971636BC608DB4839B7397DD6F0DB2694663233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347901, "uuid": "926b8844-8f81-46b4-9f32-c87edc355ad9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347901, "uuid": "3f2ce284-6493-489b-bd26-95f0532949f4", "value": "24576:Vyid/NdLT81wbQiI0moLzIsnNaHEDSDh:wid/NdLWySofXNaHEDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697347901, "uuid": "683651cd-127a-4630-b572-6511a7c7f639", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697347901, "uuid": "6f6c59ea-ea16-4515-b46e-25c894b53d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697347901, "uuid": "9a9f9cee-5dbf-49d5-8184-2c4a5737c357", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a025391-6b94-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697399406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399406, "uuid": "a967aad0-768a-4808-95f5-1daf9eb746d0", "comment": "Malware payload", "value": "a4a579b36ea193da1fe83faac7fb1e0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399406, "uuid": "8f679db1-add5-4972-8277-836de477d64a", "comment": "Malware payload", "value": "5f548e260fd3dd1059808697e8ee01cda2d8fe6004e22d3319c44f921484148b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399406, "uuid": "3170b519-4546-45a7-99af-6c18cdabcdd2", "comment": "Malware payload", "value": "c556465d3b2f1a608c278815b3a6cbfdf4d8d928", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399406, "uuid": "f5925577-fb57-4229-8fa5-3b268e9090cf", "comment": "Malware payload", "value": "54f5c925f996c62bd21425f116aa6f386e1c8bbde539c2b90140db584119bf8940e0f6b3384d9cdcc51da46483c30860", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399406, "uuid": "c3537229-9ec5-426b-871b-a2d1a21d5612", "value": "T1472349C4E547DCF4EC2606B16132E7369B37F03B115DDA57CB99DA22EC82A80E94329C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399406, "uuid": "efd5b015-e09e-4972-b684-d56626f38245", "value": "768:B5hZMIbOlYqwBYEIvGIa/2UgxtmcYT5ARSqFiiN4ugFLse:B5hZM2OlYqwBYEUla/o/m1iSqEC4ugFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697399406, "uuid": "5d2d6e3f-e14f-48a4-bde0-7711207d0f1f", "value": 46512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697399406, "uuid": "52f86ca4-cf9b-41e5-ba29-40d21d85a33e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399406, "uuid": "6f88efae-c906-4904-b4a2-014266af2fe9", "value": "shindex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a337bc5-6b02-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697336941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336941, "uuid": "40ed85ce-4437-4d2f-b94a-44ec513fdcfe", "comment": "Malware payload (RedLineStealer)", "value": "a6d303c42b407563883b0c728160cd7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336941, "uuid": "97f0f304-f95c-4ffc-9ec5-222bc0e6fe1d", "comment": "Malware payload (RedLineStealer)", "value": "6190fdf30630e5cab415aaf32beff777c46fd68a76f7196675431fba2ca56e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336941, "uuid": "094444b7-2d9e-4c91-86ed-df347f43616c", "comment": "Malware payload (RedLineStealer)", "value": "06ec9744183d6293eeeacafb0c23640aaf493725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336941, "uuid": "add9bc0c-415c-4426-86d1-a14b60433f40", "comment": "Malware payload (RedLineStealer)", "value": "6e25e8f6bd09bf35931976e82c16bb292ef79ab223f461e6c72a5b0b4905c104aaf923d0a0851c18f675c7f2a736f861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336941, "uuid": "45c9005f-056f-46c0-b375-164d1178b9b5", "value": "T12E151201E2D9A463EDB517702CFA15C71B35FDB08DB1972B2792998E0C72788A93533E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336941, "uuid": "2527f9e8-38ad-4688-8c74-32911cd6e0a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336941, "uuid": "420151c1-64a6-4916-9a81-a6fe51b1cb07", "value": "12288:OMrPy90mw61XNO+uSy2r7cZzhX0T/ZrLHvjAMC6uaXIErHXKc9+fI+TBEjlF90uZ:hyygFy/XWHvjDhH6c9+g++BFdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697336941, "uuid": "121962de-4a70-4564-abe8-4b67ec4b4f5e", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697336941, "uuid": "9464ce0f-d1fa-4c52-9371-72d9e3a774ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336941, "uuid": "82fe9df3-0a1e-40f3-bc89-390c43d123b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5264261-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367132, "uuid": "dc623c39-8d9c-4af9-9635-0b18811015dc", "comment": "Malware payload (Mirai)", "value": "96d4acda227dff64a093d51dbbe6fa78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367132, "uuid": "ab071305-0da7-4296-9bc0-4e7ff32b672c", "comment": "Malware payload (Mirai)", "value": "62857fa690170f660045fc81771c8f5af22cea5304d91bd293734807495834ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367132, "uuid": "3d2f2925-0ce1-4613-8dca-fc718290eae2", "comment": "Malware payload (Mirai)", "value": "d76bc3115f82a9ada2e028de712cc41f791310de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367132, "uuid": "55b33ff2-7e6f-4591-bbc9-e6283b65bce9", "comment": "Malware payload (Mirai)", "value": "55b8e58c1125fe2c5a02f4543596fa10c3976bcc909b589319ff595421a7321dfec4238b633cb00c6638596dc9d4454a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367132, "uuid": "235082e3-1a71-48fa-9ec8-9234030782c0", "value": "T191243C613A791B36C0E0653D50E7971AB6F617C826B0C20F7EB10D8EAF59A603153BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367132, "uuid": "17e4b8ba-b3ab-4d20-9a5b-408e8c4020fc", "value": "1536:7Yy5KrYZioZjlZOwzS24S5ZTP/8VWV8rhKjU6U1uYMTobeo+WNU4XOqxh:MPKT4S5ZTv5jLYM0yxWhOqxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367132, "uuid": "7f50236c-1f4b-468d-ad71-d07bcd4ce383", "value": 230012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367132, "uuid": "9854e177-fb2a-4730-ba6c-a7e210c63602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367132, "uuid": "af7b82c6-e76f-42cb-9696-dea36ea9d6de", "value": "96d4acda227dff64a093d51dbbe6fa78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9aedaa-6b76-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386878, "uuid": "abc26af2-2be4-4e7b-b7eb-42d3d0bc4018", "comment": "Malware payload", "value": "f3234097fc5189cd1e558550ba0617fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386878, "uuid": "31873a26-2731-4757-a619-a8b0dfa39598", "comment": "Malware payload", "value": "62f6c5b21b490f641e177ab2f85ad44b38289846b89e170ba2686acf13eb12ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386878, "uuid": "37710ce3-4e60-4345-9c84-9f95dc3abfd3", "comment": "Malware payload", "value": "6051d0af13a8b8d7b3be6d9951f9c7382ca58fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386878, "uuid": "e767a955-ccce-4136-9275-7a32175bb564", "comment": "Malware payload", "value": "920586c455cf16c1fb9b962e267100a4b2c45239242ec54811fffc5ba65753228dabe1435beef1b91b6d58df9e24b1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386878, "uuid": "0fbceb55-0db0-4a34-94d7-a03e75d7dfda", "value": "T19535DF4AE789FD22D63445F660F6B0CCD2A0C1AC856E874EA810B1E7A766745FDFD00B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386878, "uuid": "35866527-4762-40f1-bfd3-91adb667adca", "value": "24576:P+Cyv5uFDggoQxFH4Ls5R+LoO5v4pWUUkgMLF/20w9:A82pjLsrArUUkgsA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386878, "uuid": "10763626-3d8d-4509-a60a-2ff3f5dc4830", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386878, "uuid": "34427845-a273-40ac-a216-4738a2b3b206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386878, "uuid": "c3886ede-3860-473c-a601-c51590b98e60", "value": "f3234097fc5189cd1e558550ba0617fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998b0d52-6b27-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697352831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352831, "uuid": "3e57cb70-14e2-43d0-9fbd-3e415913059b", "comment": "Malware payload (RedLineStealer)", "value": "2f6d82c22089d6abbcb05ce5e466b408", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352831, "uuid": "60f4a603-88eb-4b1c-ab6e-a5a715732646", "comment": "Malware payload (RedLineStealer)", "value": "630dfad344a1eef8261ca4e4476f01e7ef6c667e2f78623adc7aea2b88fd3d2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352831, "uuid": "96ec2495-d3ce-44ea-9a12-cf8f9547994a", "comment": "Malware payload (RedLineStealer)", "value": "73478e9e39462979f223f5d1131d8b32cbc47284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352831, "uuid": "d4032429-d9aa-46ad-8926-d5f2d4ab2932", "comment": "Malware payload (RedLineStealer)", "value": "bd1baa4ed2672438600788dcaec4ea05857f1ad67e57d910e9397472986cef4185430db7b4ae345bed971bfc94229781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352831, "uuid": "910b742a-c6ce-46c8-8a12-ca9c22a5db9c", "value": "T141152382E3DC4172DCB01BB059FB03870B76FDA04CB9165B279A697E5872A95F834327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352831, "uuid": "fe829efa-92ca-437a-be66-c1f3f8463e21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352831, "uuid": "fd0607ef-20a3-4caa-99a5-0c4007b697c7", "value": "12288:YMrry90tIN5/ZitZeA2eB3VhW2ZdXgxERpD9p7RA1111khTzCJ7/DDhz5y+Rt6fG:jy4oLmfB3hgyZ7Rw11k1CJLemAfBPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697352831, "uuid": "4555bc60-befd-43dd-9048-4b4b65a4ce50", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697352831, "uuid": "1d9011a9-f66f-45a6-9f01-8776c88068d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352831, "uuid": "6f851a45-36ac-44c2-a0c5-6bbe580a419d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8fa662-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367144, "uuid": "525fe35a-66c9-4372-9dac-f42eeb3dab87", "comment": "Malware payload (Mirai)", "value": "5ddc32b299c179c23668457c42ae0b5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367144, "uuid": "1e84bf42-7a07-40dd-b42e-079ec67d9393", "comment": "Malware payload (Mirai)", "value": "640c8f22d51b5a705ff324d9a7b0cc2318da53df43b0441b35a26d39392d1b63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367144, "uuid": "84bb0e1f-7b53-4ac2-928b-250f83075028", "comment": "Malware payload (Mirai)", "value": "e59f1edde56778fa25f2af1a2af2bafc09ea9893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367144, "uuid": "03208169-23e1-4136-93e3-2f6b01e78f1a", "comment": "Malware payload (Mirai)", "value": "2cac5ef17a057a21e409a5eb8d3815ca6e22f88f980f48513cf6f69cee76461f3f5e7489e9ba01cf39063dfd89c5e333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367144, "uuid": "fa8dfbd2-0dad-404c-be37-b82675f33c71", "value": "T10AE2F1B5093108A1EB3179BD4FA5C25D8A4FCAA6C5EC3075316A1020A8DF864ED7F6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367144, "uuid": "7cbac393-8f9f-4aaf-9084-448d2f8673a1", "value": "768:6d0ByevXvuiDGqB+oZHNsMJyZs3UozXPv:G0p2iJB+oZHNsMdzX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367144, "uuid": "06e24748-9540-442e-81f8-5d61a83df318", "value": 31936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367144, "uuid": "a7ff1a42-802d-4d53-9db1-bc3256df11ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367144, "uuid": "af430823-7695-458e-a08c-717211e07623", "value": "5ddc32b299c179c23668457c42ae0b5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0fd2c2-6b40-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697363414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363414, "uuid": "25442722-413b-4d32-b50c-03d0a03031a1", "comment": "Malware payload (Amadey)", "value": "95f51e995d617caab4e5ac847b8c699a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363414, "uuid": "21336232-3303-44b4-9cbb-b253b54c3e93", "comment": "Malware payload (Amadey)", "value": "6417df9657bd42bb8e51138350481fe09ddec83bc0a0c5e21925cd38c3bc0496", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363414, "uuid": "26387777-6170-48d6-bf54-0653bf9004f7", "comment": "Malware payload (Amadey)", "value": "4272a9816ba97454834e73ca837bc9d6796ef0ac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697363414, "uuid": "85f888f7-ccb1-472e-a8c2-54a2b8667360", "comment": "Malware payload (Amadey)", "value": "2e038304b0673fa846de870e5d999ae16b316cbbd731854610e57b20df708559356ae09bace0f73948e58e31bed41c7a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363414, "uuid": "5c203a8c-5f8b-4535-a313-99abfaff4f06", "value": "T162E39E01B5C084B2E772193606B0EEB14E7DFC700F505EABA3D85A795F646D08A39E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363414, "uuid": "8a856aa0-0d06-42b5-8e0a-0f325ffeb571", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363414, "uuid": "048d7036-8731-453e-83c4-2876d90ed752", "value": "3072:yWQJsU12HlWCnUewNzrQuUUpBt2973rC9wmaPZpqoHx0DPoJ:KJsICnU9Q8UhpqJPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697363414, "uuid": "7b180230-beeb-499b-a627-d0a197b77d66", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697363414, "uuid": "94da70ba-4c0a-4348-b496-ecdd37d8fa1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697363414, "uuid": "c4aaf29e-e20b-42b7-83a6-7e1816fc8c41", "value": "95f51e995d617caab4e5ac847b8c699a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e374e112-6b15-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697345224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345224, "uuid": "e189d6d4-cc03-462d-874d-d9bbc60256b0", "comment": "Malware payload (RedLineStealer)", "value": "8df9ed73edad4fcc0a18e5ff93825b51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345224, "uuid": "34b03504-2a11-46f4-9ac5-89561622c7ea", "comment": "Malware payload (RedLineStealer)", "value": "64263a4ed1a6432b06bc1729d818182081babbe97f02fd6f61f2d09e3e657dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345224, "uuid": "21399ba7-9957-4afd-b0dc-747c552ae60e", "comment": "Malware payload (RedLineStealer)", "value": "f27d046414f1f5d291b211d765999e8192efaeb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345224, "uuid": "aeaccd08-5b98-4c03-a7b1-bfa8d09de6ec", "comment": "Malware payload (RedLineStealer)", "value": "fed9e740dc764de5c479071eb76a392b0188738f06c36f45f9f67834a5f7c6cca044012ccf05868326f4b0bf3d66d29a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345224, "uuid": "709857a4-ed9d-49ec-bb01-c1149867f74c", "value": "T153152203E6F49471D5B907B019FB0397073AFC9289B097772785196A1CB2AA6F872337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345224, "uuid": "e85f9c55-59e7-4c9f-8a8b-e12871e2ccaf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345224, "uuid": "f21df70a-5582-4d76-ab0b-36d44349e097", "value": "24576:Gy4iuMl6GLUd7u7cT0iZ6WnGkXypqNi5PBQ8tczl:VN6GLU1ce6WGnqNz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697345224, "uuid": "d8161902-8366-4d70-880d-ef3c778e321c", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697345224, "uuid": "29bb3e78-7a12-403d-8848-ce1af7f1658d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345224, "uuid": "7c39f102-1555-49b0-be28-94ca99ffb9e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1192a2f-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367152, "uuid": "27a4dd20-9e0b-4699-9db5-4b7b540d23f2", "comment": "Malware payload (Mirai)", "value": "e72e0f7b7a0b2bc24ff7ab99164c9270", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367152, "uuid": "54d13ea8-71d8-4dd3-b38c-243feec605cf", "comment": "Malware payload (Mirai)", "value": "654a1d89125e72c670e8aaeb9b68d9f180674cbe7fa96fbdae4166e0135e265b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367152, "uuid": "8225a720-59ba-4fa4-87f4-d959e365909a", "comment": "Malware payload (Mirai)", "value": "93990b648f6960dbda7b80e99e16d4388da67237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367152, "uuid": "c57f165d-8074-49c0-8914-34bf01d8829a", "comment": "Malware payload (Mirai)", "value": "3f4883d71f7542e9e84e7d27fa59c92ffb60bd32f5130fc6467c4c7a6a9094c723f73f305b8b2372f44a0cb7d2d14ea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367152, "uuid": "cff5f5e2-0b63-43a3-9077-e4eb477ed153", "value": "T1C1534B99F4029E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367152, "uuid": "564ada06-9ff8-45d4-89ee-f4a25b7188f1", "value": "768:me4gpsM204GEkRbj3eXmonQiuQttd3gFHy1eu48B8vB6J7EzNfXQuJpozME32:mo3EkRbrdDiDaFy1X48B2SEzNfAuJKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367152, "uuid": "2bff91c7-1131-4135-bd73-68dd4b46c54e", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367152, "uuid": "ed5fd8b9-3d1c-477a-9b11-1329c10ea55c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367152, "uuid": "22818cc4-4edd-4e75-9e92-976898a15919", "value": "e72e0f7b7a0b2bc24ff7ab99164c9270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c525d243-6bae-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697410887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410887, "uuid": "ac06d65e-aabb-44a7-91b2-ec54e914eab8", "comment": "Malware payload", "value": "d405909fd2fd021372444b7b36a3b806", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAKEOUT", "colour": "#629AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410887, "uuid": "069f21ec-299f-4966-b2fb-21b78ce774bd", "comment": "Malware payload", "value": "662124b0c998fd0826c192514b1f57f8002f2ab031996aa6dd7832f561679779", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAKEOUT", "colour": "#629AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410887, "uuid": "a576f698-125b-4178-b097-3001337f51ef", "comment": "Malware payload", "value": "354e1f8cd546077d99619bd8445073725ab847ad", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAKEOUT", "colour": "#629AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410887, "uuid": "cc85fafd-906f-4ebd-84ca-ee944c71ffde", "comment": "Malware payload", "value": "acce72fbbe5b780257e06991c84244dc1e56af98e2fc22af9f7369cef0327fd6d32cd9f28394667fb5921e3ca2c3c459", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "TAKEOUT", "colour": "#629AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410887, "uuid": "a5545c96-dd82-413a-ba42-879b813ee094", "value": "T18E642309FF7B99C0CAA8492AF68F3C3680F08E1EE912D18560A789C15DCF772759B457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410887, "uuid": "148594e1-2726-4ca9-adc6-bbe273d6a3e9", "value": "6144:RLRxYCttuj5tqtwFsLfzpBUC8CxsWVPs4OsiKy+31tjBWsmPU07Kpb:XxzMj5tcp6WxsyA+39Wsg+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697410887, "uuid": "94ec7948-0e3a-4ef5-b174-b9750d65df20", "value": 330246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697410887, "uuid": "ebc93454-6412-4355-81a7-516dc41f4ac5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410887, "uuid": "ead5d20b-681a-4923-964e-9b7a0a7d7fc7", "value": "ClearTemp.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79fceaf-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353419, "uuid": "6d4da39e-4e98-4e71-be94-4ba318ba300a", "comment": "Malware payload (Gafgyt)", "value": "b05384f4df810485f7869218af37c9f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353419, "uuid": "79cd90a8-ebc4-49f6-8db6-047db6040701", "comment": "Malware payload (Gafgyt)", "value": "66905502163c56e099aeba148c130e21f6dc666d099365cba01348c87126aa31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353419, "uuid": "fda8f156-063d-425f-a660-ee9905e4feb5", "comment": "Malware payload (Gafgyt)", "value": "b568bd6791f1ec9b2b6001fcdbf8a3466edcc07e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353419, "uuid": "453cb179-442e-40f6-a367-12b4f63c4b65", "comment": "Malware payload (Gafgyt)", "value": "5a6785b5cbf52fb9218b449fccb3b7f4d497b672317363c16e83f7cd0321f219fe3b5ade16ddfdcaa81213dc500d4a9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353419, "uuid": "4b72ec7c-3c1d-4edf-a9b4-0735c0a9a94c", "value": "T159E34909D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353419, "uuid": "954a5116-3ff6-4715-9a15-fa1b526b9666", "value": "3072:ut8iFDKEfFN+Fa+1sWFh7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaN0h7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353419, "uuid": "de9a203c-fbda-4a0b-99d8-de1ee2ac24ef", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353419, "uuid": "2546a718-a63e-45f5-b8f1-5754f6797d70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353419, "uuid": "67406811-51a6-45d6-ab37-1f3593f4de5f", "value": "b05384f4df810485f7869218af37c9f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc357221-6bb6-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697414334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697414334, "uuid": "96482091-10dd-4e98-80c6-f7670d7cb434", "comment": "Malware payload (AgentTesla)", "value": "08677d1e591e7726dab3ce72a62fe8bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697414334, "uuid": "d94cb0e7-9e5c-4703-a2e1-61d500201b6e", "comment": "Malware payload (AgentTesla)", "value": "67d9651b26cb6dc1a1d6b9d072b3382555ddd0811d2beb0eab6cab27dfecd8f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697414334, "uuid": "22c44bd2-5500-4405-bb3d-3561a783f276", "comment": "Malware payload (AgentTesla)", "value": "edbed08c97c4091bb48daec3f22aab3f00d7336f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697414334, "uuid": "b9e7b550-caad-4e06-a827-d753f9dce051", "comment": "Malware payload (AgentTesla)", "value": "1bd323563d8af69f712cc57efaaa28728d3e6984613c7f8420a600d7a3738477417426869be22fb42a04ba7453ba2512", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697414334, "uuid": "320faf8e-af0c-4df8-a574-ee2180432b08", "value": "T199B5BE81A3F8D949E0FE4631DCA562E0A2B16E377222C67DDD02F52578693C34DC4F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697414334, "uuid": "304e494e-b04f-4541-be84-7ae82e0d415b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697414334, "uuid": "d5d99f99-2060-4e86-bef5-f21f1acc4292", "value": "49152:EYEAHKI8Hp8NsdNqaUyroZxgjo1dtFaTcebCLiF1Rey5djAK:EYEAB8eWrogE1k+S1oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697414334, "uuid": "fceb1490-4e3c-41d2-8147-b60c530643e0", "value": 2473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697414334, "uuid": "475a3630-5d5a-41fa-898f-157b611ef617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697414334, "uuid": "9a2b4d72-d54d-4d2c-8983-b5daad1d45ea", "value": "SecuriteInfo.com.Win32.BotX-gen.15529.17557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd7258a-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409717, "uuid": "d43efb3d-b5a9-40ce-b252-8617978cb0e7", "comment": "Malware payload (Mirai)", "value": "aa36ccd80953f96eb67304505b1406c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409717, "uuid": "ecb7a6fd-1987-44eb-97cb-7720df48f14c", "comment": "Malware payload (Mirai)", "value": "68215ef80a04fd9215e857c8f02b93ebee99311308fc99f71c69e1e943c6a846", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409717, "uuid": "723fc780-34c0-43dd-b93f-a0f4c95a6683", "comment": "Malware payload (Mirai)", "value": "45ab1487fce0c292fb6109d5119ef29e07761bb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409717, "uuid": "afb58295-b436-4238-8f9f-2951303fbfba", "comment": "Malware payload (Mirai)", "value": "320c85fa0449120b11b1bb9d4e2f2aa56e433c8b4bfdec4788d6418ec464d3b27c34f97b4f539ebe32f11c8540f202fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409717, "uuid": "fe9e8eff-f515-4f62-96cf-fa00f898421b", "value": "T18F82CF2061AB75E9DBE10431FEEECEC697160BF8D1FC36D316586B78894600661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409717, "uuid": "fe5229b8-92b1-4cb4-b78f-2185479e7f80", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMad9hymdGUop5h5lq:6/V0P6+kom0tVAoNvm+to1Xs3Uoznlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409717, "uuid": "8aa6cd01-357c-438d-a031-fa607b83dac9", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409717, "uuid": "976f3f92-fecc-4192-b0d7-ad851bd8d008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409717, "uuid": "d8feb6c5-2809-4968-af62-6f4652ccbcb9", "value": "aa36ccd80953f96eb67304505b1406c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d757f5b-6b89-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697394902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697394902, "uuid": "87d2dd97-973e-4892-8abb-d0a3e57b253a", "comment": "Malware payload (RedLineStealer)", "value": "0320e0f42f42b625ebd2ee31cf174ee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697394902, "uuid": "b5662996-83d1-49d9-ac12-136271e7fedf", "comment": "Malware payload (RedLineStealer)", "value": "6a714084847cf8ff540ca1fff6545c4cc50f65ff422360ce0f21924c87f3d07d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697394902, "uuid": "d3c80d28-37c1-4b32-a205-c1f429501e38", "comment": "Malware payload (RedLineStealer)", "value": "361eb29fa7e4881a9f1dc05421f5fd3757b9d5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697394902, "uuid": "778637cd-c3ff-4602-9896-95ecc76df354", "comment": "Malware payload (RedLineStealer)", "value": "22bc09f7ef18f60b46deda3d8a874f02f390b88f4cd4eeaecb13771f833e155ed4f19a73b4a22b8e5c8c2549389c910d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697394902, "uuid": "18ba8b50-cf99-42e3-8a35-b95c3e8a9ab0", "value": "T1FB252343DBC80836E8B227B069FB53D30B797C615871022F77465AAE0CB16C5A6B1B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697394902, "uuid": "e183dd14-da12-48be-8f5b-b66aad703aad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697394902, "uuid": "dd17d2ab-7607-4de5-9ffd-09d7b7508d9e", "value": "24576:ey5TRZgyFBdsz22sVxxlKWRHb3MEN+bzEcfHQbi:t5T7VKWRHbMEN+bzEcfHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697394902, "uuid": "517d9a9e-06bb-4993-a0b0-518cd80bb0c1", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697394902, "uuid": "4ad66d41-9f13-43b6-a613-9303390a99dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697394902, "uuid": "6558e5a7-a54b-4275-8903-abdb85fafac8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6f8e312-6af8-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697332802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332802, "uuid": "9eb8ba0a-0674-42e7-8641-4a21af747c64", "comment": "Malware payload (Amadey)", "value": "0bbb2d8220c24b73c00c008485472dca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332802, "uuid": "65cd84c2-78a6-4238-8eed-1c325c1ec0a2", "comment": "Malware payload (Amadey)", "value": "6c0040c871c4657d544b6b2e80c56c29acdcf4b873354379b58b631739a0517c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332802, "uuid": "d339a1b6-aa1f-4515-a5a6-95488520516e", "comment": "Malware payload (Amadey)", "value": "070d413ca926aa8d452585eadd25d6a85bc49abb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332802, "uuid": "b46b6177-d912-45fc-b957-103eb2005e5b", "comment": "Malware payload (Amadey)", "value": "28338cdded88115e9606a92f9cbcdb23698591834eda6dece3b1c5e1bbc8fb7bb6352ba4f71ae32c4a852817f3721b56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332802, "uuid": "2a03fd39-322a-4406-8d0b-206335cb401e", "value": "T15115235B77E99436D8BC1FB068F213D72E367C914A34876F2709D94958B3AD8603072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332802, "uuid": "340f7518-b2fd-47c7-a45a-abdcf1ee8606", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332802, "uuid": "ea555e67-7ae4-4342-9361-91f2a9bae163", "value": "12288:vMrjy90aN/eLMt/brVdZ8bHvCKfY4Vlv3vCwagaTSSyXOkUu07SWTv:AyTCMB0PnlVowagGSJ0Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697332802, "uuid": "a9b165b1-40d7-4955-8841-2c22f6993483", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697332802, "uuid": "9de9a6a4-d797-4ed9-af3b-a9cd295b70ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332802, "uuid": "95f4bbc1-3e61-4839-93df-d5a9f9b066bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c853a117-6b00-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697336160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336160, "uuid": "2f8056ca-02a7-452f-be16-7d939ead6abb", "comment": "Malware payload (RedLineStealer)", "value": "ddf15dee1c807fa879560d2a70ac039c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336160, "uuid": "99496b5a-713f-4107-8b37-aa506c805e46", "comment": "Malware payload (RedLineStealer)", "value": "6d2dd1bcf8e1e770ad7d95818d4aa6389c31e1c677a514e0b1edf7501b64b28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336160, "uuid": "4ef0777e-ea2a-4494-a3a4-d54658361ab9", "comment": "Malware payload (RedLineStealer)", "value": "60aa5f06291e845131ccd10ff596bc3de00f6c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697336160, "uuid": "8c7941be-3d23-43a2-95d1-07eb6f552315", "comment": "Malware payload (RedLineStealer)", "value": "d3cc9e4179545d22711244e57990b35e96d30dbe960366b705e046bb514e69cc23d225e8f87e91aedbed5d30bf53a7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336160, "uuid": "39f53368-387d-495e-914c-36d180b7a421", "value": "T1B6151362A7C8D172E9B2173068FA02C71E3DBD915974835A17A26C4E0CB37D8B837757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336160, "uuid": "1f8b510b-8dd2-4e8c-8b84-cbbe6dc915d8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336160, "uuid": "04eb399b-9241-460d-b609-2461e570b73e", "value": "12288:AMr9y90CqW6iQL5v1gNkKsXGfNJT5YNprBUNHm4kUW7CRsXJ2TxDlD+Q9y:tyKzL91grs6NN5mprBUOQ1DlSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697336160, "uuid": "d82168c4-4b58-45a5-90de-004d8c6b7b2a", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697336160, "uuid": "33c7654f-688f-41bd-8a4e-340a5cb0f3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697336160, "uuid": "84b9a1e0-e395-40ce-8947-c6a0e459c0bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3c4f19-6b90-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697397930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397930, "uuid": "b14bc3db-4811-4d7e-9e54-a87da64d9a0d", "comment": "Malware payload (RedLineStealer)", "value": "ac9b9aafc5582ad1b5ef589e0d5379df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397930, "uuid": "99000352-480e-4b74-86ef-47dcbb38081a", "comment": "Malware payload (RedLineStealer)", "value": "6e72688cdb1c84b826798dff4f2aabc4a49c977e28b98fd3bcdf38b846ed9a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397930, "uuid": "81843bc4-69d5-4d20-a222-be55bedaa9b4", "comment": "Malware payload (RedLineStealer)", "value": "d777d83b130e962fafd2bfe22c72e31858181d53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397930, "uuid": "a66f65ec-e3ae-4833-a4f9-625ca9b0dbb9", "comment": "Malware payload (RedLineStealer)", "value": "a3353dcfe645a03697522916a0a5f29df9634fe20c8fcfb488cc4deb6ef627cb1ffed22fb3872a1aad975f0b011cd00d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397930, "uuid": "330dcfa4-bdbc-471f-9ce9-ffd1ae62c02e", "value": "T114152207E7E89173E8B82F700DF647970975BCA16D68C32A77C1D85E48A3588E832767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397930, "uuid": "d8a6ff0d-b626-4667-9521-e92f601285e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397930, "uuid": "d90b7fde-499f-4e64-9cb5-6d3f78e45d40", "value": "12288:UMrmy90IifQi7V/FYz/Ho7jP0+iO5MZuAdKUTTLgNEPg3XNAm6R35SQcHhitg4uU:6y4oiR/F2/I7js+iO6ndhnCEo39ARn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697397930, "uuid": "5d841f81-e2b5-4dd3-a2cd-d48cc5ec351f", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697397930, "uuid": "70045de6-3b42-40d3-a097-875cd6639e0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397930, "uuid": "1ce91486-8807-4b46-b76d-b63ebbb5bce5", "value": "ac9b9aafc5582ad1b5ef589e0d5379df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4117d7-6ba7-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697407785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407785, "uuid": "964022de-c86f-4e76-8782-e667d5f95236", "comment": "Malware payload (Smoke Loader)", "value": "cb20469403acf9ca0ffd0918d3d577eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407785, "uuid": "4b5711ae-8201-4164-9afa-7107ed8851bb", "comment": "Malware payload (Smoke Loader)", "value": "6f2bbd35accc8785877395e1967538459f5e96999c7ad17b96e5208b6e768c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407785, "uuid": "ba0cfe0c-986e-45a7-b94d-e4e113f7a47a", "comment": "Malware payload (Smoke Loader)", "value": "e448dc3c7d723c19fc3dd717fc3ed9993c94ea74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407785, "uuid": "b46b3afc-75fd-40ee-8f85-445014f99ebd", "comment": "Malware payload (Smoke Loader)", "value": "7b899c8cb99330fa77a5a74456461f8004e7b55bf071f2a1846f74c54a86542d061a671b5cff30da52fff6ea23b46d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407785, "uuid": "71f0fd7d-88bc-4e86-9162-7a574924a7e0", "value": "T1FA341913D2E17C54E9264B728F2FC6E8B60DF690CE4D7B69261CAE2F04B11B2D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407785, "uuid": "6934c0d3-41f3-4454-bc65-2bdbe36843be", "value": "da3e442c2d2024285cdd03f77dec5d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407785, "uuid": "176dfb0b-ec25-41b3-97c4-2fa432444b15", "value": "3072:0YbIXCbkLmvtqcR+BEYvtF4x4/E9e8azW5UXnxH:1bIXk8agntT/E9rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697407785, "uuid": "d027b511-a49f-4496-9ac4-889158a5dd61", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697407785, "uuid": "1c7f9d5e-9618-4350-b1f4-c909ad372e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407785, "uuid": "01499552-4938-492c-a7c8-7dc620c5dcee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50711ee6-6b24-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697351420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351420, "uuid": "4ed18b4c-9ee9-45dd-890c-1002486e0c1a", "comment": "Malware payload (AgentTesla)", "value": "b02e000fe67bea9a36118811e9afbf9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351420, "uuid": "a9aca0e6-9631-4523-a540-570767fb86a0", "comment": "Malware payload (AgentTesla)", "value": "6f437c694463d856376d7f5a6b5e83fcf76215044c6b157a2931f4693f7071ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351420, "uuid": "df35126d-23eb-46f6-85d9-54c2daae4ac0", "comment": "Malware payload (AgentTesla)", "value": "f25e951343c39a24348efa689728617a43cc9310", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351420, "uuid": "e31bd497-290b-4979-acf7-9c3fd6e9a326", "comment": "Malware payload (AgentTesla)", "value": "c77c66c6797cc187de74f5417a47a2e44338af914c56c37ff07ea7f77ef3eeedc9f91b6e553b9b8bcaee247d7ff8bfbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351420, "uuid": "6244c4ce-8472-4daa-9d72-2c84b48aa0b7", "value": "T120D5C02229FB109DF3A3AAB25FC8F8FF896AE573191E70F5214107468722D45CC52B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351420, "uuid": "20c4dd5d-5bba-453e-8f44-71220662bd8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351420, "uuid": "40df9aea-de3a-4fb8-b4cc-8506bdfd5fd4", "value": "3072:Be8lTxrU1GUGNxmRiSYT0zHCqn6Y/TEA7hvewogiutF/sD28t6iNBIFT:Ber1sbT0zHCqVB4+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697351420, "uuid": "bc99edd1-4fa6-43c5-ba2b-e94af79c0cb3", "value": 3009728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697351420, "uuid": "cacb8670-4b20-47c2-acfb-1774a6220780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351420, "uuid": "f74210f4-b00d-4230-a978-799f095fd0e2", "value": "Okuru.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0784fc-6ba3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697405982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405982, "uuid": "e9766c45-570d-4105-af08-e5288ed3548f", "comment": "Malware payload (RedLineStealer)", "value": "dafcdac4b83187bfbe4ef8441e093b96", "object_relation": "md5", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405982, "uuid": "00496d75-49df-4794-b27a-37b6faa6e85b", "comment": "Malware payload (RedLineStealer)", "value": "6f9ae99a83cc8905f7183b9228f7c5781b302e72e1cd684ccfee0f64bd286bf4", "object_relation": "sha256", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405982, "uuid": "2202c14e-2d94-46bc-a2b3-f355c65af51a", "comment": "Malware payload (RedLineStealer)", "value": "675f86a56e056a2e561032608e2faff91932ba4e", "object_relation": "sha1", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405982, "uuid": "a41cab72-d4d7-4c57-af1e-2b39167ddc05", "comment": "Malware payload (RedLineStealer)", "value": "114eed1cc278d9160b5bf0ce1943314848e94bfa627102c7ff89e4b3afb6ad9dd5d4fe98df35a1fe5a99ccd94951b9f3", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405982, "uuid": "aec9d0ad-53ca-4e2e-b0d8-2c110a844d8d", "value": "T11844D01A63E421A6E0B9177558F203835A317CB15B7992FF22C4D97E1E33AC0A932F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405982, "uuid": "065641cd-5e92-491f-a89f-6abfaf07adfd", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405982, "uuid": "4a936235-b089-4654-af21-b8b49035688f", "value": "3072:hahKyd2n31p5GWp1icKAArDZz4N9GhbkrNEk1jtUVnnZSJaqlmze4HV/5tPZsAkV:hahOdp0yN90QEGqVnZOVAlV/nPZ/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697405982, "uuid": "f1299770-87bd-4fd1-a620-556a760ff840", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697405982, "uuid": "29040268-3d91-4dd1-a402-7504f83de0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405982, "uuid": "00a03c5c-7f57-461f-97ab-f03700f068fe", "value": "educationdeveloperpro.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6699ee1-6b16-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697345686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345686, "uuid": "6c1f71a9-c9ef-462b-b56a-c29a88feb0b2", "comment": "Malware payload (MarsStealer)", "value": "7c6338713fa402602e7902c6712bebd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345686, "uuid": "f86ea4ef-35ec-4f0f-9cc3-6f3aedd17b8a", "comment": "Malware payload (MarsStealer)", "value": "7083052576ebdd75079d25251f24df243395476e0386c25656937a24b6865759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345686, "uuid": "7c8ba916-230a-4cc8-9359-5641f75d2ada", "comment": "Malware payload (MarsStealer)", "value": "88746b7939db6916097c1927ad81306f1fe55ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697345686, "uuid": "c4cb2e3a-9433-4b97-81c4-a9b7d4ca5699", "comment": "Malware payload (MarsStealer)", "value": "2ad4abdc58a5971b2ea15114f701185f4e9e6986e78337bbc837a72d05c6023016fd2c21f3d4b8ce0898e5c6ac9c98d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345686, "uuid": "d334c29f-15b6-4944-bf6e-82a9a82ebb60", "value": "T11906E63828EE101DF373FE789BD4BA9E9DAFBA732B065499105103478613D81DE91B39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345686, "uuid": "7dce6d5b-1ca6-45af-97a6-15db852ace74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345686, "uuid": "931744b9-0bd8-4175-bee6-08fb33d70993", "value": "12288:hFyN37FMCwa/5zCoehaSiNM5JWFnOVyVI:jqADNqPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697345686, "uuid": "0bff58c8-f9dd-41e8-9916-e0df776f21c9", "value": 4016896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697345686, "uuid": "54161c0d-735a-4bd5-99f9-321cc0b98f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697345686, "uuid": "161e41f0-be0e-4bef-a843-b10f1853b9ce", "value": "\u4e00\u4e2a\u5e74\u8f7b\u5973\u5b69\u5728\u623f\u95f4\u91cc\u548c\u5979\u7684\u4f34\u4fa3\u80e1\u95f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a286c069-6b58-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697373892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373892, "uuid": "1f5022b1-3713-472c-b4f1-321914bc6404", "comment": "Malware payload (MarsStealer)", "value": "c8466ccb18fbd1e9cb815f5f4666b4c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373892, "uuid": "7047f9d9-cec5-41ea-81ab-6945d45afe7c", "comment": "Malware payload (MarsStealer)", "value": "70f692d253921ece92f4e124d94ea340972cfc936c8aa74dea564bdfca8e4316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373892, "uuid": "a56266d8-dd37-421d-8ab3-fb8a39a06d83", "comment": "Malware payload (MarsStealer)", "value": "fff3614dd1a1ce7684b6ed1f657982b2792af2eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697373892, "uuid": "53de196a-02fd-4210-9c97-82ab194e8761", "comment": "Malware payload (MarsStealer)", "value": "3e8b89df2071c0a93b87ed77c2d416d8f23586ce67a7bfcb6287a174b74f3e729dc5fd1a664ae68a867597819a0e3837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373892, "uuid": "0c6d8075-940f-42b1-aeb2-acc1c0033232", "value": "T134444B13E2E17D50E5664B728F1FC6F87A1EF6608F49BB65261CAA2F14F0172C2A3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373892, "uuid": "1155747f-e804-4719-9083-a7d36aa76326", "value": "f8d7b6f4b1be45f1a7c2df1ba9bbc18d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373892, "uuid": "3a8cd5ba-ecc5-4a04-bdee-7738f8ada703", "value": "3072:sBY7v+o9eNUBojfi8Xi2nMQGepBWkm9yQOxwi65z9CoI:NL+o0NUBojaci8p24xB496", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697373892, "uuid": "a5818aad-4278-4652-8057-26abf7bc3c37", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697373892, "uuid": "b89910cd-06ae-4929-9901-0a925e61788d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697373892, "uuid": "1bd9b353-1fe1-476e-a88b-7ee6666baa4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e97e05c-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409721, "uuid": "9f022d16-979a-4857-b75f-fc5fbcc7d8e1", "comment": "Malware payload (Mirai)", "value": "e8d131ff283c130501ff919d230e1c5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409721, "uuid": "83f60e37-9179-44dc-b639-c15b0cb81e65", "comment": "Malware payload (Mirai)", "value": "71e50378534cfb187b865d647bdf2f166c733075343c18748fdc26e748494fd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409721, "uuid": "edbe38bd-22eb-4ca1-a4b0-ca7d2c521462", "comment": "Malware payload (Mirai)", "value": "47848a697cd919ed4e6b09afaaa08f4ea72f7f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409721, "uuid": "004e2422-426f-47e1-bf4e-d4678b60a689", "comment": "Malware payload (Mirai)", "value": "25ae0163921c604e9f8137aedc315a2cb4bddae454a537f3d568f475058dfc1a764a7819f5b03a8f82817e14f3ea2a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409721, "uuid": "9f9e07ff-917d-442c-becc-1dcbadd272fd", "value": "T1B9230271850F9EB164303C76EED9E39379E12AB1C5673023D6280A3C2F697531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409721, "uuid": "5de7dd82-36fc-4680-9391-b27770c4e9e6", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3w9q3UELbUXfi6nVMQHI4vcGpvx:gECFd+A6YHAx5LRQZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409721, "uuid": "eda7d563-977c-496e-b5f1-a2f650165530", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409721, "uuid": "7459e0fa-bb18-42e3-8fde-0944c086dc9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409721, "uuid": "4a1f6d61-bdf3-4e36-bb03-f1f6c45af814", "value": "e8d131ff283c130501ff919d230e1c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02f50c5-6b76-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697386880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386880, "uuid": "c7d93356-306e-4bf8-88c6-f8f5a02b9f94", "comment": "Malware payload (SnakeKeylogger)", "value": "981de70f5242ac1192bf182be3797e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386880, "uuid": "8da87e5a-e05c-42c9-b1fa-89e97bad962f", "comment": "Malware payload (SnakeKeylogger)", "value": "72023098897159503324279508c4af1c62d2a839d1adcb0ecbdee59ffed712a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386880, "uuid": "a16ca507-9856-4d7e-95ce-5a4d19ae6b3c", "comment": "Malware payload (SnakeKeylogger)", "value": "d7ac568899333c823c589444286f9d3655992332", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386880, "uuid": "c5641674-e035-4ddc-a8df-2fee1d22f7fb", "comment": "Malware payload (SnakeKeylogger)", "value": "a7b1716c783d0d7b7c0d78ca6644f9a8c22a0151ffedc20c9daab6f52d5f073303d73841f491db8160ee14f762009b58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386880, "uuid": "61cc8bbb-afad-4b05-94d4-f44b3d0b7533", "value": "T1CAE48C9C3210759EC817ED768B581E64AA206C7E930BD203A13736ADDA3D997EF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386880, "uuid": "64c3c663-a910-4622-ad06-ccdd9147d7cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386880, "uuid": "3f6f1bfe-dfac-4a66-b424-1a9b7853f405", "value": "12288:ni/FuEHcO5O5LK7s9dZ3H3m/yy1XW8pV9QGFK6+S0ol71Zdk1L7rwqw/LgVme3Ee:i/wEHcTE7s9dcrmUV9QGFCO1Zdk1L7/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386880, "uuid": "f9df6cf9-6893-40fb-a42f-c9e4fa413f34", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386880, "uuid": "089b9549-b99a-45f6-93fc-75818e29bd7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386880, "uuid": "4d4dff46-f66b-44b2-a7b8-a950296d6991", "value": "981de70f5242ac1192bf182be3797e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb36893-6af0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697329243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329243, "uuid": "ae0dab21-45c6-4747-95f4-3c303cdebc8a", "comment": "Malware payload (RedLineStealer)", "value": "613b3e208492b886e136cb19740049e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329243, "uuid": "2f04067b-ca36-4346-afb7-d9643faaff82", "comment": "Malware payload (RedLineStealer)", "value": "77cef45652b1249c215fb5a58e1a250147cf1c5c313706c8b84aa48e48527c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329243, "uuid": "f1a9a583-af87-4efc-8e01-f4acce1b0284", "comment": "Malware payload (RedLineStealer)", "value": "f5538f97aafe5e0dc2aec97fe26040798833e800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329243, "uuid": "96b51c74-13cc-4d29-9ac6-6f5d14697c20", "comment": "Malware payload (RedLineStealer)", "value": "76430f3aad8b9b2cd1929f629bb39449566595519bb8bf01cd4c36ebd3252cbad7d5eb1df01e91fbbc24278dfe8b8fc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329243, "uuid": "264489c7-8987-4071-a2e1-baedfe02c094", "value": "T13D152327A6EC9972FEB2137099F801D30B39FCB51D3096CB375458AA0C37A896536727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329243, "uuid": "82da8614-3ae5-4627-87d3-05c445cc4429", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329243, "uuid": "a9572b36-30f1-460d-bb95-02185eb08bcb", "value": "24576:bwytfjeutIYP0lwT2Z0gLodrNV/BFirZ:bd9FP02TAfKDZIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697329243, "uuid": "800d0dae-3167-42a8-8a98-784c5565892c", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697329243, "uuid": "1ecaf93b-5dbd-4e31-b93b-c5eb1e9ad6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329243, "uuid": "f11468c1-2960-4d1c-a626-843ec8fd2ce5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e03d81-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401269, "uuid": "295a7bcb-deab-4a2c-810e-c836564e16e0", "comment": "Malware payload (Mirai)", "value": "e95f2adcf9e9384fe9d09c46b2dfa967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401269, "uuid": "1e093810-609e-4fca-b47f-0b5f5ca50e66", "comment": "Malware payload (Mirai)", "value": "7a2f3a464a67c04e26285f44c3f9aa31a30936c58425c43e42c2f619cb8f735d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401269, "uuid": "b4f35952-24a8-4e11-aeb1-de5940899563", "comment": "Malware payload (Mirai)", "value": "467047d7c71177b3fb839a49370aa16b31cdecce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401269, "uuid": "570031ad-5a3e-4209-a1a6-f0e674bab8d4", "comment": "Malware payload (Mirai)", "value": "5ad5953773ac92cf99b63a98d35f46d93a72a047982a991e632c57fd7e3b5020c22f347a7bc2cae8072492819200d815", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401269, "uuid": "bf94e881-6b3e-4345-9d95-7c2bfd091032", "value": "T193334C02321C0A5BC5675A70293F53E483BFFAA021E4F689555F9B9AC639E771086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401269, "uuid": "9d2fc0bf-2d4c-49f4-81ba-cbcf4698ccf6", "value": "768:WQDZxhVTH2rzRg8vRYPpD9bmA9s/oU0YFw2Ai8mqipqRIjZ0AT0zwRv2:PxzjgNeD9bmXCvesRI6oXR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401269, "uuid": "2cf9eea2-952a-45e8-8d89-47400d1edd3d", "value": 50876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401269, "uuid": "d08c830c-68e0-4ce2-9a1a-15c76739b247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401269, "uuid": "213a784b-cc8c-406b-b6d5-1c89447ba566", "value": "e95f2adcf9e9384fe9d09c46b2dfa967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580c2cb8-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401255, "uuid": "e4cd70bf-a366-4158-9976-466a52ea3182", "comment": "Malware payload (Mirai)", "value": "8db06ce048bb302e42470cbf9217bf2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401255, "uuid": "580e3bf9-0bcf-4b41-abdb-fe8f3bf5174c", "comment": "Malware payload (Mirai)", "value": "7b6205c3a7378584b8d4587eca7934d14ca84695f5023746c3b6dd1ec2f16b5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401255, "uuid": "8cd7d5ca-3146-4540-8c5e-1708501952b6", "comment": "Malware payload (Mirai)", "value": "2b0bd8841cb008c47cfae83405bd2c2be4cf0dbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401255, "uuid": "e9122cce-a80d-498f-8019-d8e6214d3cdb", "comment": "Malware payload (Mirai)", "value": "80f6261d40db97b5e222383c315f2b6bef1767f81e1e3e7225a781c544f9b35a885b266321b574daee1088a1c8ea3d14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401255, "uuid": "4a73c83b-4886-4dfc-80ee-754c27bdc4ed", "value": "T1B163A91E2E268FFDFBA9863447B38E265348339637D1D685E15CD6012E7034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401255, "uuid": "403e77aa-0155-466b-a211-6e2175bba878", "value": "768:HtiuAETFMzoIMXliZj71gsNQH5yc3DmReBs4nA4pl4PDeUB/DcqdyUs/EwRN:NwE5MmVyj7esWZRnA4plA11e/lRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401255, "uuid": "d98e97d8-ae78-4c98-b22f-10bf982c86b6", "value": 68588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401255, "uuid": "2a041ee7-4c66-45a2-ba36-7d38ab599761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401255, "uuid": "7de86333-8a8f-48cf-9ad4-f737baa98191", "value": "8db06ce048bb302e42470cbf9217bf2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77584cd8-6ba5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697406891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406891, "uuid": "bbedc1c3-5612-475e-8a33-f4e842939d20", "comment": "Malware payload", "value": "7cd1bb80040540153bc9220d7ef11ccf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406891, "uuid": "df5b52f9-1274-4e89-b0f8-bf79834a30aa", "comment": "Malware payload", "value": "7b69cb6bf6a15e5c5c62d9b1f9af26a70264c805d894229f730a9df64e91b668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406891, "uuid": "1d2d1779-2514-4127-bdc0-c7f5df231cef", "comment": "Malware payload", "value": "f0e1885fc91203232054f4c95ea2bec8818f42d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406891, "uuid": "cf5d3630-325a-4767-a558-5fdea8629ed8", "comment": "Malware payload", "value": "7024b0e4397fa4f0d7fce84cb9d11c18882027eea68f97f3d27867a3104d081470c059ded1feb93e08f04a6be4d2f994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406891, "uuid": "03c666b5-3394-4bd7-a94f-23d0648b8596", "value": "T10B534C8DE283E4F4FC0609302077FB76C676EA3A2174EDABD798B9639D61643D05225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406891, "uuid": "e64a2e95-8baf-4d6c-b960-a9772857d4b5", "value": "768:xzISb9aodzQLT5gTHwG/f+HaElKdZxK31dSlNcMfp8ABFaBKpnBSMUWUnPeSj9zW:xz3lEe/f+Ha/ZsWYlHsNVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697406891, "uuid": "a61591ff-733d-40aa-9fc1-5c65188111a4", "value": 62076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697406891, "uuid": "f4b7671b-8e24-46bb-a636-ed04a35301b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406891, "uuid": "17817664-6077-43c2-8b84-85965b922abe", "value": "7cd1bb80040540153bc9220d7ef11ccf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e20311-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353412, "uuid": "e99e3992-7f7b-4ec8-ac65-e331a7d907dc", "comment": "Malware payload (Gafgyt)", "value": "0a0a5603bbcf56c2aa75e4421ae2fac7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353412, "uuid": "f151b5d1-a7fa-4a1f-98f0-4b5ed0e98836", "comment": "Malware payload (Gafgyt)", "value": "7d63cd36f71bff785af91ba26c3693dccf8a28def857287aa78b20daa31bb95e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353412, "uuid": "6fbb86b8-2ef3-4e35-8ade-a12f4e26ae7e", "comment": "Malware payload (Gafgyt)", "value": "d8de786865ba933e1277ff31c95ea8c352c5c132", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353412, "uuid": "a0daeb91-585d-4e1f-b4c3-35e0b24d5b4c", "comment": "Malware payload (Gafgyt)", "value": "6741b3a0ae3306bb0bc2fc608a2bd87d66339fb66ebe1b94d1ad9daf85356e63912c1a1bb3ed54c8df2eb9300bd9ed66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353412, "uuid": "425fa7e3-0496-40df-9a79-f053be4e93e2", "value": "T1B7A35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353412, "uuid": "01efa0b1-e838-4052-aa80-aecace282cd3", "value": "1536:DEg/+165BDtuS5Xap3SQuqomJd28C40W2tNnAJfmsCskFw3DW:DXa65GSA6q7JduomDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353412, "uuid": "c767cb36-e94f-4e4a-97f0-71fb221957c6", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353412, "uuid": "9a8caa01-29e1-4bfb-ac15-0e4db893647b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353412, "uuid": "5b720a0d-4f70-46ee-be08-352ffbe2c164", "value": "0a0a5603bbcf56c2aa75e4421ae2fac7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51592d41-6b74-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697385782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385782, "uuid": "d2e982c3-924a-40b8-82ca-d3fc21b1926c", "comment": "Malware payload (RedLineStealer)", "value": "6db63d1bf65ab71f45c5af10e08d6fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385782, "uuid": "d6c03a83-6bda-47ef-b37a-a8ccc3d56685", "comment": "Malware payload (RedLineStealer)", "value": "7d87cfe680c8f1452c51f2d5c60da2fd39058cfe46a9bd8530d6f8ce143cf98f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385782, "uuid": "757c42bf-3c8c-4edb-ad7e-d1b8e75f5a4b", "comment": "Malware payload (RedLineStealer)", "value": "862d7880ece87b1d9b1b6adc2dae326f1832278b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385782, "uuid": "b826be73-7f8d-4e86-a1c7-56a5064cfe8f", "comment": "Malware payload (RedLineStealer)", "value": "f88571bb44afd9985ac75a984f6f0a6dfc04dc4252b650b95d787c28bec186f5f1bbc1a28873ec258c703423d535fa9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385782, "uuid": "172c281b-6c6b-49f1-8882-13e8110a8596", "value": "T1E5152316B3D4A0B7DCB05BF084F75A930B363CA29979C36B2B479D0A4C322D99971367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385782, "uuid": "a0395a10-0237-49bd-8e50-9bce1e9df6ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385782, "uuid": "e000d2bc-961f-4c9f-9aa4-936a76089cdd", "value": "24576:ByDynYpyaLIeuOKZ4yWk0l1AhyhKQw1dOfd:0D7pvLIbOKxJs1AhAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697385782, "uuid": "149e60dd-5cad-433c-ac09-a7d8d2e9cf3c", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697385782, "uuid": "5f63f8e1-44f7-4e8d-9ebc-074c01555d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385782, "uuid": "d5511e43-2a5e-4e49-ac91-b357d65ae1fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0686ae5-6b93-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697399363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399363, "uuid": "014a932f-837e-472d-a74a-f32f5e92f6ce", "comment": "Malware payload (RedLineStealer)", "value": "e0f8e61eb6a8e091e233762c858145e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399363, "uuid": "6bc2d2c6-990a-4c96-9ae2-c9f41ce7cff9", "comment": "Malware payload (RedLineStealer)", "value": "7d9e022752f3a56dea6642d5498f52ea8862c1e2a1b580476f8dc9948cfb4465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399363, "uuid": "459516eb-7997-4c3b-8326-257df8bfc111", "comment": "Malware payload (RedLineStealer)", "value": "09a191e05c7ebfeb1bfcc745435a8f111b68ac61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399363, "uuid": "386e5d71-5a81-497a-9a49-c415b07b71a0", "comment": "Malware payload (RedLineStealer)", "value": "0fd0f34a915f455d03f9b48f43099ff9f0a064d8d4f030f74bb35d637a71b97a3d0ea755e4a382013678e1d71d86614c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399363, "uuid": "9c1e163b-a8c2-4c4e-b1cd-30dce83e38c6", "value": "T1AC252317EBE95573D9F5337054FA02930B367CE21EB4472A6302D90909B32946B33BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399363, "uuid": "34ff307c-fc57-4c6e-9a82-b263f8fa11c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399363, "uuid": "46784a77-240f-4855-92ec-b4d92d30f114", "value": "12288:PMrZy90cCjO4IB6U7aLCrcG3V35sg0zu9IylCM3OBUaRPqdhNYp4jZVk6r7ccUPm:6yE5IsU7oCrp39R99CM3OBtRdl6/hom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697399363, "uuid": "6a3fdca1-feee-4aee-9f6d-7bda8385723d", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697399363, "uuid": "7480ad08-5c09-4c4c-ae10-01d27ce17289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399363, "uuid": "0357a6bd-9327-4cd9-8d51-8740d29c33b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6267c25e-6afd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697334700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334700, "uuid": "23964aef-41e3-4d96-8802-33eacf10f7b9", "comment": "Malware payload (RedLineStealer)", "value": "cbf9e663916587561716f7664e1760d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334700, "uuid": "73535ba7-30b7-4733-a076-bb96f456eff8", "comment": "Malware payload (RedLineStealer)", "value": "7dd9b4818a33775a0cd8944fbd82e0a036a60f1ad89a5d9378813903de90f657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334700, "uuid": "8b393b52-84a1-426c-a673-64c8e2bd5bfd", "comment": "Malware payload (RedLineStealer)", "value": "33b8675a44838af32b6d753ede2a6a5a717612e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334700, "uuid": "a82fe0c3-68f9-4a23-b601-8a8d1c153e01", "comment": "Malware payload (RedLineStealer)", "value": "3d5fb6180625a91601e6a2da1b90eef89adc95a859a07d5f53817f691824dbef01c8e3352853a1fa010d7333baa63402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334700, "uuid": "ad7bfabb-b011-47cc-89e6-a2c681a101e0", "value": "T1FB152207F7D888B3E8F6277469FB06930A3A78608C74529B1395692B1C73584F831B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334700, "uuid": "356319b2-c098-4b6c-b575-e2b79ceb9c98", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334700, "uuid": "57a8813d-86a4-44fe-911d-a031a23570d2", "value": "12288:wMroy90xV4PlJ961kNZL/1icaMydD07MD9FH8PdzU3CFlePX3YhgNau2vRyL:IyLl9fLt9d+46H8VzICIX3YuNaLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697334700, "uuid": "67a1783b-e901-4dbd-a030-c4b2e90365ac", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697334700, "uuid": "1af7f142-5802-44d8-bcb2-8b5d2202d0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334700, "uuid": "e334e707-65be-4095-81c1-f57cfa86f031", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca3556c-6b1f-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697349481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697349481, "uuid": "c3df9a9a-e322-40c2-849e-416e93b1c6f7", "comment": "Malware payload (Healer)", "value": "7e9fae8d7cc1200ab396adb65ccc63eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697349481, "uuid": "10344a25-d2be-4fba-8f58-1949fba17119", "comment": "Malware payload (Healer)", "value": "7ee31d9861f8144887ba4516b71831a3991858a6815faa8fd2b643b0265e5c38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697349481, "uuid": "24a6bac2-dfb7-4e79-af22-f5304d792384", "comment": "Malware payload (Healer)", "value": "40acce023862cd7dd0b1371a53adcd7a88c7727a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697349481, "uuid": "d3e56d4f-9e01-4866-81e0-fffb4316fc91", "comment": "Malware payload (Healer)", "value": "f956ed362689c1dc5c644071c720635006e60048a320f94db4324cc35e590e6665c95b2af34fa3c7d38df44ddd47eede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697349481, "uuid": "12dd8587-524c-41ea-9bcd-2d2a9bc55a4b", "value": "T19A151302AAE84033ED755B70B4F607530A357DA39DB443AF2622A96E1C72785F53633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697349481, "uuid": "75e212b1-4184-462e-b68a-da1708f256c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697349481, "uuid": "cc73ee74-0765-4ec5-991b-78f1223e6f77", "value": "24576:rysd2dsAJiOiIP7UXQWuM/72YHvyhovHR4JI:esd2KrOiISQUNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697349481, "uuid": "cde3e3e5-1287-4a11-b3eb-6e07961cd1d5", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697349481, "uuid": "51aa2485-9b6b-463f-be3c-e2e6c02791ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697349481, "uuid": "e2b5ae99-3eee-415e-aac7-fbeb9f669a5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f3ba51-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401280, "uuid": "72ef2f41-0d5c-4ef8-ba9f-08076cc06c15", "comment": "Malware payload (Mirai)", "value": "b4592f4a655a60325ec38cbd50501806", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401280, "uuid": "e66ed3d3-5edb-4b40-b486-b5cb3447a0f0", "comment": "Malware payload (Mirai)", "value": "7ff2591214a753ceac549273087a30f7eb0a09d3d543d7dd80a9bf07d09a4ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401280, "uuid": "62ae8592-13cc-4249-8751-6c88ab9579bf", "comment": "Malware payload (Mirai)", "value": "7920ed010c7dbd3d285c131bb02fe1e6356d2bc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401280, "uuid": "9246d1ed-5955-46d3-83d8-af9b216e55b9", "comment": "Malware payload (Mirai)", "value": "e9d66c172ef3e31d70e754caa96f988e1e73887d5ebedf923f0804c29e0fb0ba5416d67cf11b64d67772f31292765db4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401280, "uuid": "57bc3034-f055-4614-93e0-ba8ef12917d0", "value": "T146531A96F9818E11C5D413BAFA2D018D33136778E3DFB2239D106F25778A96B0D3B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401280, "uuid": "73308dc0-1282-4635-8458-71c420a7e0e9", "value": "1536:mDnAR2cF3CPSN7SrRJQ0MtiAAKKoa61Rj:Px3FwSAKKoa61R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401280, "uuid": "3bd99e00-dd54-4c99-86c4-50243e4fca64", "value": 63060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401280, "uuid": "6c788866-fd72-40f0-b80d-b63adbb8138e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401280, "uuid": "707d07ed-69c7-4c8c-8422-ef6f5782d551", "value": "b4592f4a655a60325ec38cbd50501806", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d52a38b-6b24-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697351415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351415, "uuid": "f6ec883c-f79f-4735-a1e7-d8dd37a91687", "comment": "Malware payload", "value": "69f4f9e005cdb2e85a9be4b154d58881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351415, "uuid": "b1a4ea89-a172-427a-82e8-9e8434030ef4", "comment": "Malware payload", "value": "8019944a846ca0e4b3f63b84a92e2e5235343a28b116fbbfd39baa9bd08b69d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351415, "uuid": "4ef51d63-52a1-4558-b76e-066dcba6d42b", "comment": "Malware payload", "value": "730afa1abd4ff2202264cec65fcb6854875c6910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351415, "uuid": "c7474e49-4825-4640-a1d5-4eac1bcb6100", "comment": "Malware payload", "value": "05f2fed6781f2f92684d6d2ed699511c0b057c8f12de5b0198eff8530f83b06f0de9f14d1f735551d3613f2bf4d4f4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351415, "uuid": "5b66a2ec-31e9-49e7-b368-9b61dd71fa75", "value": "T19B346C5362F0BC50E81647338F1EC6ECBB1DF560EF59AB56221A9E6F0A72172D263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351415, "uuid": "f6940f1d-f097-4241-b0e7-7949e0e6aa5f", "value": "ac884caf40631ad7d38fc4bdd9ec1343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351415, "uuid": "b8505dd7-a169-47b1-8568-2c4af46e662e", "value": "3072:xhK/PFaHNlCwQ+Y4ExbH8Ktd0I0Kg1joOBJFc5ziTfCkqQU:mnFyNlCBb4ExQKtbg1oOZCiTfCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697351415, "uuid": "8ecc0cfe-568d-45b6-97e9-e5934ccad00d", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697351415, "uuid": "b721f17c-58cc-4d60-92aa-79171e5dcbf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351415, "uuid": "4f5824c3-f524-4456-81fd-8a4415765452", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b421b93-6b8d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697396455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697396455, "uuid": "a00895ba-cce3-4f63-b5b9-1602dcbf6a01", "comment": "Malware payload (RedLineStealer)", "value": "2ba0dd909834cf4c4eb4e3a94b17b149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697396455, "uuid": "087f5cd3-01a3-475b-9867-725f00f174f4", "comment": "Malware payload (RedLineStealer)", "value": "816d4fd6ca3b5dcba1a2a355e5198f413aae21af5d8e53bff74b02e59345f9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697396455, "uuid": "3081b89d-6580-4ae4-9cf8-814b194c6a5f", "comment": "Malware payload (RedLineStealer)", "value": "7e0f8c499a6a567abb1a0d003300ba90ca7f373b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697396455, "uuid": "04bcbcbc-493e-45ec-91c7-f2e85d4b36e1", "comment": "Malware payload (RedLineStealer)", "value": "4dd18224efc14b26777fc61bc6862d32c6f9efc3c788838b2fd429ea107075b5d769c374ed1decfe1dec6efc3256f66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697396455, "uuid": "6bf88af4-6338-4467-8166-390a018ce014", "value": "T199252317F7D98567E4B123B42CFA07830B767CA22DB8A22B168B595D0CB32D0553276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697396455, "uuid": "11e97d94-9b98-4f79-aa97-9729feeca0bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697396455, "uuid": "bba200c4-38ad-4ac9-b07a-0f9910a0bc30", "value": "24576:9y3jr1ELLw03ZJWFEmT2m217y6Qzt8KO7i:Y3/GLLbJyEmT2mEyLZ7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697396455, "uuid": "84f82ef5-998c-4cae-8ea6-546103dab78a", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697396455, "uuid": "f5957d93-d12e-4456-98d7-415501978209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697396455, "uuid": "d08769a6-8a2a-4fef-ba78-b2456cf3e124", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cce2b5-6aff-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697335462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335462, "uuid": "7051c564-5b5b-4fe1-b995-9326c57b2212", "comment": "Malware payload (RedLineStealer)", "value": "0d43253f03bf1f72de5150725c4b0109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335462, "uuid": "b82647f5-bb53-4b63-92ef-1b3f5da6f8e0", "comment": "Malware payload (RedLineStealer)", "value": "817b97a8b171a614c612366ab2dbeafab4dcc8dd161d9a06f8865f5f681b6072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335462, "uuid": "f31533ef-1dc6-4cdc-ac6e-764e2391cd20", "comment": "Malware payload (RedLineStealer)", "value": "4ede53c748836f7d2ed42a764d2210b3bd4f6371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697335462, "uuid": "cfdd3ea8-fe29-4d34-92c2-29aaac444e2c", "comment": "Malware payload (RedLineStealer)", "value": "e160bf2f82c9899051c22eeabf5319235588ef02726c49f648275423c6c4c89551e6ce975989b2d07cd408521daf0bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335462, "uuid": "ea1cd173-a1a5-45ab-9165-bd0c0da7359c", "value": "T1BF152313B7C89172DEF817B024F603930A397D508DB8938B2B46AE5F5FB3194A935726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335462, "uuid": "81c335c1-f647-409d-a61d-9bc6b4513405", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335462, "uuid": "57ec6175-661a-4a61-ba7a-c2bb9bc11269", "value": "12288:RMrDy904KbN4Fc9qmIw49iND045SrOZudA+O95nMK2GUbCUi6IpRPOvoFc3Tbn:SymCC9qmIwegSrqud29BzLWHiN2Kcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697335462, "uuid": "b5a3a7b8-8eb1-4a29-9d13-ab3c2e8ebf6d", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697335462, "uuid": "1fa8c166-4b45-4e7a-9e28-593c90c63a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697335462, "uuid": "50b0f976-8ff7-4dc6-8391-fec53d19448d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c60320-6ba5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697406886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406886, "uuid": "f3525f30-8b22-45aa-8850-e6b35d688207", "comment": "Malware payload (RedLineStealer)", "value": "dcc2e218f0c9faee3291c2cdda59d791", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406886, "uuid": "fd15dcbb-532c-4b06-8373-ae95f5ba8bb5", "comment": "Malware payload (RedLineStealer)", "value": "81847864d2367eb14334b5bd9231e8b1946a0958aea96126771d22f89d1f837f", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406886, "uuid": "541f399d-1513-4392-9584-4b013504e952", "comment": "Malware payload (RedLineStealer)", "value": "db80248e655890948227fd450136c17099126edc", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697406886, "uuid": "a7f78187-f81d-4402-bd92-077f88842bdf", "comment": "Malware payload (RedLineStealer)", "value": "d9b9308844a200283aa4cc50f10fbf120f4dcc91097c3b72f582265d7cef9b7f885482462044e0e49393d1a53e7e5948", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406886, "uuid": "95e7942a-f3fd-418f-9bd1-ca441e9ff4e1", "value": "T1E414127DB6061D14E638AC2C27728C62B9ECA76918953143793B4FFD0F16712BA8E0D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406886, "uuid": "04c09340-8952-4572-93cf-0f0b7c4870ed", "value": "6144:lut8iMq7fdlbQd7qp3lV/nPZ/GDQYKIvFg:U8iMqpu43lpntGDQKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697406886, "uuid": "c69f2f81-6d65-4df1-9bb9-e51f8fb494de", "value": 202753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697406886, "uuid": "489e8b7e-8518-4835-977f-6b0a90ad367a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697406886, "uuid": "0df1e312-d4c1-47ea-8e75-c26fbc439a45", "value": "dcc2e218f0c9faee3291c2cdda59d791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5637cc-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409748, "uuid": "fcd1d6cc-748e-4a29-97ec-71b37a04d605", "comment": "Malware payload (Mirai)", "value": "99331655038f0bd69b94b7e15180b157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409748, "uuid": "86a3d699-491a-4978-aacc-b8e86f9ae94d", "comment": "Malware payload (Mirai)", "value": "82ef9605be8b15cf24c40818242fb4e4373825fc52905de7d5336409f5dbba98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409748, "uuid": "1bac3469-14ff-4f41-ac8c-7c10518505de", "comment": "Malware payload (Mirai)", "value": "99f11cfa889170f9d2d556ac90055a2ddefbd157", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409748, "uuid": "11e962c2-5278-4db3-beca-8c6252dc0795", "comment": "Malware payload (Mirai)", "value": "5a4d8077a3a07649ab3027df295abe89771f5bca14884e550915266fb283784ece6a56a8abf1bba8e7b0cefa3f71d3de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409748, "uuid": "687706ed-7461-4ae9-b629-ba78c2567cb0", "value": "T115C2E0E0B726FA31C420AC3DE53A4D893A51067CD1FF393664258D35CEC1A5B66B84B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409748, "uuid": "608ed3d2-54e4-4540-8fab-c09149b302c8", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrk9q3UELuX:NKy4qfqoeJdXWgNLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409748, "uuid": "a8dd9fa0-8b04-42d5-a475-25ae06f8230b", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409748, "uuid": "479269f6-c039-4cfd-9eaf-0c9a93e8f608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409748, "uuid": "2ce2359e-d005-4383-8599-93079e28fe39", "value": "99331655038f0bd69b94b7e15180b157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f15c9e-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409735, "uuid": "7598cbc1-d221-45ab-9ec1-e2a1cb31eac1", "comment": "Malware payload (Mirai)", "value": "97a544a85dfab4c4eff34f363d6c0468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409735, "uuid": "42a4c3d7-2ab3-45ca-8308-9bd86aa8ad49", "comment": "Malware payload (Mirai)", "value": "82f7dcab7e7c94b0e42ca72a6f8f6949e1f8cfe3b19936af9670eae05e01442c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409735, "uuid": "4a0db7b6-38bc-4c70-9514-2fd032c0254b", "comment": "Malware payload (Mirai)", "value": "9cee7701afcb75056bacbcc03c22476f96ab20ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409735, "uuid": "328e1700-f38c-4911-aee9-75caa6f7aa6b", "comment": "Malware payload (Mirai)", "value": "50ec094b561c8f9a178a382d2278ee52a2d7b7154cef49eada03ea181664270f14eef614aea2275c18fadfdfd0059530", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409735, "uuid": "f507c5ec-f27e-485c-88a7-6fd9bf2aff3b", "value": "T13EB2C0CCA4543084CA8D7C7C578D4A674F6CA1D0BAEDDB16E350CD98B3BEA4B3859079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409735, "uuid": "1224ac6a-6b6e-474e-afe2-1bd4ba832b9d", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpGEZqSWv2:4QlS07FUXqIYSXQKquG8qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409735, "uuid": "27e99d8f-a6f7-4439-ac82-e4b24a9b439d", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409735, "uuid": "b5de1eb5-f8fb-49ec-8c90-8bb7734e7710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409735, "uuid": "fc13ae1f-b745-424a-9b46-d79a1be9ea33", "value": "97a544a85dfab4c4eff34f363d6c0468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194bdcbe-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409739, "uuid": "8768e282-4453-43ac-83aa-e21bbb139b63", "comment": "Malware payload (Mirai)", "value": "74be794c33b0568b6d18b1dd4f30f4d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409739, "uuid": "8c3ba81c-eb5b-41ea-ae18-02dcb54d3132", "comment": "Malware payload (Mirai)", "value": "85998573f525d0bc4bdba3472dd76ee44ced9643d9eb6bd4f781451826f894a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409739, "uuid": "eefde1d3-88d5-401c-b629-4b23c5a9380d", "comment": "Malware payload (Mirai)", "value": "19abd852f85c0a2406c7dcfb5a73c81da2cd97be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409739, "uuid": "4c7ad895-25c5-436a-a617-3849ff2ab4ed", "comment": "Malware payload (Mirai)", "value": "d279ea2731fad29ca69e890a3a6b603d818ac49f346049d2d80f7bfc629724b7f30fe4466035524becb3abe2d474d7c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409739, "uuid": "829af9d5-fc34-45d4-a817-2f32f608f297", "value": "T121A2D11472A32D66F3ED1C3DC96A835BB9660BFC90F6327669401630CD4D24A2E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409739, "uuid": "de3e6703-33f0-4c0b-bb5a-27b8b9fca9b4", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjCthymdGUop5ho:vvQn4j+ZO5fKAlxWts3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409739, "uuid": "9322bbf2-17a8-4a4a-a957-20e778b06e7c", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409739, "uuid": "fc821485-046f-42e0-91ea-8ec446256ab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409739, "uuid": "f7830da5-7bb8-4ff1-af0f-8c8bb8fbfd17", "value": "74be794c33b0568b6d18b1dd4f30f4d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111aa771-6b42-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697364199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364199, "uuid": "2ebaf70e-1c4f-493e-833b-22f1fdb52d2b", "comment": "Malware payload (RedLineStealer)", "value": "475b5e2b5c557979210ee92541e81e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364199, "uuid": "e897cf48-b277-449a-92c5-3f475fe32f4c", "comment": "Malware payload (RedLineStealer)", "value": "88538ade562cb5b8fdf599a711369cc4fc117c0d36b71c86f27b42b7b914cdb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364199, "uuid": "7097f40f-8b57-4dd0-bc6e-b254c254ff15", "comment": "Malware payload (RedLineStealer)", "value": "81996a43425c5816f2c94faa6b1f6a76bbaaacd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364199, "uuid": "3d6b424a-f53a-459d-a00e-550ebf5bbb48", "comment": "Malware payload (RedLineStealer)", "value": "123e7091237a3786204f3f52899cd486932797bd072e4a55b17ae00c0668213ce773a871860e52795194c076b9d99393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364199, "uuid": "ce1a79d9-2df6-4008-8f97-c71a748b6d23", "value": "T10C152212ABE85026DEB567308CFB07930E39BDA498B193DA17949C6B1C737809572F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364199, "uuid": "f8112f5a-a5b4-432f-9f10-32a1d3107a32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364199, "uuid": "4e85e8bf-5c4e-47bd-8b84-798c10e14245", "value": "12288:VMrKy90AeA3B2IuVTdyXOi2c1Lv+pc6B6F4YyYyTVdP864RAduMofUe5d13jT1Th:TyGxT76xvacs6FDyVjyRN5zVkVa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697364199, "uuid": "a4eabc44-bdf7-4a54-a2cc-c44f418f8d25", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697364199, "uuid": "630ad2c0-3a98-4e8e-9428-646f659ae99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364199, "uuid": "b51e5539-9d62-44ba-8c8d-ddc9a549c72a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c873c62-6b4a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697367815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367815, "uuid": "6c2e8e4e-2b4c-4f5c-bcb0-1c8abc591ede", "comment": "Malware payload", "value": "a953ad8c903f22965c21cc626a257cae", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367815, "uuid": "2ca28a30-ef83-4179-b907-08a0b963b906", "comment": "Malware payload", "value": "8883e7dadf9609d411a9accb0aaadc5226793139d306afc80054d93aef5c10f7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367815, "uuid": "fd7d464d-1736-4930-9c7b-d798014f499f", "comment": "Malware payload", "value": "7eef9c8e96b14a27f69c1909466d2d0bca786b99", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367815, "uuid": "2562746a-5cf2-432e-9563-3e91da61eb56", "comment": "Malware payload", "value": "221c5e333a8662e10d457d2a32793bcbd129d99e5113f84a4371ddf3c8db05d7978688975eee9561d0d853181cc7bc4a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367815, "uuid": "ab95353e-554e-493b-9d65-2ff0966d7347", "value": "T14241E93FE22832B10977455F5205F574AFB7005A5B21AB72F405CD3E39A412A96F90FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367815, "uuid": "80d62a3c-0941-4d36-bdce-69cc746e93d9", "value": "48:ElzCJnMu4wZGHmtHwf7KF3FPpSvNfzyBHRzhst8mIJbOsBxv23PLJP:El+tP4wZGcyq3FkNaHRDBkfL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367815, "uuid": "0cf3fdb3-d0c9-4975-b84c-a304c890ad0e", "value": 2116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367815, "uuid": "37b6eac9-2987-4c5b-87fb-167f76b5e722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367815, "uuid": "f7f84b32-1a07-4d1f-be4d-349b2c8fd5d3", "value": "1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdce83bb-6b36-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697359335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359335, "uuid": "bf1a7ebb-35e2-4758-84c0-b7cefaa1444a", "comment": "Malware payload (Smoke Loader)", "value": "195bdda36a48f126fc9801aeba29cebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359335, "uuid": "858dec9e-5029-48f8-b5e5-3a2faae42e07", "comment": "Malware payload (Smoke Loader)", "value": "89797297ce145c9bb7885fbe2d79a482829e1d789e3112f785f6cc6348134db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359335, "uuid": "34a51cf0-c544-4837-8df5-5491ba090d02", "comment": "Malware payload (Smoke Loader)", "value": "c5886eeed021cb4047c914da21ae9a475ee575a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359335, "uuid": "f28f24aa-68e7-45b2-85fd-4beb35a8ec2a", "comment": "Malware payload (Smoke Loader)", "value": "3436bef1140e84dc179228bf8f42e6c3640c6db5bdf74e3e47ae444ed6bdd6cc7274ea277bcc8310137d7a5f4555f9fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359335, "uuid": "05e6e10b-54f8-4287-ae55-6836c4dcbde6", "value": "T169346C9362E1BC61E4164733AF1ECAECF71DF561EF58AB5A22088E2F1971172D263305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359335, "uuid": "0ab2f1f1-09c4-480f-ac4a-f9ceb0eacd7b", "value": "ac884caf40631ad7d38fc4bdd9ec1343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359335, "uuid": "74d8dbe5-a6b0-4432-a87c-c27f55e1dffb", "value": "3072:zr5xP4AvnNoreeMqlYCQn+qhbN1jf46K6dzhh2ShuZG4vPbrHGl5zi04ClUj:RN4AvNorlplYCw+sndzGZG0Di7i0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697359335, "uuid": "9fe10e1f-d714-4abc-9844-34cd8e523a3e", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697359335, "uuid": "987199e7-6bc7-4a9c-a58d-56783d5cde34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359335, "uuid": "9acf76a0-6ecf-4f9a-ad7f-403e53db59d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae592df-6b94-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697399407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399407, "uuid": "6fa2094a-f46c-47d4-bae9-41f09a8925ee", "comment": "Malware payload", "value": "7dbe86a266c412adab0af9b3f054df37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399407, "uuid": "6f6e0cf4-388f-49a7-969d-6b3b26c1089c", "comment": "Malware payload", "value": "8abf6d62b56c191efa6573e515744eb1056f6d6dbd4ba456c939bb3f2aa539be", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399407, "uuid": "a23720f4-e7d8-4013-9133-1ecaf5a077a6", "comment": "Malware payload", "value": "a5370660eb1203a2da9921e0d14e80be8cce08c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399407, "uuid": "7bb44543-4fe0-46ef-8649-44f37abaf7cb", "comment": "Malware payload", "value": "88b938f50ba694dfd2c35214830e98a9a81aa1574ff7cd73a027dc49ebcf04d2d273a33a19f0e5debea86f87d261fd92", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399407, "uuid": "b2ad3772-e4cf-4f07-8097-85082143bdf6", "value": "T143332981B8819A63C6E013BBF66E42CD332563B8D2DF7217DD226F51378991F0CAB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399407, "uuid": "80041350-c08d-4263-9ffe-bdd695c4e8f3", "value": "768:HfVIY2vGSvbk+mhKssCk+r+w3zD/aTQpEHoOWNVIDvAdhwR:tIteSvCke+YE4G88R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697399407, "uuid": "21741f64-1713-4261-8759-c6a39f2822eb", "value": 51556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697399407, "uuid": "08ddc14d-cd49-4b5b-8eed-07a45f8256fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399407, "uuid": "233b0895-8b61-4bd2-afef-973aed04fa43", "value": "shindearm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6b0c83-6b59-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697374231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374231, "uuid": "8768c1c5-dc8d-429a-bfb5-d1a5f5477a55", "comment": "Malware payload (RedLineStealer)", "value": "f231ff074fcbd6a6d8e2b4db9cb9c37b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374231, "uuid": "4c1c300b-168d-4b35-a74e-41d57b262186", "comment": "Malware payload (RedLineStealer)", "value": "8c08df336c91910b120bd67cc460d4518d856359625600483a01907afb0ccc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374231, "uuid": "b7c2d169-fb6c-4a2a-8961-d473de18c22d", "comment": "Malware payload (RedLineStealer)", "value": "5528fe9224fe375be66c0c413409dcadd9bc63f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374231, "uuid": "e0b0760e-575e-429d-b721-4f6120c7fbc2", "comment": "Malware payload (RedLineStealer)", "value": "bd0f41dfaa31c669cfca33f793dce5eca643cdd12e981b45f5d58f7060348b37461c72ac6e1b59ba6d12be5806bf099a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374231, "uuid": "54cccc2b-26d9-40ab-b869-20258eba61a9", "value": "T14415229236DD9032D9F61BB058FF16830435FCE5CA79863B1B40A86A8A73DC5A532737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374231, "uuid": "1714cbf0-6440-4ad0-a9b5-5586ab657e4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374231, "uuid": "ece43ddc-4d6f-4526-9cc8-3f4ae1bca81d", "value": "24576:UyRgxir5IuqpxzbMz6L1J+FkkDu+h/L5x+:jR6iuLzse+pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697374231, "uuid": "11770aef-3cfe-40e1-a2e3-011854059c1a", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697374231, "uuid": "df379802-47b6-4294-98bf-e8cbc3dcb373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374231, "uuid": "546bf91f-25e8-4902-90cf-5bcbcec5ab3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebd6fed-6b4a-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697367658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367658, "uuid": "b8f734e9-a3ab-4ed3-abad-3b36bbe331d2", "comment": "Malware payload (RedLineStealer)", "value": "a087a82bdaf96ae4faaeb8c51dd84e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367658, "uuid": "517d0429-c120-41aa-8f87-46e0c755c749", "comment": "Malware payload (RedLineStealer)", "value": "8c1bff991e1f05fbd3900dbd458329c58f9d6beffb94a7430a3617bd05f71c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367658, "uuid": "7da37d36-bf22-4253-afce-6185533451d8", "comment": "Malware payload (RedLineStealer)", "value": "92d4b6ddb762078c3b7529f6bbcfac0f82b48fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367658, "uuid": "bd68f7a9-a601-4e64-ae0d-cd3c83bf777a", "comment": "Malware payload (RedLineStealer)", "value": "4f7d139e70dfb601c1c694f613d46c15dbd07ae5d494ec643d01ed0b4a92490871a952b2a77415456542733db95abdf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367658, "uuid": "283cfac2-e626-48a5-911f-df86f649459d", "value": "T130152313BFEC4477E9B4637044F703830725BCA2AE74576B25CA996E1C71B98A83437A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367658, "uuid": "6552255e-2b87-4144-b249-dde72196166e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367658, "uuid": "9234ee88-6b23-4742-9de3-3f3d5b492cf9", "value": "12288:OMrmy903ZB3/iAiaIqClG8vqfM9Mvl17c1oN18lI/MJfE3xxBQefc1yob8vZ8bFJ:Iyw2G8vqksq1xI/w8xjfm8vZYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367658, "uuid": "e42bb3cf-d3f8-4cdb-b50d-084d6d62af85", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367658, "uuid": "c1605b18-41c5-4350-94bb-446d25d1562c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367658, "uuid": "242497a6-2781-4fce-a8cf-e65d595f7952", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0093f8d2-6b7b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697388652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388652, "uuid": "a14cd31b-7c17-4746-b134-7a5d26b6d036", "comment": "Malware payload (Smoke Loader)", "value": "e699123318acac9faaf1f28a62aee521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388652, "uuid": "62d4b2f1-61f0-42d6-a64a-f8cac3c9495f", "comment": "Malware payload (Smoke Loader)", "value": "8d423d5ee4bc84fc088ff35fda7656d0385d35fe1fd6c3cc575c9699cfbb7e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388652, "uuid": "3763b3fc-5739-4826-a150-b30a47cb3dec", "comment": "Malware payload (Smoke Loader)", "value": "6bacb67303997a8cc530b848931237dc130392a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388652, "uuid": "edcf0bf5-ea30-4d40-a2cc-e372ec258ebd", "comment": "Malware payload (Smoke Loader)", "value": "ff3e62498612caabed411816d742a4435ff22390d89f3afe311cfaa628f10db9fd031d0f3486a8a3a6201e79a6a553fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388652, "uuid": "97818c15-195d-4487-a211-72dfd0d35753", "value": "T18F444C13C2E17D50EB368B728F1EC6E8BA1EF6708E497B65261CAE6F0470172D663711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388652, "uuid": "a076f0da-07c7-495b-aec4-088845a1b8b3", "value": "2f16a3a753ec35e9c4b47871bbc2a2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388652, "uuid": "fe36f070-b6f4-455a-a62b-5fbf8b394006", "value": "3072:1hu9ePxRM+qvmzgLD9TD0Rx3odhT48stEY9L65TpEbzA61DvXdqoI:yep6+qc0RT4ic8QgpEbzA61DvXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697388652, "uuid": "b3c611fc-b517-467b-bd10-edacf9b2fff4", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697388652, "uuid": "b3b663ad-3181-41f5-bec2-6cc549b514a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388652, "uuid": "b5b61dcf-c73c-4797-9b2d-c5c72a26adcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ec7426-6b74-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697385930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385930, "uuid": "03094727-3ca1-4bc4-b5a6-f248ae9664ec", "comment": "Malware payload", "value": "b3a69d39ea2f074e520077721b475d51", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385930, "uuid": "4a79bf18-d87b-4f35-82a6-90aad1811b71", "comment": "Malware payload", "value": "8e28ddc558064889072da509008e162887252a6237d305b528620508b450f725", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385930, "uuid": "810583aa-eca9-4d84-9316-12195a06f892", "comment": "Malware payload", "value": "fe4ac7309f7e08b2fcd4f4005966548e35650154", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385930, "uuid": "b00350b4-642f-45eb-b0a1-40eae1bb3002", "comment": "Malware payload", "value": "ec0a7ac7f8bb24820b6fb6682d4777cc2ff038af4febc1c38d9e717b4b566416b92d434ad684090f218f1335b4b92209", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385930, "uuid": "144382c1-80a5-4763-a91c-769773998d80", "value": "T1D272F9C50244ACDD6CE8F7C5997C2A5E5F4105B7320916E3DB30AAFEE4BAD0E192CE46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385930, "uuid": "f359f0b1-03b8-4e01-b61e-e1032f5e4daf", "value": "192:WqgAUxKcGb+e64JVHzWPUgPYL1eKfTQhDcqsOHQXhSnP:dgA/RFOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697385930, "uuid": "35f5d3b1-81d3-4dd0-934f-05360e3819b7", "value": 17197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697385930, "uuid": "88da4b2b-6c03-4fb7-97a0-aaecc7157ef4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385930, "uuid": "f5596a0b-468e-4e41-bf3b-7a0a48b438dc", "value": "9298fefddb1796b95b5674e951d59d0cbd1fb2a4af06572ed05233f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30b4476-6b38-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697360256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360256, "uuid": "4a4b26a6-cd26-4534-a958-99edd920fa77", "comment": "Malware payload (RedLineStealer)", "value": "6d63c0e7ddd98718f24a8e22c2d1d988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360256, "uuid": "c75ba07c-2576-4714-a6b9-7c76b07081f5", "comment": "Malware payload (RedLineStealer)", "value": "8ed268c5217515001d15b7d08afd3c42f6d494ab389d3fe406cc1c162c69fcdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360256, "uuid": "c52b0bf9-ff73-49bb-b9a7-0de59498c073", "comment": "Malware payload (RedLineStealer)", "value": "5ba931b3f7044e3789fc5164e49346a1a9d000d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360256, "uuid": "b68d1bba-d2af-486f-a2d5-ab4d5e08705a", "comment": "Malware payload (RedLineStealer)", "value": "03c70141d9c138dc11974ebdbf83c536c568ff35f1b8a302c3b7adc76f466dea7ed6144695e3fded88351216918b3577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360256, "uuid": "648e0337-6ba7-4f39-9ae9-a05f535f3fcb", "value": "T1C8756CE03F8C8172DDEE2075C2ECB764C66DA0AC0B2656D756C45EFD8A106F1673268E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360256, "uuid": "d3ff7e2d-81da-4659-88bf-5dea6b96f990", "value": "e367cd2cd00d41816448f9c2b20f0e47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360256, "uuid": "22b25412-362f-4d7b-8bc6-f31042f5fa4b", "value": "12288:X7o9H8UPBmcjeOqPKpfwHfBJjB0pOHZUeAj4hvCsBo9eubQg1mXxgJpke7m+s0:89H8mBmcjeOqyYJ1FhvCsQCCYe7md0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697360256, "uuid": "22d83dce-5a16-4252-af02-1f5a8be9a785", "value": 1574912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697360256, "uuid": "b4c9c3fa-0bfe-43d4-bc88-1cb3aaa25679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360256, "uuid": "a046703c-987d-4ad8-8d23-7a7618f92090", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b337d38-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376886, "uuid": "94e2f993-7a46-45f9-b469-5943c9ab7cfb", "comment": "Malware payload", "value": "e280b01463c6c7ad6df493c58143a6b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376886, "uuid": "b7d7de32-b55a-48d1-bc4f-8d4152197808", "comment": "Malware payload", "value": "8f5fb4479b94c442c021bbf817b59964f9f90e59cdffb1affb2caf9760c2f395", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376886, "uuid": "d12b98de-8722-41e3-9640-5f65e2edec97", "comment": "Malware payload", "value": "7a787a864a96ed0ecfd8903f32f9cc4f47b2cce9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376886, "uuid": "f93caab2-f46c-4769-b1fa-650c4d0aa19d", "comment": "Malware payload", "value": "40a2acc66b7fcb87a45acfdcf14f1cc2ef0b7ec232d4bae131f97e9d2c46bfaae3b9f6f816254e75ac9d8d169394a404", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376886, "uuid": "f5d974fa-0d5f-428d-bea5-c34fc7208637", "value": "T125D3AAD5438E4328C0D1B36E19BC7F9BDA80A95527F47D97E12CFA5DAB8882D33580C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376886, "uuid": "58eb5053-6bce-4b17-b8de-a0a8060ad636", "value": "384:dtttttttttttennnnnnnnnnn8tttttttttttennnnnnnnnnnvtttttttttttennO:0ckBSyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376886, "uuid": "1b7dccf2-8643-4ddc-bc06-6ea681217b1c", "value": 132371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376886, "uuid": "85aaad8b-496b-4c7e-a626-747ddb20f61e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376886, "uuid": "ac530c4a-1ca6-4b85-8d13-4e75968369ea", "value": "e280b01463c6c7ad6df493c58143a6b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5cc233-6aef-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697328571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697328571, "uuid": "e50ca4a4-d83c-433d-9615-bfa0a7bb8579", "comment": "Malware payload (RedLineStealer)", "value": "d4d2e1ff2787b4f220f64fb4df76dd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697328571, "uuid": "e1573aa4-e3ba-4023-82f7-9c1d9205a185", "comment": "Malware payload (RedLineStealer)", "value": "9199be7aefdf13bec12f84faddd5a722429a511427ff866aa31ddc80095c5a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697328571, "uuid": "0016ede6-7d17-45b6-82ca-d0d6eb6a3068", "comment": "Malware payload (RedLineStealer)", "value": "9c57173f5b93630e95f27b1d9fa2946d2584b544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697328571, "uuid": "5d0a7da4-0f03-4f9d-867f-13c74ae01508", "comment": "Malware payload (RedLineStealer)", "value": "3c21d343ec25a9159157abc34ecd5cdbe1923435d76b06901b0960bd02a49710ab9d7d315e7458aa09c7ffd29d7424b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697328571, "uuid": "233329c3-ca09-4617-b7d8-43e62495e814", "value": "T1B3152213EBE95167DCB02BB05CF216970A313D60DC781B9F6B85589E08B2788963277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697328571, "uuid": "efbfd802-313e-42df-869c-d1e4384f3c78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697328571, "uuid": "5324acd6-a0b4-4d97-936f-c8124f433f5f", "value": "12288:oMrqy90xWPPmw0SMP2LASWOCeAXE9HpjFzFfUYJLxH5gUqtmAjVX1QD8sfQxn:Sy2WPwSAneWuhfUYdnOmqVX8DQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697328571, "uuid": "4c57c331-cbc4-4eed-9a58-e2abcb382dd8", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697328571, "uuid": "e7b876e0-ad3a-45be-a021-71d09171b640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697328571, "uuid": "9a1cdc42-7fd9-46b6-865e-c82523f9ba12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20667883-6b62-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697377968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377968, "uuid": "3169fd3a-e62a-4b52-a645-9fe343638154", "comment": "Malware payload (RedLineStealer)", "value": "13c82abba511b29c29759cc07b294014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377968, "uuid": "aee15edd-90d1-45c4-9dc8-986b7add35fa", "comment": "Malware payload (RedLineStealer)", "value": "91f2a73cebd5e85be02c2a1a1a799e94fb6c6416638c0efd4befabd79c6d91c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377968, "uuid": "f6d607ca-83a5-4711-9f52-46105ec166ff", "comment": "Malware payload (RedLineStealer)", "value": "2f22da98795f6e779c506cfefd6d805b79a82a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377968, "uuid": "b1ede063-c3b5-43f4-9c06-7fd05dd4bb8e", "comment": "Malware payload (RedLineStealer)", "value": "254e335ea6ee62a51731e78afc9a5b48ed41a68b2b6929512f15cda93c3a63bdaeb4af6782feba77e67f220fb7db52f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377968, "uuid": "38b95e1f-42f4-4c8b-8558-df9e48731205", "value": "T12C15234676E84033D9B52B7049F307C32F36BEE15878822B2785E87B5DB168598B371B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377968, "uuid": "2b53e1fb-bdee-428f-8d22-8c714f46ebcf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377968, "uuid": "f0c5bca9-9e8e-4865-bb6c-4e56ab97565f", "value": "12288:GMrXy904GkOSyST41U00patB3Qjv2R9wI1+LiP0VQtEwWChRFBkb/4okKy:ZyuMTWU00AL9H1+LKwQu0hRTAXTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697377968, "uuid": "95d10e21-f7d6-4555-b76c-382f4f0abf6f", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697377968, "uuid": "800ebefb-37b1-4814-9223-a8c7df7820b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377968, "uuid": "5a2ed74a-2a92-45fe-b78c-26f1be7e69b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2191e359-6b8f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697397298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397298, "uuid": "79a5328a-9c4a-46c4-b2b3-6a474a858b3e", "comment": "Malware payload (RedLineStealer)", "value": "a8d2445b5c56c0b286226326c146d7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397298, "uuid": "b39a49fc-3610-4bbb-bc7d-75b5ad0bd280", "comment": "Malware payload (RedLineStealer)", "value": "9254d3f2a9044a85c97da326c0e587a54dd622ac5952095d8b769cfe435713cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397298, "uuid": "c80e01af-77a3-428b-b12c-1a3adc8e66f7", "comment": "Malware payload (RedLineStealer)", "value": "4a4cad467556c38b96475db4610bde9ebdd01244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697397298, "uuid": "9d8c630d-5ae3-45c0-ba98-ccc980aa49ea", "comment": "Malware payload (RedLineStealer)", "value": "6e8089fca14d86780babb96a532e6e46e37cf6a706ba6dd2d8eed5a44e2fe085d76e4274b09a00fc35b8e1cc63dd1490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397298, "uuid": "a37c9071-a10c-4d08-9857-b3869749a1a5", "value": "T1B425230BB6E840A1F5B537B055F217832B327CA65DF843BB2B128A641CB33949176B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397298, "uuid": "b874aad6-da3d-40f1-a197-4e4ba41d641c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397298, "uuid": "c01cafcc-15a1-431b-80c4-492cfe1b85e8", "value": "24576:bylFryfQ6Td/ciN1hCzZH3Cgz8s66rOYVz4bOzi:OzmYIjPCdH3147kL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697397298, "uuid": "50ad1709-588a-4301-aab3-e2d5ddf83450", "value": 1022976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697397298, "uuid": "be0289c6-9034-4047-b295-15e3e58c9258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697397298, "uuid": "1d16a155-326a-4a8a-afe6-b03b7995c29c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52729c2-6ba6-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697407477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407477, "uuid": "94cc6dd3-e940-4374-9d92-04799d91cf90", "comment": "Malware payload (Stealc)", "value": "284fe0c51c687b6231da94fc259bebe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407477, "uuid": "7e6a9d15-3d69-4e55-bf0b-f260301002b5", "comment": "Malware payload (Stealc)", "value": "928bcb18852a834c761599967e13f415ea32f5145c709436f0369d292ac509d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407477, "uuid": "cbf5b9c8-dfe1-4275-b628-18fa88763cd7", "comment": "Malware payload (Stealc)", "value": "129b9b8f5d2d8828537aadf50317feb3b121cdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407477, "uuid": "9d9300ff-05ab-4b32-8c53-4cebcc56b1fc", "comment": "Malware payload (Stealc)", "value": "4cca38b929cb0a7c84c9ba1d9a1b80688510d15295d4a817f8aee7b2b74dddc98675c8e5de5f7088524c668e5d98168a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407477, "uuid": "5b6bc1a8-09b5-49ec-af9b-7ed18eb2057f", "value": "T1F1344B83D2E13D50E9374B329F2FC6E8760EF6508F493B69561CFA2B04B91B2D663611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407477, "uuid": "bcbac702-7dd9-448b-959b-2093f56cf9be", "value": "da3e442c2d2024285cdd03f77dec5d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407477, "uuid": "34de3aa4-2125-499b-b1be-2d1b27a49632", "value": "3072:h0TQxc1T89yHJCAIX30SLJjupcUfuoqWtq0/2b8KAbNU7W5UjGxr:KTQx0TbcnnPL9upchFlXbvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697407477, "uuid": "efc5407a-68cf-4439-aa16-5eafd9d88162", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697407477, "uuid": "89146e2f-8a9c-4060-a4e5-1ce49c42269d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407477, "uuid": "6b4c04ff-b561-49a6-9ca7-184d8fda12d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db492299-6b6f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697383865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383865, "uuid": "1813904b-6fcc-4077-8634-480ad95e3f61", "comment": "Malware payload", "value": "bd551a475063f8ec5985f3e96018e472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383865, "uuid": "0f3da7d1-94f4-462b-ad94-4856fd150dad", "comment": "Malware payload", "value": "93899976442a355be7c4f42cda3f03a0eadf76cbca4d2ccfc8e9fee8c06b0503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383865, "uuid": "ab70031a-6adb-447c-8ee9-d9837ec4f0f7", "comment": "Malware payload", "value": "de21eeaf2a1ca77a476aa3146712902e2261c57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383865, "uuid": "b935aded-6f15-44d2-bdee-ae07423b979b", "comment": "Malware payload", "value": "a8cb7669c9fdf544bf61155fc3462d248360c71c0fe5893b710920a0247391f5cebfde1327580cfe0526fbd133a7795c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383865, "uuid": "80cbaaab-4459-458e-be55-74812c46ad92", "value": "T11D26D0C9C16E44D7EC052EF5A8102BC36B2552728638087A26BBFE485F375FA811EF75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383865, "uuid": "66436851-ac52-4be4-92f7-55ddea1dd6c8", "value": "ebe8de187d2ef1e49673834aadb8a0bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383865, "uuid": "f2562abf-a9bc-40a5-919d-41c8a331b0a6", "value": "24576:qpFjXZ3nELTg6LHhCIJA+70FqV40hh6TpNqZR/kGYPB40izIMCZVdTW6bVTl+tKV:qpFtCTZLC+70IVwpNqZR/YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697383865, "uuid": "477b1322-a635-4be4-810a-a28f6ad02770", "value": 4644352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697383865, "uuid": "e2eab699-e911-42fe-b9a5-454d29408616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383865, "uuid": "a9ae12e3-7ec2-4696-914e-24856113d0c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d67e316-6b52-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697371118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371118, "uuid": "697d16d7-f19c-48e1-9579-49209e08f6ba", "comment": "Malware payload (RedLineStealer)", "value": "43e1d9e742cb386b808462c427b2bcc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371118, "uuid": "08742c72-b5e4-4bf4-8792-b6003dba2c49", "comment": "Malware payload (RedLineStealer)", "value": "94620955d27d425a2584f6368ac6b5e8b7a3b5fc4fcb5080cce4e66e85a964cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371118, "uuid": "fe337f66-a429-42c4-9bb6-53f69454c8c8", "comment": "Malware payload (RedLineStealer)", "value": "8244c3d5676399da93c837748fbe11938a48a568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371118, "uuid": "1c5954d1-4993-4013-b78e-079aae238e2a", "comment": "Malware payload (RedLineStealer)", "value": "583efabbb8cd0c3d6cfa31e07f16c3aa6635b0b5c6edb4718b96aae65be5c1c1d231735b964f6b8dc283252172cf1daf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371118, "uuid": "3c60d758-e7d6-4dd2-95a3-d439c97931ed", "value": "T1B3741A097ED6AC16C51E44FBC434A19DFE2EB8ED3160AA9765760884EF2D349733C4CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371118, "uuid": "9bb96efe-92ff-4eea-b372-13b6129e6e38", "value": "c7c9eb7dc16fdf30c39a296c30ab2134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371118, "uuid": "1ad1b0a9-f661-4411-9597-9ef6b424d1a1", "value": "6144:+d/gu3PkiaRnyYASHSFDOJe0NjIGG8TDUOHFMlhTI8r2Vod5ptYq69XLsJ3OjPGr:+Zgu3+HSFDOJe0NjIGG8TDUwFMlhTI8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697371118, "uuid": "aefb72d3-8385-44c1-a758-d7b0ce9ef047", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697371118, "uuid": "9489d5e5-8477-4907-9c82-bd0f60ed002b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371118, "uuid": "e3864a77-cee7-4e10-8048-fe0ee470cf48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95c0a41-6bae-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697410867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410867, "uuid": "46a0c776-f19e-4e32-a743-99d24d799a70", "comment": "Malware payload (RedLineStealer)", "value": "26cf21a57bab9f8338cfddf41a446a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410867, "uuid": "417af879-02d9-419c-9c82-783f5f7bca05", "comment": "Malware payload (RedLineStealer)", "value": "94f87cbfbf516f1e2120a146c2c882476ff89efa9f7e908a3eaf437d5c48ba45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410867, "uuid": "f85ac2d2-0757-42e5-b775-baf0a6a94585", "comment": "Malware payload (RedLineStealer)", "value": "cc1ec76938c92922a2baa3884d1c11e10caaecc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410867, "uuid": "6ca07603-f94e-4a7e-bbe7-1b34c6eddbd4", "comment": "Malware payload (RedLineStealer)", "value": "84a598b76e299fb3851b7a2b59aad8c37f12855dac145cab505c3870e115116d431e853876bb0849eb3aa3f46e4b94ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410867, "uuid": "65279fa6-222c-4002-aeff-1a10aa4f269d", "value": "T1B8252302BBD54473D9BA2774ADFA07831E36BC709DB843562791292B0CB22D67836737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410867, "uuid": "3a0be740-6ed6-4d57-8f40-230a8c8a8684", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410867, "uuid": "db036923-bf27-4921-a732-e4aa9d695416", "value": "24576:fylrnqiRuHoqmRBVPs+46dsb6NURcEbRCLPH+QkELR:q9qiRuHo3B+Dfb6ocEVCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697410867, "uuid": "f828f4f7-8840-4a6f-811e-b0dadfa6c3c9", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697410867, "uuid": "b556138c-472b-41ea-aac0-08e103a34613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410867, "uuid": "c7af2493-820f-47ee-8dfe-69a430e5d4be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da30079-6b7c-11ee-8907-42010a9c0042", "comment": "Malware payload (Stop)", "timestamp": 1697389292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697389292, "uuid": "8ff8c4e6-6190-4c4f-bf8b-12a2000bb526", "comment": "Malware payload (Stop)", "value": "15a8142992786ff28bb79fb2b7d47f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697389292, "uuid": "a43d96cf-86f2-4f2b-912a-02288c5dd621", "comment": "Malware payload (Stop)", "value": "9a203a1f050818238d950b70465e679c6475cf974e7c823d188645ba6aec01ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697389292, "uuid": "27c6eff0-3a67-451c-a4bf-ada63cdcbaad", "comment": "Malware payload (Stop)", "value": "c5fb299009599c93fef087734e13f1dc195f8ec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697389292, "uuid": "ffa622cf-84a9-41e6-851e-bd2bad9f40be", "comment": "Malware payload (Stop)", "value": "a92551c2bcfc04036c3cbd80eadd405b7ce0529e797a4f007d78dec0812621b806f2b06df814d0b2726949a1dd7ddccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697389292, "uuid": "1f118906-e28c-40de-877c-d43a7d67fd39", "value": "T104F4E053D3E17C91E9368B728F2FC6E87A1DB1505E49BF692A1DFA2F04701B2C163602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697389292, "uuid": "def9c5b6-7765-4fd4-b4e1-7f3660293f37", "value": "0f0db3d3ce4a63ec014870c327afc9a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697389292, "uuid": "a85bec34-6ce6-4ea7-9edd-b58522f60cd7", "value": "12288:xcfUbjw1xHxDEfUViMVkqATGFMPZhkBH6Jrrn5/Ywmn/nJuR2ks7S:CfUbjysfUGHcMPZhkBaJrTZYzJuES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697389292, "uuid": "79998866-0f94-4116-a652-b5c166fd258d", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697389292, "uuid": "99624530-788f-4972-8f26-5f3a12556687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697389292, "uuid": "b7f2fb63-6715-418f-905c-3043cc9b05f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dce99ac-6b92-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697398607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398607, "uuid": "3f4375d4-7a64-4351-aa29-15f75232c503", "comment": "Malware payload", "value": "92fac0f376374c4572deac4b8ca31381", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398607, "uuid": "88b01ccc-1a1d-4bde-954d-6b5c23135993", "comment": "Malware payload", "value": "9a8c4b54e54630f11730425c2d8faa49d30a6a9fa77338dc479229f3d476eee8", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398607, "uuid": "b12e7a6f-c9ec-43f4-8d99-a83ba823eb36", "comment": "Malware payload", "value": "67aa9584f15500f95cfcb1111457d3a5225eaa26", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697398607, "uuid": "f7df43e5-5b80-41cd-8f28-1e338a3edb94", "comment": "Malware payload", "value": "1768dd876baf437eeff4a3b16a5c9c5f8c9104a26e3512f9e0a4d0c06c6a5433997bdb82b32be1f9b070e7c8b980c4da", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398607, "uuid": "8253fd4a-890b-42b2-8f80-a6f5f6274b47", "value": "T13C01704075CAC32C05B15263C41EDE8CF038B02F3126794236CDC9DC9B25D4ABBB56B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398607, "uuid": "ef30eb1b-e2df-4199-8148-e46527ae77ff", "value": "12:CWVmoMcLBx3iMfRfE7yARzgxJmQLgyaI4HLALkzLgyaISH4weAHnpCKPk3X+0/8v:3VmoXvyM5fE7JRz+xLCHA0LwYn0pOl/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697398607, "uuid": "1b24add1-beca-4384-8884-f3d66c370b64", "value": 735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697398607, "uuid": "b0e34ffc-f73a-4ee4-ab4d-d269f4796c11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697398607, "uuid": "44bec4f8-17c6-4c10-b457-500e118957b5", "value": "bas64encodedpayload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35447e7a-6b06-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697338490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338490, "uuid": "b1bd9bb3-f444-4a54-b70e-3b61c9cfadbf", "comment": "Malware payload", "value": "37062fedef66e106a3c266c8a4e6e696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338490, "uuid": "19d0c49e-4f1c-444a-b8db-071a9dbfc02f", "comment": "Malware payload", "value": "9aac2b276672cf4c003544b368362418ffe9b41f553d23e33cb70f496f6af875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338490, "uuid": "df39abc6-dfa5-4be9-9b34-1a22e46cf34a", "comment": "Malware payload", "value": "b8e67d1325ed4ce03b6a8ccf641b9847dbd58e04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338490, "uuid": "0d4a789f-ee55-4e9e-9c69-64a81af2052a", "comment": "Malware payload", "value": "954ca29c6779c21825def3abfdd3cf5043f88518387b5ebcf625be6188b7c9f79b8d8fe101e8e6e011c306cf5210d07a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338490, "uuid": "c16a649d-ad29-42a7-a2bc-201a387a10c3", "value": "T11D9319027A448726D8591077C1EF003403F1AD93A673E38A7E9C76ED4E263E66D89FC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338490, "uuid": "31e703ff-f340-4335-b6bb-2b560917210a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338490, "uuid": "50517666-3777-49db-956a-0e335088ce15", "value": "1536:DksLmYsTpff5GjvWA2Bw0X8TctzP75Hs5BFLmpNkMFYPDQWbT:D0pGrWA2BwnTctzj5HSFLmpWYYPDQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697338490, "uuid": "ca723573-fcc9-4c01-bfc0-636def23f724", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697338490, "uuid": "98669775-792a-4046-bb0b-9d8ca2934c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338490, "uuid": "fab18ac2-4e1d-4251-912c-4a8f81862d28", "value": "37062fedef66e106a3c266c8a4e6e696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16a440c-6b76-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697386909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386909, "uuid": "167decdd-a038-4da5-a40d-e2051aec136d", "comment": "Malware payload (GuLoader)", "value": "18ac0a760bc95124a4f9f3616ad85f53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386909, "uuid": "b9403e4a-db4f-4d0b-9762-6a174da49b53", "comment": "Malware payload (GuLoader)", "value": "9d2add864a71479775021dab298fbf34ba28edc3a4bc0084e8f30ab11952d67b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386909, "uuid": "70145094-107c-4c36-bacd-7df3275d4e32", "comment": "Malware payload (GuLoader)", "value": "8a310766550fff5b3d167bac74fa31b4bff9157e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386909, "uuid": "e1e1f68f-a192-4cc6-9567-c3cf6de17e4d", "comment": "Malware payload (GuLoader)", "value": "fe7333dd12048a2dcb5ea7299e6869d9bab7f0e527c06e8177919da5a01b1cff83eccb93febfd862575866ca5dc4e41f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386909, "uuid": "76e8a248-c192-45ea-818c-24903ff13f8f", "value": "T1E24512A32B0EDCB6F9290471A02646AAD770E8FBFFC045B23546FD2258B7767550B10E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386909, "uuid": "5f48dbff-8637-4203-bbb9-0646adce5563", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386909, "uuid": "918cf1bc-4c46-484a-abd0-a78c8b662c12", "value": "24576:WTlO/GohO4ez9Rz6WfezSp5UvsOBVm4eW0M98+:WTuGOeznzdf35UvsOVUW9m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386909, "uuid": "86f72395-d26a-4f05-a209-fe3aafc97794", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386909, "uuid": "63e146be-0fb0-40cc-8b37-abec469e9db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386909, "uuid": "95353a47-8ca4-4e5d-826b-63b7a8cd4827", "value": "18ac0a760bc95124a4f9f3616ad85f53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967a2b1a-6b2a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697354115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354115, "uuid": "9e3e6674-02fd-4405-9725-8570ed94cb9a", "comment": "Malware payload (Amadey)", "value": "9de074abdf8f4aa3dfb995dbfa683e3e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354115, "uuid": "626b5791-902c-4404-a407-bbe8da6a44b2", "comment": "Malware payload (Amadey)", "value": "9dbcfff7ec23e6b79aba58d3d86e521e96325b9d65d927a4a7fca489a35ac4ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354115, "uuid": "e437fe46-da4d-4e19-a2c4-8eeda00d68d9", "comment": "Malware payload (Amadey)", "value": "e5b618232df10b2d1767be2bcc8a1b135f66caf2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354115, "uuid": "c2dee75f-f4af-4c07-87e7-48d6175c4f8d", "comment": "Malware payload (Amadey)", "value": "b6e877fc19073b87424be18d617ac636ce8c77fd926c44d7f36e11b7938cd6c1183b4a02851b8f0eaa05be27a37935aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354115, "uuid": "606c08ac-9341-43d3-b910-18478f47a6c0", "value": "T185E39E41B5C0C4B2D972193E05B0EEF15E7DF8700F509A9BA3D816BA5F706D08A39E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354115, "uuid": "5031c8d5-b8de-4650-936e-c3627eba8c8c", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354115, "uuid": "fd894dbb-18a2-4808-be0c-e76b63dc1aef", "value": "3072:CW/v5JsU12HlWCnUewNzrQuUUpBt2973rC92ma0K5CJgdcNQhpS5/NDPoJ:55JsICnU9Q8Gd5CnNQjgPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697354115, "uuid": "a619a78f-8133-4fc8-8860-3d732281dff4", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697354115, "uuid": "1d4a0f6c-8e9a-43f4-a961-3e743c8ff6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354115, "uuid": "5b49e6c0-c517-49c9-95bf-8dc842ce4a3c", "value": "9de074abdf8f4aa3dfb995dbfa683e3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e68cecc-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697401265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401265, "uuid": "d27a5851-5a8b-4a74-ac83-b7f00703a105", "comment": "Malware payload (Mirai)", "value": "6bb4d94727f86997ff414fff9da62aa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401265, "uuid": "864a178b-d6fd-4d47-97f1-b00262353494", "comment": "Malware payload (Mirai)", "value": "9e1c7c60d70e10fcb17c26ff32220d0eb0f9bca5a47e860f9799af261327bef2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401265, "uuid": "c2309a6b-475d-475c-a22e-12dfc5a6a899", "comment": "Malware payload (Mirai)", "value": "a25f8c811ece1f9aedd45be6ba9875715c9e1f95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401265, "uuid": "7b0e3028-b20a-422d-85d4-cb6c07e4ba38", "comment": "Malware payload (Mirai)", "value": "6fb08aa31f10d22d739971bcb32759ed0b15de6b1f56b6885ed9338276fda302287c864dc54b3c103c3b2d0d285e9d5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401265, "uuid": "5f417455-a384-4fba-85e5-15953c04b61c", "value": "T13C333AC1F54B84F6D41B493040A3F23FCB32D52951B5DAAEEF8A9F36DA67642921234C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401265, "uuid": "c9731edd-46af-4992-a23e-c1403353a40c", "value": "768:Un1WetR3wSIll/cFMCI3hQLUu53PwIj036I0oDHrzeZ7ktC1q+PWYQ1ms:41WCpIl1II3hQl5YIj033e9iC1HWrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401265, "uuid": "091d4d5c-ecb8-48cb-aed7-9aadd1416818", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401265, "uuid": "34e73fde-8aed-4859-b4bb-05c646f8a05a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401265, "uuid": "f9ff20c4-16fc-4b88-9f05-fb14e3ea425a", "value": "6bb4d94727f86997ff414fff9da62aa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95273cf-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353368, "uuid": "4aaee316-f197-4919-9617-015ed7400735", "comment": "Malware payload (Gafgyt)", "value": "3882aa3ef9fc56e05ea739728613ebb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353368, "uuid": "fa92a1ea-e5d4-4411-975a-64b297a545c5", "comment": "Malware payload (Gafgyt)", "value": "9e4f35988f450e64fb98b0da432b5f0fcad5c247e3c1f942f1e48f26482388e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353368, "uuid": "690e2923-71e9-4e42-ac1a-a8ec3a4d033a", "comment": "Malware payload (Gafgyt)", "value": "3f750496b156feb3403b4e9f52eb971912a362ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353368, "uuid": "51cbd702-3b81-4e7e-925f-c55f9522fab9", "comment": "Malware payload (Gafgyt)", "value": "fe7123c4ce50ccccf26c3b221aeca225c3d01afc2fba708bc045cdb1df1275929a061bb3b8c9bd857b23256281c799d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353368, "uuid": "7540a4da-651a-4cb3-b0ef-7b9b93130507", "value": "T132B30741D6548627C2D32B7BAB9F438D3336AA54A7E733095528BFF03BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353368, "uuid": "1cbd141d-0fef-4247-b6dd-81c8fbf6dbe4", "value": "3072:HgvUxOcKFN+B9Jy8D3XvpIhfXE4CHz9cm7QnKQXaeW:HDEKXy8rvOFXE4CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353368, "uuid": "79c742cd-d88c-4c80-9ecb-31803ed3fe5e", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353368, "uuid": "a6ade9f1-684a-4f6e-9f9f-8cb739f127c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353368, "uuid": "15d2cb77-1310-42c2-8680-fd9b120c3c38", "value": "3882aa3ef9fc56e05ea739728613ebb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b168fd-6b3a-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697360878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360878, "uuid": "31254f87-73e5-40c5-b247-36d3e41b1646", "comment": "Malware payload (Smoke Loader)", "value": "b1ff7dddecb23ab890127b9aefc2b1f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360878, "uuid": "e9d9cce3-83d0-48b8-98e0-21041b126b1d", "comment": "Malware payload (Smoke Loader)", "value": "9f11c43fba696b3cbdd3bfb88cf172216e616cff10a392676e7ab8a25ea8a7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360878, "uuid": "fad1eaf8-3e75-4be9-a27a-681e7775ad0c", "comment": "Malware payload (Smoke Loader)", "value": "219faa9f45f0f9c43fe88e78c06499a4634ed11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697360878, "uuid": "b6dc69e6-178c-43e5-ade6-b8780bd2e2de", "comment": "Malware payload (Smoke Loader)", "value": "769e3f541cdf66ed30a07b625efe1c7db94a182228054446b920d8ee597863df88778304b71ddab2510e8a017ef18a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360878, "uuid": "5a85d32e-bc00-454f-b0b2-6d2e42d8abc2", "value": "T149151251E6ED9232DAB45770A9F307830B36BC865C7813676747ED9A1D72280A83273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360878, "uuid": "c9fe3530-b695-4d27-a6cd-05f16b4bc2cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360878, "uuid": "4a15cda0-1dda-463e-8e73-0dcd2efbe2a6", "value": "24576:AyFcrqibnujUGx9WAam78eqJ3MevoCH/QNtk:HFqqoRGx9jkJcR4/QNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697360878, "uuid": "d7ce8053-4e9b-4601-9db2-dfcbc52529e9", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697360878, "uuid": "69d0b8d1-2758-4976-8784-addbeaf54b7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697360878, "uuid": "7eb392ce-c44c-4b14-8eda-e5fde4b234d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebc1ab8-6b2b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697354585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354585, "uuid": "6e054ffa-4659-4ee6-943b-3346169dbe09", "comment": "Malware payload (RedLineStealer)", "value": "20f647726d2257ede2da5bf827250e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354585, "uuid": "f16fff8d-9713-4368-a0ef-d026e96f5b13", "comment": "Malware payload (RedLineStealer)", "value": "a13d980e94eb413013182bc3ae2adb5411f918db10c26b2e4bbf7ca3ba51616a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354585, "uuid": "1e9001ed-d0a4-4c9e-8826-75f4059091c2", "comment": "Malware payload (RedLineStealer)", "value": "44e121ce364df2d247ec2a8a82cc29e7f1f3f49f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697354585, "uuid": "33f6a2e8-1dfc-4a46-8ca6-71aa714f0298", "comment": "Malware payload (RedLineStealer)", "value": "6a3149f7fcd7c621076e841ad4b13c88720d22e3f811b9675208a01bf7b71ce19ced0cf4589b326c09c2ee283dd1d662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354585, "uuid": "d111f67d-08ea-4da6-9e04-a3f03fbd3492", "value": "T13B7419C9F98406E1CCB50A3A7708DC6A2B69E4788E93B5C759C74430BA3DB864C5CE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354585, "uuid": "61429b38-0d7f-4cbb-963f-88b7499abead", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354585, "uuid": "812d8c1a-1ce4-4f6a-a50f-9750228e1236", "value": "6144:cFJsICnU9Q8qlrRRSX8oTGD7mQoRIFsSa+JCZh51y+94Vj+rPoJ:c/sICnVLoUmRIFsS/0PoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697354585, "uuid": "79b6a9c1-d01f-427a-a94c-a66fd31f5c8d", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697354585, "uuid": "1999d460-a715-4122-9410-925cbc335362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697354585, "uuid": "65145920-7e86-490f-ba3b-1d40c1750b38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027c5322-6b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386079, "uuid": "d4e74faf-e213-4065-a6a7-65e5377de647", "comment": "Malware payload", "value": "c35b7e980b618f8cf19c5a7a801c3e5b", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "ZNeNote", "colour": "#92FD88", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386079, "uuid": "2501ea90-4f1e-481e-93e1-0321bffab304", "comment": "Malware payload", "value": "a2c948628ea4303d03418849690068004ccfaf58db9568e9c2daf323c2a2d8f5", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "ZNeNote", "colour": "#92FD88", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386079, "uuid": "ee767c00-4af9-40a0-bc96-fd0ebc006232", "comment": "Malware payload", "value": "929a0bd89bf050dd65a2ea02ce828854c4856e74", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "ZNeNote", "colour": "#92FD88", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386079, "uuid": "c4273cce-349c-4957-863c-b5af5e427daf", "comment": "Malware payload", "value": "bdee12d6d597183f87ee9ec79494eafa1c01d49366e25f18e9cd7e17c065576c72339dd46750e194a69aa5a5713d49b8", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "ZNeNote", "colour": "#92FD88", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386079, "uuid": "79fa1bb8-b1b7-4405-87c7-8f58528c8837", "value": "T1EAB3E026F591821ADB2A413809E7AFB4B3737D1290926B1FDFB61A2C4DF0184CC5579F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386079, "uuid": "ef710b58-8a57-4469-8539-5cb08a72f0bc", "value": "3072:BhYgS2EJbyYeMYkKkyX3DWvLLATiaRgZia:VhjZrHDghN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386079, "uuid": "4f56159c-e491-486e-b71a-fcad8d87921c", "value": 112264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386079, "uuid": "04d9ccb4-2a9e-4584-92f0-8ab1867c87a8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386079, "uuid": "33bd1006-c10c-40b1-8fe3-9b818ac88ce7", "value": "8e88539cb1ba27f08b1a85571d0944ab2e1b1e65674a7d063f618c27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67475176-6b85-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697393120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393120, "uuid": "3366b06c-567c-4b21-9a23-bd0f5e06766c", "comment": "Malware payload (RedLineStealer)", "value": "1c76992a979fc6706e8d61999ec48569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393120, "uuid": "18b6be43-2d05-4eb0-97ff-dc6823fa9cf3", "comment": "Malware payload (RedLineStealer)", "value": "a319ff91613aa44c2541fd4d9c182dafbcbb30e04e4022cb18e459e3819dfb1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393120, "uuid": "ab758dfa-6b04-42a6-92ae-97e83d92b86c", "comment": "Malware payload (RedLineStealer)", "value": "7c17b9073d237b139f25838a80b4c3ff8095a00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393120, "uuid": "d51c4f1a-a70c-4b73-84f5-d28a805f0bc1", "comment": "Malware payload (RedLineStealer)", "value": "9adee1f5676726cb7674bb9b39dbc033ddff2c144e1eb60bd833f7d0267c216d68394d287a114791583373d5a6df8383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393120, "uuid": "328c65ec-8eb8-4db0-8c04-8ef9a5f27342", "value": "T12EE3AE0275C1C871E57219350970EABD8A7EF8700F54AF9F2398163A4E747C1AA39DAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393120, "uuid": "8137e10f-cf93-4407-b424-fc5e0ffb353b", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393120, "uuid": "21711fd4-5193-4bea-ab46-2f1d7eedf4cc", "value": "3072:7MPnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQRn2QOcJUEdfrwI8TJn:GZEe3bpi5aaYRQOcJbdfcI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393120, "uuid": "f38c85c4-a114-4a52-ab91-98b2116b0606", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393120, "uuid": "687a2b77-b987-4976-9e42-d7355d3e7337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393120, "uuid": "351b9361-3fe2-4f69-ac71-967b389ec457", "value": "1c76992a979fc6706e8d61999ec48569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19576c36-6b33-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697357770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357770, "uuid": "db52ac75-eccf-4d7c-ac5a-e5cf4a7fb5ab", "comment": "Malware payload (Stealc)", "value": "35792a02ab4306f0d49ac32fd340e507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357770, "uuid": "f5712d0d-d839-4e09-b0e1-81a96a4ef771", "comment": "Malware payload (Stealc)", "value": "a567c1f01f6bed6d88712149472f5262d2ddc14aa4d6c1b0544e81dd0929931f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357770, "uuid": "a25e1eeb-3d10-4983-a351-6051d3665834", "comment": "Malware payload (Stealc)", "value": "241c128cd12cb0a0c990aba1131f9aa987dc3c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697357770, "uuid": "2a9f9e8e-3a21-419f-80a4-eec1347525f5", "comment": "Malware payload (Stealc)", "value": "159663128005ec655ff57527cce6c05b1e9f8bbec6ca4555ed4a1cecf1f1ebb4cd74ef3dd6e0482e039481cf13537cc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357770, "uuid": "6b7c290e-fcf6-4cd6-ae78-800cd0ea7c58", "value": "T14765E032F6D01437D5A3137AEC0743AAA939FD102B1855866EFE0A0C5F39695B7372A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357770, "uuid": "213edc34-eec8-4bc2-8e73-1d9a7ab7dacc", "value": "ff9e770cb7f9e9a6bc475ae0ca7ad026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357770, "uuid": "74e83e76-8e4f-4aee-bf1c-5aadecb048e2", "value": "24576:txpa5NZDUgskBA0BevJwj5jJjPeLcMD7jJ414jfijcje3j0jFfJj6jnsg7jXjZE3:txMJICze+j5jJj2LBD7jJrjfijcjcj05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697357770, "uuid": "5c48f19b-d7c5-443b-9dea-fb610466d8b0", "value": 1409282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697357770, "uuid": "0f917b46-cb94-4a42-8891-b3041cc0e28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697357770, "uuid": "8fecd1da-ebe1-41a7-9177-3ae861dcae4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3d224f-6b3b-11ee-8907-42010a9c0042", "comment": "Malware payload (BlackNET)", "timestamp": 1697361324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361324, "uuid": "686875aa-3457-4d82-a514-5fa8c5baddea", "comment": "Malware payload (BlackNET)", "value": "8ce1041cce94737d4a36dbad504f4a78", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361324, "uuid": "3e6416f2-0a84-4fcc-a54a-ea43e4df6243", "comment": "Malware payload (BlackNET)", "value": "a7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98b", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361324, "uuid": "d3c72eab-13b4-4482-9def-e850f0790827", "comment": "Malware payload (BlackNET)", "value": "c4a49dcf6c6edff26b0514da03b155f2ac418a3c", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697361324, "uuid": "507817b5-b266-403e-83d5-65e570f63a1d", "comment": "Malware payload (BlackNET)", "value": "4f5172fe0e506f1cbb001c25a4b9c60914478cfb3a202b1a58386e6cbbd80fb199db7e6dc0814f9d52c25965bbdb812b", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361324, "uuid": "f265486f-afaf-48e0-9c12-9d6453a429bc", "value": "T1BD73C44237ED6C92D0BD9AB4BB3353C1C7B8FD1A0512DA5D08C410AD9A7A747B981BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361324, "uuid": "9c7f3b69-a684-4fa0-b21a-f983dbe6ed05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361324, "uuid": "4840bcd6-687a-4bf1-bd60-ecf31187e74e", "value": "1536:hZuhD5z28TC268is9T8VPPQTgbSUPH4LU0tYwq:Gt19T89mgbSKHaUoYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697361324, "uuid": "be9823ca-26f5-47e2-b21d-20e17b6e2ccb", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697361324, "uuid": "e5a66aba-41a5-47b0-9261-a0eb12d4aecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697361324, "uuid": "f58548bd-f1f2-4e9f-bbb5-94995c41c7ec", "value": "8CE1041CCE94737D4A36DBAD504F4A78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d410aaa-6b8b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697395546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395546, "uuid": "7ffd84d3-5d52-46ed-b57a-292f80b42d36", "comment": "Malware payload (RedLineStealer)", "value": "f31f12ee43fe377da05a53af05637e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395546, "uuid": "203b332e-2d77-45c3-924d-3b4a5b0751f3", "comment": "Malware payload (RedLineStealer)", "value": "a7df616beba442a1e32264d78c0fd86f6ac40b9d98c0993cd96fb2cc1698eb70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395546, "uuid": "d5b1e00b-4eb6-410e-bd75-7ee6e5f43203", "comment": "Malware payload (RedLineStealer)", "value": "2f180073f2e6beb498b7420928ab31392ef7519c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395546, "uuid": "8eb02142-049c-4d85-a5c5-cab4514c2a6b", "comment": "Malware payload (RedLineStealer)", "value": "063971271cd9ce627d57aaf23a48dcbe46fbdebfa0ddf3c579bb923f775c8bf3bfde4eef67fb3429fdbd659fecd67bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395546, "uuid": "66dcdc8e-9857-44c6-a8f7-93de64629290", "value": "T1012523526AD80472DD722BB01CF703830B76BD624DB4469B3756A4AD0CB36C9A57CB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395546, "uuid": "8467601d-b062-437b-b131-0e5f637055d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395546, "uuid": "839d68d5-d51e-427a-acc2-d6cb131b2b62", "value": "12288:bMrny90wMYrj/U2/nA3UTWG2TqDxWC3aAflDS5nD4kp+Qvl4xV9tj1o/vIX83crx:Yy9P//U2f6tXi06VS2xxHtRooHc6cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697395546, "uuid": "1ea4db38-ab13-4b01-a798-7037373bda4d", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697395546, "uuid": "dcbaa69d-116a-4fff-834e-c4f47cd388d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395546, "uuid": "93c9647d-df0e-4880-8621-4a0cbea5e40d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddf889f-6b7f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697390420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390420, "uuid": "ef971358-22cd-4a27-8d03-548945395c20", "comment": "Malware payload (RedLineStealer)", "value": "a7b738d511d1f967719ac99926d6c78c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390420, "uuid": "11840ae6-e703-4d4f-9a04-0470268ec58c", "comment": "Malware payload (RedLineStealer)", "value": "b0828933bddc17db9319e5587d3bb45ce5c771dd60875c5ce95ce21631060313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390420, "uuid": "37ca1f52-86ed-4093-a776-2147386607f0", "comment": "Malware payload (RedLineStealer)", "value": "4e5cd969b2348090ad2693d6241cd88e7b400b62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390420, "uuid": "24d3ec4f-7bd7-4004-9fa8-5c2bacdb7572", "comment": "Malware payload (RedLineStealer)", "value": "6f269eeb933250a2c00c89c7765a9285bed825e3940052fc110fbd2203c42e426c1f7ef5c54c819819fbb198dbd3dc1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390420, "uuid": "3d412cbd-6e3d-4b6a-a01d-1e239ea3f71a", "value": "T117352392ABED8476FAF65B7058FB028B0F35BC714C7887362297A14E1C312916471F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390420, "uuid": "eba299dd-2bd0-4f1c-b84b-6a5f21a6a2c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390420, "uuid": "b7d3d035-4986-4717-9c1a-d6aba4c348ae", "value": "24576:fy4GP7czezhSLSAIQFcAg1OJJx5yiz4yhD/GUdtzolh1p:q4KczezILSAWA80jD/De", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697390420, "uuid": "08c6d988-775a-45ce-b9a7-dd748fb2f48b", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697390420, "uuid": "d3f0487c-b94b-4b5d-a7e7-5b3953426c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390420, "uuid": "6fafaf32-2024-4f6a-9a28-bf8ac918a15f", "value": "a7b738d511d1f967719ac99926d6c78c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfa9d39-6b05-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697338263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338263, "uuid": "c5817a14-f7ab-428e-8bff-5a2059f28276", "comment": "Malware payload (Amadey)", "value": "a0b5d474e80453c125a628820343d34f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338263, "uuid": "cfc4e140-f54c-4254-a582-248c39f814ff", "comment": "Malware payload (Amadey)", "value": "b1894bdec474af11a27a741c71612cba95bcf9a142632c851b407b1c4293d2cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338263, "uuid": "5e4dbc17-6e78-47d1-bb32-9c2dca18d543", "comment": "Malware payload (Amadey)", "value": "a2ef6c8921ec6711e25f9fda598058002346b390", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697338263, "uuid": "d1f64f68-ecfe-4ac8-bbfa-fb05af2dc9dc", "comment": "Malware payload (Amadey)", "value": "9c2352905ca7bd921a1ec84fa07e335730f7ba2740ed3be09e73d6edda86cb75eeb85a9bf83139b4dd226e6252a4dad7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338263, "uuid": "8da145bd-161a-4058-837e-814a7f1a3124", "value": "T1E9D42242B6E88072E9B51BB059F302871F3CBC919D74971F27A0A99F0EB3591A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338263, "uuid": "b4b6bf5f-7429-4cf1-9dff-02b9387e2458", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338263, "uuid": "185f2b5a-d689-49f1-84e5-e3333418439a", "value": "12288:hMrCy90SICoV08RuK4TmWnIihMIOyL4uB5O8KhYqPtcyfuohzksyvvLzpabTX2:ryFICoVfRuZJnyc3ODhTtDj/yvvLz8/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697338263, "uuid": "830eec85-7ad1-4015-a7fc-f7d6e2154b4a", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697338263, "uuid": "d5776b3d-2212-482c-92a4-6e37df0694f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697338263, "uuid": "1b594c87-de2e-4b31-a381-fed6cc0b966e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1274da3-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353381, "uuid": "45b0cf1c-5227-4ee0-a67a-2228eaaafc4a", "comment": "Malware payload (Gafgyt)", "value": "933cf1519f41a6beaeed57ffd5480719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353381, "uuid": "e9a3f9e7-6d4d-469e-adb3-6bfd8acda342", "comment": "Malware payload (Gafgyt)", "value": "b3e81f61aaeac5453a33572e942dc5b2f435128f8d994e70a35f62e43d6994c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353381, "uuid": "689cda67-997b-48ef-8efa-3b49877d4da5", "comment": "Malware payload (Gafgyt)", "value": "dc3585c1e062b5d8a3004beef3ccbd02aed48624", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353381, "uuid": "1fd2f1b1-5279-4ffb-b328-3ee9ac5a612d", "comment": "Malware payload (Gafgyt)", "value": "efc4e65c704afbeeb15417fe68c6f3e4ab04d3002d036ee5c84c8077cec86c24b0041cc70aec14f4e7780ec521dc67a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353381, "uuid": "42cd8985-322a-4414-a044-dd508ef804f1", "value": "T1D993398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353381, "uuid": "91e986a9-091d-496b-a84e-607f5457856a", "value": "1536:TeDM+Vlabe0Ff5soS4yfafKdfmoDs2tSYVm+:Tj+Vlab/DDfKdm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353381, "uuid": "45330444-fd45-4fe8-a9f7-0e33a6a9843b", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353381, "uuid": "bcf0cd74-966c-4d01-81ab-d91b6367f9d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353381, "uuid": "adf9da69-46d6-4e9c-80f2-a01f7e137330", "value": "933cf1519f41a6beaeed57ffd5480719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b56774-6b93-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697399132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399132, "uuid": "75a1b02c-4124-481b-beff-84f4c427ed36", "comment": "Malware payload (RedLineStealer)", "value": "52a1e914d8aeee0a2ba0d7619d69f7f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399132, "uuid": "bdad7f70-992e-4503-8534-7fb861aa210d", "comment": "Malware payload (RedLineStealer)", "value": "b43b10e777fa921bd7ae6e3c069586fa0ee4318b537d18712b7e2b5127e66d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399132, "uuid": "6ee29dac-2d2c-4bf9-9826-87ab30e86873", "comment": "Malware payload (RedLineStealer)", "value": "2cd9eed1b10699363fe2a0f0c89971465f6dacb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697399132, "uuid": "798cae9d-57a6-476b-9fe3-1f2a831faedd", "comment": "Malware payload (RedLineStealer)", "value": "4406e2e4756977e5e359020786cc578a796c06380c882f057698d2c820b53773faf2952fd1c9f4057dea1a88e27ae48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399132, "uuid": "e3b511d1-c471-4f53-9606-7054dfe89687", "value": "T1E42523028EE440B3D9B2737049F216831F367D65D968973B3B89AC1D4973B98A83573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399132, "uuid": "3682458b-492b-448c-89e4-6583fb725755", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399132, "uuid": "147f74a7-e9cf-43d2-9419-45080c47aa43", "value": "24576:PyYokv6eOkpqHeXsZsEdyoIwJiU8D9h1:a7kvdOkyGsZsiLICGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697399132, "uuid": "736ee7ee-16f9-4ceb-a794-feb71ee015c8", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697399132, "uuid": "5fe01eec-0f3e-423e-b1cd-a16ea6e5e5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697399132, "uuid": "b2bd5f08-b5d6-41dc-9959-fbe814fa3c4e", "value": "52a1e914d8aeee0a2ba0d7619d69f7f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b782420c-6bb0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697411723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411723, "uuid": "0ec1e3df-aad7-4048-9ecd-27e800fbde9b", "comment": "Malware payload (RedLineStealer)", "value": "057bdb37953346d1cd50bbd93d70d501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411723, "uuid": "12e91d14-a76b-4535-a2c4-581cdc9eb4e1", "comment": "Malware payload (RedLineStealer)", "value": "b4430d1d3e75dcae098e99c79aba79c80cddf9ddceeabf50f21c8261413add17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411723, "uuid": "0f690e4a-de17-47bc-a907-4b56e48bafd1", "comment": "Malware payload (RedLineStealer)", "value": "9535074cc3f59c0332e08b6ad97ae6394ce3bdea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697411723, "uuid": "b653f2d3-36b9-4ae6-aaea-018c3a4e03e7", "comment": "Malware payload (RedLineStealer)", "value": "74800a3266fc0e3d6ce8d4c4076f322c0d44ba36a5cbba3e6c1ff91077fcd04db3e10533123f6d6cdf6afc364a3d9caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411723, "uuid": "a633478c-80b5-4c51-9e0b-60a0e662d1ab", "value": "T123252347F3D551F2C9F62370A8F747831B31BCA149385E2B3695A85F08E2AC26872767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411723, "uuid": "8cfbd825-c77d-4cd2-9d2b-09c6fa4ce5c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411723, "uuid": "a0f8b9e6-15a8-4a77-80bf-bd8aae9c35f1", "value": "24576:5ys87eQ7JuTrqbo5du3iNqxTT/Vp8kpdUk/zA:ssq70Te05dGiNqJT/5/d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697411723, "uuid": "2c0db057-6d33-439e-a4da-07b74a43cc5b", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697411723, "uuid": "67519bf5-d195-40f6-952c-557c6cc078b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697411723, "uuid": "002bf36f-1b42-48a4-955f-a6d65416eb47", "value": "057bdb37953346d1cd50bbd93d70d501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d08101-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376853, "uuid": "10298f7b-1127-4c74-bd8a-b3602544ab4a", "comment": "Malware payload", "value": "76d379da706323d303f33b426cf5035f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376853, "uuid": "d11a0830-9fbc-4096-9e00-a4294f1458a1", "comment": "Malware payload", "value": "b48cbcc1f498663353ea06ee685d733383ee1a79b72d9be1a3d31f626bc7d69b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376853, "uuid": "7caea2cb-efae-4cd1-ba1e-452299d04d32", "comment": "Malware payload", "value": "86c4ffd24a35867bae194ee812b909256e4edee9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376853, "uuid": "d0265928-bc4e-471e-b548-0650f21f973c", "comment": "Malware payload", "value": "5e4b9161d97a9a1ee549cf08f14e97c6b0cc3a786157ba1d979cd1eafd4deb0ab740cd511834064fc676be2ae2deee96", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376853, "uuid": "27fabad4-01c6-410d-b2e0-0fba6a676838", "value": "T1B5E27DCB938603319299D34C584D7B160FF9E04627857AA8C37CE7DEBE45C64329CE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376853, "uuid": "aeb7791d-43cb-4d88-9c49-68d5f37c06d5", "value": "768:9CCCCCCCCCCCKCCCCCCCCCCCHCCCCCCCCCCC6pCCCCCCCCCCCXCCCCCCCCCCCKCi:9CCCCCCCCCCCKCCCCCCCCCCCHCCCCCC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376853, "uuid": "fe31af89-98c5-4b37-9979-c2df260f1124", "value": 34216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376853, "uuid": "3457058b-8c30-4d1a-b679-3694d0fbc306", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376853, "uuid": "fee9aca9-f353-4969-8155-616fbca26201", "value": "76d379da706323d303f33b426cf5035f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558956e0-6b72-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697384930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384930, "uuid": "d6666d23-c072-4342-83a9-218927a787b7", "comment": "Malware payload", "value": "bc136f3bd95f290e472bf6da404186a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384930, "uuid": "81f1cc9b-baf9-4450-a726-3f9f741a20de", "comment": "Malware payload", "value": "b49be737db3f966f29dab25706bd74353a737d5ab8376fdc4f3e35b97ceab208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384930, "uuid": "29c2eb0f-82c3-43d1-95ce-7040d59fdd69", "comment": "Malware payload", "value": "66daccf3473470eb02cf410145b7557c56a54d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697384930, "uuid": "1811aaff-77f1-4203-b7bc-8c57adebc930", "comment": "Malware payload", "value": "d42cc6e8a2065a6b9abe7dd6fbb2557623a19fe685d4c170a8bf7ea30cc7fcb8b03450f1d687a2f080fb757fe1ba2a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384930, "uuid": "90b6bba5-ee7d-474d-8b6b-eca82ae45181", "value": "T110C54B45BA814CF6CE5E15F2D3D247088F96CB761B01D5AB2AE780DEA31D9DB8C4F182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384930, "uuid": "cf408ec2-6a96-4e13-92d0-06f79825aebe", "value": "49152:bQowHTl2uT19CJVZM9XgzetLnBzd0p5EGVs:Vw5DT190Z0t9B0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697384930, "uuid": "6f573dea-bfd2-4c0e-8c47-3d34c45a969d", "value": 2715648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697384930, "uuid": "2d229c6f-fa87-4aaf-ba87-a9e91301fc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697384930, "uuid": "824362b3-c839-4660-82ae-091765cf6e80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaefad29-6b99-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697401823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401823, "uuid": "00caec66-46c4-4a46-a58a-e1faf525e6c2", "comment": "Malware payload (RedLineStealer)", "value": "ae36b2fcc15fb10a6007b42c75111728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401823, "uuid": "d1162297-45c9-4ef3-9200-aebd93828cd6", "comment": "Malware payload (RedLineStealer)", "value": "b6ffaaa39281ecb3d96043a6bd42f9418095264174c8676486baef87bffa6d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401823, "uuid": "de4e1309-f68a-45c7-b7b4-f9f82929ab20", "comment": "Malware payload (RedLineStealer)", "value": "74458e2c60ad982ee2c2535864dd52fcbe094799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401823, "uuid": "0c4e906f-c679-4bff-b857-bcb438024ab4", "comment": "Malware payload (RedLineStealer)", "value": "d293413838cc4168671802dae74f41436d9b4fb55d2ed63f5e9b03d0b43d2bcd727803e45ed793f29485e6130269a6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401823, "uuid": "caec2cee-e989-40d7-a978-3ec35fbf5543", "value": "T163258D2138C08176EEF320B646ECFA3A46ADD0B0076912DF16D857EEE7206D17F36596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401823, "uuid": "75166a53-21b1-49fc-8496-2b41f2380949", "value": "66025e7bb3415added2b8177bf9bcfbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401823, "uuid": "780bf9da-e0fe-4442-a3f1-0acc37284716", "value": "12288:ViMqWAVpsx7UgJCSkZZ7gFMRfIByCZeEAQ+ni5SZYzu99DYH2a6KRnI:d2psxIgJCSkjwwCyCse+ncF2a6mnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401823, "uuid": "dec8debb-3c1e-41c8-8813-0105f0e6803c", "value": 988936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401823, "uuid": "4cd1af34-79ee-4b67-b761-c0513eeb82a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401823, "uuid": "19b4126d-b3a3-43af-9266-c1db13edcc42", "value": "AE36B2FCC15FB10A6007B42C75111728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04098ba-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353406, "uuid": "d3a6ced6-ceea-4f9d-9b2e-5c78f91c4874", "comment": "Malware payload (Gafgyt)", "value": "55b71e00df7e34962d73455bb5ce205e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353406, "uuid": "00dac072-f64a-4e60-a5cb-acfb9fc2e3d0", "comment": "Malware payload (Gafgyt)", "value": "b8970620110eae7515f7286ffa16633fd4356a4269926c57ccc214c8f502cfea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353406, "uuid": "d77e86ac-e5e0-411c-af2c-d69524143c93", "comment": "Malware payload (Gafgyt)", "value": "7ca108bb4f71b07599a310b133d0685c06b85b82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353406, "uuid": "cec875c6-0fce-4fd3-9880-468adb52b682", "comment": "Malware payload (Gafgyt)", "value": "b0c8f9e94cfe2b8db5bc181c01abb9601366bc920b6e61dcb0b9a4a93030eae9f89fe84a8054c3f94e1db91cba51e873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353406, "uuid": "6a4231c6-dd92-477e-a330-5ced2333368c", "value": "T109832A46D3A2C5B3C4831BF605E7D72B0231F9164B2A9F0AE36DAEF47B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353406, "uuid": "c63d912e-67c6-40e9-b850-ee7dd406c9b7", "value": "1536:L3oLQ5TCzSVYERb1aGy8gwi5vuMbBZzp6+m5CsNFPVYLf0:D8Q5Tv+U5aH8VkWMfp7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353406, "uuid": "89ef0d7f-6b12-43d4-a33e-518e3c92cea9", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353406, "uuid": "5976c121-b343-4b9d-9895-c6e25b617d81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353406, "uuid": "c74b5ff4-2c3a-4693-b676-397a6de67806", "value": "55b71e00df7e34962d73455bb5ce205e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1802cfb-6af5-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1697331450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697331450, "uuid": "dde4285d-7707-45bb-bebb-04f106e48be1", "comment": "Malware payload (Healer)", "value": "d318c6337d7cad78817bd3b9b3f43bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697331450, "uuid": "c66183b4-8a49-4890-bb4c-792d69a9dab5", "comment": "Malware payload (Healer)", "value": "b8c4184e57c309b868bcd24bd67890a8549d93b8919ef57d00907bb0769ce7a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697331450, "uuid": "3a6b3dc7-69a0-4498-a25d-34f0d8733339", "comment": "Malware payload (Healer)", "value": "dbf134d1a4d1d712bd4d917bba0c2545fb5f901d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697331450, "uuid": "b50b3ada-f879-4a54-ba1e-26ca47c2d212", "comment": "Malware payload (Healer)", "value": "08928994b7a5a96e4c8c1a27d745ba0d0a877df7bde432586ff0cb7a103e0faaa326a3b5e50daf7cb871394e8c1e4721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697331450, "uuid": "e604c2c8-f64e-4d54-84cc-3b4777143855", "value": "T107152317EBC96572D4B52F704CF707C3063ABCE51D389A2A2B86986D0D32AD0A875737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697331450, "uuid": "764ca7ba-2e9f-485b-8508-a9d6b78a8978", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697331450, "uuid": "812c7ce6-7082-4eb6-8c2d-12aafb4230fb", "value": "12288:KMr0y90qyaqD7Ok06pNmgoVKDrk4qKdFagXt0ogWtTlY3tXrGlqFfmef2mglg+x2:GyCdce3DrkaTRgAitbGUR2maXIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697331450, "uuid": "72856a25-2541-452a-ad4a-18afdab234e2", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697331450, "uuid": "0cb01cb2-2241-4b15-9404-ea342d97c5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697331450, "uuid": "d7e46de0-faa1-4460-9463-503e21e968ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d251e89b-6b4b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697368389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368389, "uuid": "e268b0fe-5f48-4343-b209-654a8c2d4348", "comment": "Malware payload (RedLineStealer)", "value": "006f9aa497e6f49f4394d42d4f79568b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368389, "uuid": "8e8ac5ce-7bd1-4a55-ad51-03a4c909b152", "comment": "Malware payload (RedLineStealer)", "value": "ba979bcb241c8c2426dff1b390ad24321dc655d106a14539dd45c73b01a90287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368389, "uuid": "de0301d4-df07-4e17-b8c0-0ff7dbc98626", "comment": "Malware payload (RedLineStealer)", "value": "c407172ffae9b89f48c725d3809acd6c7fca3031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697368389, "uuid": "5e0aba9e-724c-4473-bc84-53002fef3242", "comment": "Malware payload (RedLineStealer)", "value": "2f12b75c1ae428dc31fdae9a0b077a2a85a501a2bf748e2dae95da5f8bbf5644579024b169c06164e6bfd77258543ba5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368389, "uuid": "59ec154e-9483-4384-91fa-c32fa45de18e", "value": "T121152283E7F805B3DCA017304DFA02830A367DB0AD70EB6B1B56D5AE6CB3A951571726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368389, "uuid": "2592c417-24de-4713-813d-5401ca6e7c8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368389, "uuid": "584c3fd3-ce93-453f-8e91-f3a51dfa1689", "value": "24576:8yfiXkT+K9xP/C9RwPmi1xznCIqVrn4er3wbv:rfOkHlm9QzXM4nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697368389, "uuid": "cb198097-b49c-4831-8d00-194042a59e53", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697368389, "uuid": "e5ce014a-38fd-4a19-b9a6-029dbbf57478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697368389, "uuid": "046fd958-9f94-4bd1-b7a9-f08210aeb7e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7b4f20-6b0f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697342471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342471, "uuid": "0909113d-18cb-4ee9-b2f8-05461d21ed03", "comment": "Malware payload (RedLineStealer)", "value": "da2aff70a6794d258cfc5f3e30c3c931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342471, "uuid": "331bc5d9-9e60-4311-9386-f2cd1fbda98a", "comment": "Malware payload (RedLineStealer)", "value": "bbb535e87b6d2fde49c6b143af1a003b5670b422937c9dd0cf5424bd212dfc01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342471, "uuid": "44f91ba8-a0e0-456f-ab4f-5fc5e22e71ce", "comment": "Malware payload (RedLineStealer)", "value": "57fa59d020b94f1e11a382f9393f7e68bf33ac65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697342471, "uuid": "c8232fb5-cc9d-424b-8ed1-1473eddfd469", "comment": "Malware payload (RedLineStealer)", "value": "bb240be8ce6bbacbd16657b5a7f29312ce35189534ea832a2251159276e777c048341a572804661664ee85974bbe7570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342471, "uuid": "44c19497-2d8a-4652-bd45-2ff38c7af61f", "value": "T1AF152302AAE881B2DDF1077068F20BD31F31FD516C78D6D72B41A9894DB2A94A57233F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342471, "uuid": "eae99397-2b53-4ecb-abe7-d4b030e81837", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342471, "uuid": "fe49c49a-9909-45cc-a9c9-8ee46079a071", "value": "24576:Fy7ThwtU2QVDbFXUnsQDcJHFJGY+qQGDq/OKWZf:gvhw+2MDbFXGXDcJHLAqxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697342471, "uuid": "13523f69-81f5-4cbe-822d-f8dee6652b7f", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697342471, "uuid": "cade2c36-5ddb-42ef-a7dc-7f737199c233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697342471, "uuid": "38caa399-bce8-4130-ac97-e40cb5c40730", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48909b7a-6b7a-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697388344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388344, "uuid": "380f2bae-39b3-4b0e-aa69-699ea35a82ad", "comment": "Malware payload (MarsStealer)", "value": "31d89c2bbe767ba9327a444a53e1877b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388344, "uuid": "a826645e-2142-476c-af4f-009dd8d3b910", "comment": "Malware payload (MarsStealer)", "value": "bc290eadffd4393ed0eb53833d81b4dc2b35205c16a9b4f2f5858889e17f5307", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388344, "uuid": "36bcc388-e5ff-4bbc-8b02-24f2fe26e1f5", "comment": "Malware payload (MarsStealer)", "value": "7870f2a331a793f7c522238dbf29f572ef639370", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697388344, "uuid": "147aaab5-ade3-40dd-a60d-c7a9524e4b7e", "comment": "Malware payload (MarsStealer)", "value": "2be5ead1c1aa556479b6997b0f487863cde5a190e5088106a94afb6f56d15c1e6541b347b831e0e66a9fed3db79ccba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388344, "uuid": "5394b6f1-0a94-4feb-802d-186668cb018a", "value": "T1B4343953C2E17C52EA268B728F1FC6E8BA1DF6508F497B79261CAA3F0471172D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388344, "uuid": "838d7813-c074-4abc-8390-7dc2e017e2c2", "value": "8b3011ba53b7e84f6ea65a7d8a93362f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388344, "uuid": "84654f3a-7eb5-4005-abf9-759a5569b1ab", "value": "3072:8GRAyZ+3WlzjdpnveRnH5uNZYhaRKfjlHGpHIZ8d9xySt5XJmBo:VRAyZ6WhjdpvgeuhaUfhmpHRxyS3Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697388344, "uuid": "ab13eb55-cb52-4757-aea4-7b34fa9ed968", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697388344, "uuid": "575fd1f5-cfaa-4b20-a6b3-14f07fa656b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697388344, "uuid": "7147ebff-6410-4650-9892-2661bd5fd46b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb17a873-6b3e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697362766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362766, "uuid": "2edd25e7-c181-48b7-b692-609279bda5ed", "comment": "Malware payload (Smoke Loader)", "value": "a61a40b19b4b6b8f1645f1680869476a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362766, "uuid": "71180a68-fa63-49fa-9c30-acbb023ee5f1", "comment": "Malware payload (Smoke Loader)", "value": "bcafa65151d00c76ec27227dfbbe8ceaec1b39da0ac85e418b2260c3ecb952ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362766, "uuid": "dbae6e1d-0ad4-4924-8c70-79ad17d1e627", "comment": "Malware payload (Smoke Loader)", "value": "d12f29ad9db929a39629ea7548fff0cbab57c9f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362766, "uuid": "da351494-bddc-44bb-b40f-39977e602cb5", "comment": "Malware payload (Smoke Loader)", "value": "5fdd4474ca59b9838282f807cbdfc34fe9754d9f0f2a3a6ef937dd45124e66bb5394c16673737f91010d54d5f606986a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362766, "uuid": "3db652d3-1b81-4f67-9d16-391b6c887b40", "value": "T11AD41202EBE88173DCB517B15CFB07530F35BCA29DB8875B278AAC4A0D72694A53171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362766, "uuid": "9751c7ad-d2be-4132-9712-e3cce252d3c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362766, "uuid": "4aa0317d-8122-41b4-bbd7-9ca59593d27d", "value": "12288:bMrjy90wv8deqSx6et8MsCIjeGfOV3TXraLKdm:EyTkdPSxAMtTjKEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697362766, "uuid": "44f28951-9c81-4346-8678-6769e131563b", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697362766, "uuid": "08fbbd26-7b25-4306-9403-f19c1addd3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362766, "uuid": "5a09d562-1c91-4999-807d-e56406018fc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a022b66c-6ba7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697407818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407818, "uuid": "0dbcd141-7825-4069-a338-f48e420eefe5", "comment": "Malware payload (RedLineStealer)", "value": "95f00a26fb33f1ecc3f9eba980829f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407818, "uuid": "85b5842f-20e4-49c3-ab03-5abea3f4bdaa", "comment": "Malware payload (RedLineStealer)", "value": "c03953cb0449e959f3d36d63ebdc5ee06517db789dddf00b58e72fac18b3d2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407818, "uuid": "ebc606c6-eb37-47d8-a22a-75ad072f71f1", "comment": "Malware payload (RedLineStealer)", "value": "80b304e92b58b786543eacc9b2cdf4d982396c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697407818, "uuid": "039ee735-deb5-48af-8a44-a2c4ba84fbba", "comment": "Malware payload (RedLineStealer)", "value": "e443fbf1317f75dde86a0908f147c98ca1bf7fd6bb3fccf1db44c46837579b68b675f5584ffb6c183a9119d009723c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407818, "uuid": "82ff359b-fd76-4dec-840e-903b8c158bee", "value": "T197252393B6C94072EEB50B7019FB03434B37BD659C64872B1F65A00B2972791AA3673F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407818, "uuid": "d9dc1e4e-bbb8-4aec-a513-cf7fcb4c1abb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407818, "uuid": "158ddd2d-683c-4cc8-a7b0-348f5b153e19", "value": "24576:YyBGGXgiPTnzxI1SYzR7qow6snh3ReLmwP+b9J1NgIOtWOybyo:fBGGXrPhI15R7g6UhoVPAFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697407818, "uuid": "f14f130c-bef0-404c-95de-4e0ff0e41867", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697407818, "uuid": "67c91772-b894-4ec3-b960-e02443c28683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697407818, "uuid": "faec8a7b-6825-46c0-91d9-fb8e4dcb5a17", "value": "95f00a26fb33f1ecc3f9eba980829f73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89dfe5e-6b5a-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697374815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374815, "uuid": "a6e141ff-b93a-4fde-8593-a9eff95153a9", "comment": "Malware payload (MarsStealer)", "value": "03a76b21baa5f39e5f592ad2e11a6336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374815, "uuid": "79e9f563-c568-4556-bd05-f2d835295a4b", "comment": "Malware payload (MarsStealer)", "value": "c24772e95123aabc57d0748f538f1453ab2bb70ccae01ead7f777b1a9cd30b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374815, "uuid": "17e2f728-eea2-4fea-90c3-4aee815889a5", "comment": "Malware payload (MarsStealer)", "value": "93bb979cbf1c2d14bf8a5c80ce952f2a5cd0421e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697374815, "uuid": "a0c3cd80-e0ad-4c24-bd0a-6e5d201160a7", "comment": "Malware payload (MarsStealer)", "value": "8b7e2811b8e2cc4badf7f6017dc4a1bee4adce1b8200d459292671b4cdcf831f167046f66a1e172032b4b8f1c5ffc611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374815, "uuid": "c0e6822e-86ad-4551-ba34-4fe1d7c51a74", "value": "T114444B13C2E1BC51E9364B729F2FC6E87A1DF6508F597B6A261CBA2F44B1172C263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374815, "uuid": "0372c60b-b080-435c-bb06-e931bb3f8906", "value": "2f16a3a753ec35e9c4b47871bbc2a2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374815, "uuid": "f169b963-8d8a-49d0-a94e-8ba94a9545f9", "value": "3072:536Ijv8H9Z70YwVWHIBim3G+BaCaNVr7dzkzeaiT5TADetXRolrD:zz8H9Z7EQgW/5vzkzMxyetXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697374815, "uuid": "d10474e4-9d3c-4696-850f-42c1c008d575", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697374815, "uuid": "cc40b99e-8a4e-4181-8344-ad95053f345c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697374815, "uuid": "1e5a7bdf-ccc9-401d-be67-a39ea571da59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5abdb36-6b09-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697340021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697340021, "uuid": "a252a8b4-8d98-482f-b5a0-805f4f529f98", "comment": "Malware payload (RedLineStealer)", "value": "15d2ed6ca72afc585b862ee906bc4557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697340021, "uuid": "018b2065-b0b6-4378-8a93-b8b82668032e", "comment": "Malware payload (RedLineStealer)", "value": "c2a8183fc1a1d26a3e4f1116ce52abace67d9e30a29b6be1703ff355102eb05c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697340021, "uuid": "d64a5a51-07b2-46b0-a19a-0108121136bc", "comment": "Malware payload (RedLineStealer)", "value": "718a35c505e887b90dafcc8208714eb8a0ecd50f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697340021, "uuid": "b699b6f2-63a8-450c-b1cf-e8df39a0c5ec", "comment": "Malware payload (RedLineStealer)", "value": "56fc2376c0d06a843cb9838af787a4055f186ae4cad134927e7797429246be7e65c73cba61c00488084a1ec4ae814376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697340021, "uuid": "1eddf88d-4569-43cf-add2-5bec45cd3ccb", "value": "T17215221AABE89027CCF51B700DF752835E75BD82AD38837B3A89941B1CB2610B975377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697340021, "uuid": "b02f15eb-e0f2-430e-94e1-bb672d5aa448", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697340021, "uuid": "79d57938-3888-477c-ba9d-82e802175c2d", "value": "24576:ay+XxvoWdbq1wnBFrhe/2xwx/2w2/IsrqytPJ3pm:h0tdbqOzte/gfv/IdyZJ3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697340021, "uuid": "6bc480f4-6eaf-4787-b6e9-f50bba927a4f", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697340021, "uuid": "ccd7f004-f62c-45cd-b567-1933e20cff91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697340021, "uuid": "1630a25a-13b2-4069-be33-71181a834f98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b301817-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376832, "uuid": "f2af4f96-a272-4c48-8ca9-eca0c4521d9d", "comment": "Malware payload", "value": "1af10be1ac0841b6f844154543d851d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376832, "uuid": "d7db601d-acac-46dd-ad52-23d8333c9ffa", "comment": "Malware payload", "value": "c402685dc7d5b1fa37cc296c0da547bfe874d3d00600831f0689a4f785ee57a5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376832, "uuid": "019ae8bb-2bd4-401b-b77c-9f4a5f8f0acd", "comment": "Malware payload", "value": "ed015b49e928c42e7f3c21743e5dd74f310f633d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376832, "uuid": "53aa5424-f544-45b9-8d08-deac30a19c88", "comment": "Malware payload", "value": "a1bcc0c817db139888f3f54c3bef5690cb462663450f2ca8b9df2f7a63ff1c1b99a907e7a9bc294c705b040bc91040bc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376832, "uuid": "1f1ccb02-8965-4e59-adcb-c3e5b0e76b18", "value": "T1A1637A8BD87BB7184CB5E66B5C537549CAF8B3A3C0D9DA50DBEAE8D314015CA2A4F4C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376832, "uuid": "45bfb112-5a82-433c-8254-9643be8dd808", "value": "768:zjjjjjjjjjjjjjjjjjjjjjjjsjjjjjjjjjjjRE7Lk+AjjjjjjjjjjjSjjjjjjjjf:nnk+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376832, "uuid": "86541651-660e-4678-aecf-f9b8055ace02", "value": 71123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376832, "uuid": "3a99e81d-35e9-4ce2-ad8b-598d32edb528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376832, "uuid": "f5c45084-2068-421a-85b4-773f762ffe0d", "value": "1af10be1ac0841b6f844154543d851d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f027a849-6b21-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697350400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350400, "uuid": "854fbf30-46d1-48f6-8bcf-8ed7724afa62", "comment": "Malware payload (RedLineStealer)", "value": "9987fcec77abb8a1a8946629d28a43d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350400, "uuid": "34b494d2-2620-40fa-a82e-f68459404bb9", "comment": "Malware payload (RedLineStealer)", "value": "c6b19365669e5870d1bde6cdd78af63eb23052de33cac70d85e8c5456c784fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350400, "uuid": "f4c0f6b3-af24-4e18-8f5d-1d54d0f6a012", "comment": "Malware payload (RedLineStealer)", "value": "4e0f1b837897e358b8c60b45950370168ea8dd1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697350400, "uuid": "d0516c5f-4a6e-4da1-a48a-cb56e7fa2fb6", "comment": "Malware payload (RedLineStealer)", "value": "6af6749c0f4514b7d4f48bdd6e39de407a63143c6275fbd482c55529fa40b23e7a1c3d1b29e4498d1ef12bb1a0216707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350400, "uuid": "4161784d-2984-433a-a185-5e2da8307af7", "value": "T1AC1523CBE7E4A063DDF12B7049FA03935B363D715CB8922B374599690D32184AA317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350400, "uuid": "5f4f846a-f11c-4548-a3e5-7ef0a2bd0a64", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350400, "uuid": "c5c2937b-a0dd-4cd4-b193-1a724d6b609f", "value": "24576:LyvYEkAzWtOkFHWNvjCpEGRJkja8Spz8U/jvfi:+v8HtOkFVpBD5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697350400, "uuid": "28213b1a-c94f-4c02-bab9-4ac2013b1c31", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697350400, "uuid": "929e10bd-3a44-4290-8f24-4a2e8ab0f1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697350400, "uuid": "fcf1da67-73d6-46be-a9b2-7e2b7a253101", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a543dff1-6b13-11ee-8907-42010a9c0042", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1697344261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344261, "uuid": "ae41c51d-0d24-4ff4-ab4b-4e30bb360b03", "comment": "Malware payload (ArkeiStealer)", "value": "786d66537812fd5b0bc48f67e87b4a5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344261, "uuid": "5be1008e-3b13-4feb-85e8-5d9fbbb475be", "comment": "Malware payload (ArkeiStealer)", "value": "c7d3374ba81f3ffcb2261c8a93df8b354c0d3d244b0dbecfb3eef5f7c07c444c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344261, "uuid": "d179d6ff-a609-43be-a12e-0557986e7017", "comment": "Malware payload (ArkeiStealer)", "value": "02a7ff2ed38899b20f88a0331a961ed2cd71f07c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697344261, "uuid": "f91a4d56-121a-4dc2-9de8-914782e05abf", "comment": "Malware payload (ArkeiStealer)", "value": "228297df98aac1d6f431242c611b5dac79c0ef6d06dda71bc3f33e496d21dd108163efbaf4c75419a31d86d2750863f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344261, "uuid": "8c3d5085-2036-4106-bcd3-56591aa4be26", "value": "T1A1749C5366D2FC60D81547378F1EE6ECF71DB560EE596B662208AE2F19712F2E263300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344261, "uuid": "83ca1678-b5d0-487a-b31c-b5254a669bc6", "value": "f521864df4943f912ba65d6169a61f62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344261, "uuid": "311d8f77-346e-4c11-9cf2-fa5a3a4bbccb", "value": "6144:FoEhJxdTxo236glznPtTOKQGqGuZfP9NLHv:Koxdtz31htgGfuZfP7LH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697344261, "uuid": "d1edf00b-74c6-4cf8-979b-1c8395e7fad9", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697344261, "uuid": "3dce082a-4aa4-4a27-9a36-6ff8733c6d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697344261, "uuid": "b9025244-fc30-493a-8d94-43b1059f46d0", "value": "786d66537812fd5b0bc48f67e87b4a5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec95148a-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353400, "uuid": "33c2d847-dfe8-4a7b-84d4-d89224362aad", "comment": "Malware payload (Gafgyt)", "value": "1f16e78d5eef8d8e7cfb910b2107588c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353400, "uuid": "6edf1223-0614-451a-bdd7-510bc76bdb0b", "comment": "Malware payload (Gafgyt)", "value": "c7d76c6eaf1e9c070d5056456dbe4c0045849755d5b21780b069601a6587388e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353400, "uuid": "fae7a9e5-8cce-4aa3-832d-afc6fce6f459", "comment": "Malware payload (Gafgyt)", "value": "866d35749915f25f400b3440cb90171d6a76581c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353400, "uuid": "21fd0bee-e5fb-431a-9bce-4d42e00a6998", "comment": "Malware payload (Gafgyt)", "value": "4c8bb9331b1f57c7fb6f3d7444e748400fb01fc5cd3e93bb5fa94ff2b4c34811806d96179675eeded96d6640b454e0de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353400, "uuid": "4e2b8c91-1b56-4525-864e-ecd289116f9f", "value": "T168E34905D7408B57C1E2277AFADB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353400, "uuid": "95f0a430-e33e-4a58-9fac-a14747143f56", "value": "3072:it8iFDKEfFN+Fa+1sWFh7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaN0h7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353400, "uuid": "1b3586a4-c818-4393-942d-540f73835404", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353400, "uuid": "2c22c41a-e44e-4323-b44a-32700d926796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353400, "uuid": "88309505-8372-440d-8f7c-068a4c316cea", "value": "1f16e78d5eef8d8e7cfb910b2107588c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab22fbd-6af7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697332137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332137, "uuid": "bb1279be-e792-4c6d-9208-b1180aa3b9ef", "comment": "Malware payload (RedLineStealer)", "value": "6ad4503cbd112635703a871666c13e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332137, "uuid": "89e7b90f-87fd-43eb-8436-7c89e6db1657", "comment": "Malware payload (RedLineStealer)", "value": "c815e17d7ec053567abb6eda6798ec463b794ea8f98b45e2caf45c20c33e5ba9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332137, "uuid": "82d37978-736a-48af-9680-ce6cd676f63a", "comment": "Malware payload (RedLineStealer)", "value": "3769ba0692ea61b0c9b8aa04c75330ea742dc7d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697332137, "uuid": "643ae65a-b620-41fd-a131-fad7611026f8", "comment": "Malware payload (RedLineStealer)", "value": "b453e850b2a05a351157f3bc83ae8fb7a76b178d7f9a7a07e61b0ddaf7d97a6f052bd34e7ff75c807aede6d8df0425cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332137, "uuid": "683f575a-f645-4527-b55c-e54d2655b65e", "value": "T15D152203BBD85023D9FC9B7458F503831E35BCB8987456AB6301D9AE15B2760E972B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332137, "uuid": "d5b91fcb-6352-4d3d-9def-bd98be35a592", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332137, "uuid": "c6afa14b-0ab5-4872-873e-ca5c58f9a8a4", "value": "24576:dyAVq8feMNgXiJIWeI4+9YPYhveQ6Awqq:4AVqqeMNAxrI4+9Dhvl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697332137, "uuid": "be56cda5-a240-4cbd-a32e-a17e30537b55", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697332137, "uuid": "73c28962-b55a-4b4b-a2d3-fb55deed8b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697332137, "uuid": "0d74e789-2c60-4296-8fdd-8456f5c490d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a44f608-6b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386307, "uuid": "f148f9d4-5636-47ca-a9fb-b8b51a1e0598", "comment": "Malware payload", "value": "ff6018379580a0f672c47e2051e514fa", "object_relation": "md5", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386307, "uuid": "21f62e62-2076-46c1-a08f-9fda06960e97", "comment": "Malware payload", "value": "c93da81208320044581b98da667f8320dff7499dc8a12d51ecfbd4ae312844c0", "object_relation": "sha256", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386307, "uuid": "fed7ad82-7906-4c2c-9928-32568d6da1b5", "comment": "Malware payload", "value": "8ed65c1a80cad3efe536aff32a5b4079a4f233df", "object_relation": "sha1", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386307, "uuid": "c7a722e4-c129-47c8-9db8-43aa73a59f0b", "comment": "Malware payload", "value": "f50edb53d325f0b2b7f4272399e0bc6ea0a0ba899fd7961db8be44fe7cba5cf6a8b8d445fef0f5859468b2d02417d4e3", "object_relation": "sha3-384", "Tag": [ { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386307, "uuid": "2f78e7e6-a479-4596-b5f6-7d4bda4e515d", "value": "T19DD0A7648646C2C7D793B5C62160BD10A80EB99528E6E94C6186CA5B0CC0CD1890D6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386307, "uuid": "000f3999-6493-406f-adb9-36f834492f88", "value": "6:tr54vVG/4xHe6FJQ29v+GQs854f5oeTckc:tuVW4xhFJ/v+GTRzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386307, "uuid": "bdaa198a-9fbd-4a1e-9b2f-bd43cc9384cb", "value": 232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386307, "uuid": "639d991f-c598-41d1-ad38-bfa6af56197e", "value": "application/x-wine-extension-ini", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386307, "uuid": "0e0c1965-ea0e-4244-8552-d3b2b8565f1e", "value": "ff6018379580a0f672c47e2051e514fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7cab12-6b52-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697371439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371439, "uuid": "189288e8-9d47-4cf5-bef2-15145fea2eac", "comment": "Malware payload (RedLineStealer)", "value": "5b0c6297ae000a8aa23f7dd596d8660d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371439, "uuid": "edf34ef1-6aca-4a4d-b486-a7f30385102c", "comment": "Malware payload (RedLineStealer)", "value": "ca8afdd68c067a8826d48085c8c6c00cc5f20b4405d80955cdfbea34f5a8d9cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371439, "uuid": "194a2c50-c61d-4110-ae1a-aff1cd80d6df", "comment": "Malware payload (RedLineStealer)", "value": "3e98faad0cd901baadc871cc80a03556068d1a39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697371439, "uuid": "17fee991-66c8-4829-ac14-f51210aa2bb2", "comment": "Malware payload (RedLineStealer)", "value": "29cb49c0c0102a2e533284fdb821e2cf8c8edfd9918a46c68aec0124cbad477dee69847d5074cbeab1c3b6f9cc41862d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371439, "uuid": "7a1aa251-d620-4426-a074-6b6861017faf", "value": "T17F152362FBC45532ECB12B7049F307934A3ABDA149B8439B178195A98C73791E87337B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371439, "uuid": "6a2f59d4-3e74-4e23-aa06-0b849ab02961", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371439, "uuid": "0dcff623-2b0a-42da-8a5c-426e1eaf1015", "value": "24576:QyXRRwIvRBp1gginCjkAptWtnXe+ml0Ak:XXRuIvzrgJnCjk2MnGl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697371439, "uuid": "fdc1f367-0104-40e0-ba17-84ed3373b5db", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697371439, "uuid": "f2fb568f-32da-4e20-b355-49ff7b4e8a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697371439, "uuid": "78e596ec-8869-4aab-a315-25912e6f9330", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c2f8f9-6afb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697334003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334003, "uuid": "3aee319e-d044-4c09-976a-f4f65020f1fd", "comment": "Malware payload (RedLineStealer)", "value": "e986528a923d7292fc564b5f7dabe35a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334003, "uuid": "7415047d-fe28-4138-99d5-6994a9a84427", "comment": "Malware payload (RedLineStealer)", "value": "cacf90307c693ecb1b7890bc5af12a49105aa868a8c07aab45f512abe94cee0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334003, "uuid": "f22a9f0a-d4a4-4cca-9f74-b51dc81ba103", "comment": "Malware payload (RedLineStealer)", "value": "78622a9203e8f432312f744d0177c39e79bc4aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697334003, "uuid": "dc484fa0-f901-4465-bf9e-e734628da4ee", "comment": "Malware payload (RedLineStealer)", "value": "f632065a791ddfd4c7384048ae0c4844c9dc99a6c3c20a016b7dab98f0f5b1b03458a0cbcb38f74c1d52b62973f3e9be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334003, "uuid": "d06a16c5-4cd1-472e-bdd9-b33acf0eba6a", "value": "T173152257A2D45572EDF85B708CF202C70A3ABD61ADF8835E1351E99E1CB26C0293973B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334003, "uuid": "260846fc-e878-4b4b-b323-94225018d3fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334003, "uuid": "da3b2deb-8755-47db-bd17-b2029368860a", "value": "12288:lMrdy90LuoSiwy7g1uty+Z+jiv+zCGQG9jeKA391jZuT9feCi4BPC5iXMWILGSw:AyGuXQtcjiv+zCbKaHwT9mCiCxJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697334003, "uuid": "4e2bffc5-b79e-4546-a9b0-053064a7bda7", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697334003, "uuid": "b2a03e3d-59ae-4403-a67f-6662a399d7fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697334003, "uuid": "e7ab5dea-3adf-466d-914e-2e75d7496168", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106c609a-6b83-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697392115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392115, "uuid": "b2832586-57b3-438c-835c-6ef0b58a7924", "comment": "Malware payload (RedLineStealer)", "value": "d13408c0edb6d9d3257dc74340792daf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392115, "uuid": "12e84841-b024-4c12-a2db-8f645e8a1c2a", "comment": "Malware payload (RedLineStealer)", "value": "cb80ecca5849040f67d2cd926f39b8eb3b3f1a21e5a0f0fa862c569bb23b5dec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392115, "uuid": "5cf8c9bd-b323-4828-a2f9-4da8372766fe", "comment": "Malware payload (RedLineStealer)", "value": "9cbd678eaa51369a984e54c7f4e8cb9eaeb349bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697392115, "uuid": "924c737e-e5bb-4b15-9f2b-bed8f76866ca", "comment": "Malware payload (RedLineStealer)", "value": "92bdbf997fc414efb1a2e03aaf3351eb056f469befd325b0d8df541c77fa26241a6886ffea928bfe9386eef02050c92b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392115, "uuid": "64e47683-93f6-436a-aea4-ddc3da18220e", "value": "T13515234366C58033E9B103B09DFA1A071B3ABCB55AB4476F27C1A95E2DB3A50D53933B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392115, "uuid": "c55e9ac8-3006-43a9-9454-1870235eddac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392115, "uuid": "5090c283-dbf2-4ce0-8b7c-e3fc6e902bca", "value": "24576:Vy5WrGTAUiiyzHl7xw9/D7uybWlL/q5ajkJ3KXpk:w5Di55K/D7uySlL/qv3yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697392115, "uuid": "bb3cb21b-2dba-410a-9c0b-ddd2c6d085cf", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697392115, "uuid": "d95deef6-afc9-4f4c-8f40-4e4cc27e717b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697392115, "uuid": "24de87cf-473b-4364-849c-2bf451a5c194", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32cfe90-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376899, "uuid": "bb6a7e2a-e22f-4869-8d91-fcd54df3d242", "comment": "Malware payload", "value": "e63699ca60e6dd2e0831b610b165dbb8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376899, "uuid": "f4bec7c2-237f-4d34-a052-c885117af0af", "comment": "Malware payload", "value": "cb9aca4fe48faa42d3a547ebc38dd812f77cd5f991bf1015a55299ac99984fa3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376899, "uuid": "8eee4a35-a09a-477a-817b-437f0781eac9", "comment": "Malware payload", "value": "b644694a7d54488896fdabb39bf5a11620c78eed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376899, "uuid": "7c64c5bb-1e95-4352-9566-e2682282ba89", "comment": "Malware payload", "value": "a507c88ae3aafae614fdc2d8f11b9f3af0d3e08793ca27067cbc956874c4fcaeed4babea99b38034c008c34fba5067c4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376899, "uuid": "f4808796-1712-4234-936b-e7ed6cb95923", "value": "T1754324F2928E8361C4D3CB9C55DCFC53822991129BB22EABF12CF75D238E57D5188987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376899, "uuid": "4abc45c9-56a9-4148-be39-c78887900c95", "value": "768:bgggggggggggZsssssssssssZgggggggggggZsssssssssssAgggggggggggZssj:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376899, "uuid": "eff93b0c-789d-40fa-84c0-d10ca50d168b", "value": 58535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376899, "uuid": "fd41e0a1-b43f-4527-b051-31a8987a670e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376899, "uuid": "8c8a70b1-3d4d-49ac-9e44-cc3dc516c35c", "value": "e63699ca60e6dd2e0831b610b165dbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be12e028-6b55-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697372650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372650, "uuid": "45501231-1c14-40d0-87ae-08ce2d5234d6", "comment": "Malware payload (RedLineStealer)", "value": "ef646a3bd274f6b635b3092100986444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372650, "uuid": "0cccb8d3-9cfc-4837-943e-d13038fff38b", "comment": "Malware payload (RedLineStealer)", "value": "cd1a7125b011886eb739ca141637a7aeb79473b3036e98b95674ddd1dfdd6071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372650, "uuid": "ed12595f-8504-407c-9ae7-f39d87022ab3", "comment": "Malware payload (RedLineStealer)", "value": "aeff68966c87cf04a00c5efb0c0d03fef5784558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372650, "uuid": "33734ebf-3558-4e37-ad44-1e92b3c56c6e", "comment": "Malware payload (RedLineStealer)", "value": "d21580e71c857fe9634365504fd3c9459ea562da57594e56ec3f18614fe8884ead15ffbabb4966091bdc4d36ae0438be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372650, "uuid": "c707f739-a3bc-41e4-a733-594cb25f36c0", "value": "T138151242BBD49472FDB52B3054F326870F317DA089B8979B275A984B0DB3A94B835337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372650, "uuid": "95fe513e-8a83-4464-b304-43bd01d4c531", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372650, "uuid": "e31497a5-53c1-4ed7-a441-0426606448dd", "value": "24576:hyut48GOlZf9dWaLg+BlYJ3BLXRMOuZ+7c9:UwV9iLXRd0+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697372650, "uuid": "dd4bae82-b475-4026-a58b-389e9b46993b", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697372650, "uuid": "1f465eaa-96c7-497d-a385-6719edbed351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372650, "uuid": "d10e963d-aa5d-4a6d-a867-97677e0a7be8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed03aa3-6b25-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697351740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351740, "uuid": "9a942e9f-a209-4c1f-a0bb-495adfcd8fd6", "comment": "Malware payload (RedLineStealer)", "value": "b639244519764d606ac92428a744bfa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351740, "uuid": "c2a17f44-3316-4dd7-8fde-58a74825bb63", "comment": "Malware payload (RedLineStealer)", "value": "cde2e1845435e14d8580d0e15264eecb234c7bb7e289abc71dd5f07f17a53d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351740, "uuid": "09bc89c6-8422-46ca-a810-e880a44a8198", "comment": "Malware payload (RedLineStealer)", "value": "e92a06ca778547ff248c2d73d6c6038851529dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351740, "uuid": "58c799c5-b0a1-4193-999d-8fc087a94a91", "comment": "Malware payload (RedLineStealer)", "value": "1cbf95a23a866d58aed6aea5a6d82d008fe1eadd7277af0b789af482680980585635114654d2df6f90ede39d684e542c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351740, "uuid": "73482463-533a-4403-af01-740249fbfc08", "value": "T14B15230567E98423FCBD277159F7136306327CE3EDB8839A2782A99909B1D80E47573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351740, "uuid": "b0a074f7-11a4-4cb4-952c-a896beb674a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351740, "uuid": "04e9dbe7-4c7a-4280-9055-eddcf99e30ba", "value": "24576:VygZpR/5ZCqbcUKGIyjq+ilI5HjPn7GZ2wv:wGR/rUGIyjzWO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697351740, "uuid": "0a34b508-d082-4170-ab9a-b60658693fb5", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697351740, "uuid": "450885b9-2353-40c0-9348-a79e73056d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351740, "uuid": "fa7c2e00-e641-403b-976e-0f43fcf36ca4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df723bf2-6b26-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697352519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352519, "uuid": "aeb56f76-fad0-4b6e-982a-0579ecffd405", "comment": "Malware payload (Smoke Loader)", "value": "8ebcdcb8890def6c8cd26effb6a81fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352519, "uuid": "2dbf63a4-a1a0-46f5-a546-3f513f2f2a85", "comment": "Malware payload (Smoke Loader)", "value": "cf17ba3233bc2dab9db27c1c73682990e0403054fad2a4ba39316d66c53bb406", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352519, "uuid": "0956ee21-bd10-49a5-a417-ccd4f634a811", "comment": "Malware payload (Smoke Loader)", "value": "2cad492e38715036eb1ae1aea39db1392ba17ce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697352519, "uuid": "4236fa21-046a-4c51-b900-7b26a8170dc5", "comment": "Malware payload (Smoke Loader)", "value": "d22f51eab09418e5d45a93737c52f6792a342c4a5142db55ffc6b32fbc743ca9bed8ae0d7364d5d338e2cebde4045853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352519, "uuid": "eb9493d1-19ab-4025-a313-0b6073022e74", "value": "T137346C5362F0BC50E81647338F1EC6ECBB1DF560EF59AB56221A9E6F0A72172D263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352519, "uuid": "c95b2e88-67dd-48f2-aae7-8ab85797923b", "value": "ac884caf40631ad7d38fc4bdd9ec1343", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352519, "uuid": "c4f15635-482c-4ce2-bb2f-276323a07b2b", "value": "3072:xhK/PFaHNlCwQ+Y4ExbH8Ktd0I0Kg1joOBJFc5ziTfCkqQU:mnFyNlCBb4ExQKtbg1oOZCiTfCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697352519, "uuid": "5ea98808-8b85-4ad7-b558-127e7555396e", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697352519, "uuid": "728c209b-7095-4eef-9d92-7bae7c8f4acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697352519, "uuid": "6987c751-e13b-403d-a8c0-57e80e60f3dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b42e102-6b11-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697343359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697343359, "uuid": "f639522e-3e4f-467e-bef0-7aefee875ea1", "comment": "Malware payload (Amadey)", "value": "fe2fb418f5bcf0de36c18f8ebd5071e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697343359, "uuid": "832306de-5686-4d3d-bdea-fd0e9051acef", "comment": "Malware payload (Amadey)", "value": "cfbd24a3ff45eb3d630bbe3fa9d8db4fc6c4e78da702a3e5f1aec08973b60c2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697343359, "uuid": "d1008a40-5538-4035-809f-b296f0917d28", "comment": "Malware payload (Amadey)", "value": "a4187f3a2f510a791ffd64229842fdf2b10bbfe6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697343359, "uuid": "a474bed5-2ce2-4c58-a637-743133c292e5", "comment": "Malware payload (Amadey)", "value": "c0c147da534a2044076e357492f5e491d18d9ff07854b2c2051e42faa6add2d7a0a88f28995217603f17d3b402651568", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697343359, "uuid": "6996c7ff-de35-452b-9230-ba67d265b489", "value": "T130152343BBDCA4B2EDBB27702EF101931736BDA19C34876A2341649D4D72681BC7A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697343359, "uuid": "aa639496-eb0f-4513-9489-642b359ddc40", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697343359, "uuid": "2044c667-f3a1-4714-ad63-3440dc1e4922", "value": "24576:2yzFNFpOrPpA0WUnDUIAhgte/quEZJx88Hv:FLJ0LnfAvbsLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697343359, "uuid": "57a2fd50-d830-45fd-9199-4f4f672cc05d", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697343359, "uuid": "8af55c0a-53ff-4d2c-981f-933b24474f1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697343359, "uuid": "17827715-426f-4871-8519-7f8e546f7fdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f3a04e-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367158, "uuid": "bc8ebb8a-a8ae-4de5-82aa-131377e4ead1", "comment": "Malware payload (Mirai)", "value": "4d08ca60ad4601f9d70660e439a86ad0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367158, "uuid": "301504d0-9819-46c7-8744-605e284b287b", "comment": "Malware payload (Mirai)", "value": "d01a6216f3844ac04bf3696136ab652dbff7b339dbae1dade90162b4ecc97a52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367158, "uuid": "c0049525-d8bb-4f81-94a1-83510c440e26", "comment": "Malware payload (Mirai)", "value": "1b12eeeeb6703cd48e052b48f9936f4732753f01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367158, "uuid": "8ce43a49-3a0a-4e20-8adc-8732022ebeb7", "comment": "Malware payload (Mirai)", "value": "577f5810b19d429e95f883dbce060e5a28d899d5b7d9850af3cf84e2c2b2a334618c135ec9e42f7fc155cf1649c04435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367158, "uuid": "02dcbaf2-e579-4180-b615-81800ce43412", "value": "T193F2E16DE6A395E4CD092D7A35CE82B50659D0E2B18B078FE31D0484D07B99EBDCC4F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367158, "uuid": "e1642a13-8728-4587-8959-8954edc254b6", "value": "384:NERzvzAkNTXrkPBUWlu00Jd34b2KLICQuzcaWs7ARV3E0rDAUa7qk6mxjEablKZr:azkSrgflLEVOiWAI0i7qaoabl7WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367158, "uuid": "d6e64136-1f19-4c8c-8783-fbb820565ac3", "value": 34688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367158, "uuid": "7c77864a-a84e-4ad4-9e9a-c53eadc99cbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367158, "uuid": "99f3e08c-9eaa-4383-a5e3-9d497618fca1", "value": "4d08ca60ad4601f9d70660e439a86ad0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133f40d-6b63-11ee-8907-42010a9c0042", "comment": "Malware payload (PovertyStealer)", "timestamp": 1697378534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697378534, "uuid": "0bc7ca4c-1a9e-47fc-a3c8-8b3035f7cb7a", "comment": "Malware payload (PovertyStealer)", "value": "76819982893d70b7e344387acfa587de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697378534, "uuid": "86aedf6f-725b-4445-9070-4386c967a91f", "comment": "Malware payload (PovertyStealer)", "value": "d0a4321a9aa24d48a3fe146368ab5c3044f0228f55ac32ef21267b70284dc6fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697378534, "uuid": "e1d4d1c4-4507-4461-b24c-186c359521a0", "comment": "Malware payload (PovertyStealer)", "value": "3713b0000219833c5b4f819e372eb2543765a0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697378534, "uuid": "ba8c65d5-1c89-44ee-a97a-23d92956cbc3", "comment": "Malware payload (PovertyStealer)", "value": "a43a84dd413c2558c887679425111319ca7abc1f5026bc5fa9ef44403c0020c1c342cc65e38a2d69e39af5fa160a1ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697378534, "uuid": "f18041c9-fb81-49eb-985c-57f3a7815030", "value": "T117E39E0275D1C872EF2219310D60EAF08E7DFC704F545EAB63AC1A79CE642D2B629977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697378534, "uuid": "b0cd39fc-f19a-4697-b9c8-653f1d70e488", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697378534, "uuid": "93a0e066-2d30-411c-a04c-2856a7904ef4", "value": "3072:bMtnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQR4257BD4I8TJn:gZEe3bpi5aaYy57GI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697378534, "uuid": "0d2697d6-01b4-4683-a52d-d2b8e0c9064f", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697378534, "uuid": "f3de4ba6-2102-4d56-8afe-99caf89055fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697378534, "uuid": "6ae2eded-7fb5-424b-a071-416e5c03fd3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d7c81c-6b49-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697367314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367314, "uuid": "5f19f827-29c8-4d9f-9ffb-eb3d34dc5ca1", "comment": "Malware payload (Amadey)", "value": "7d471329ea736e0c6a2b0cd56eb47c5c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367314, "uuid": "de2a877a-993f-44b9-8316-938e85792e89", "comment": "Malware payload (Amadey)", "value": "d2dab3a4ef93079da62b253fbed7e7919add567a22895d8db1cc61e0cee3195a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367314, "uuid": "90c90849-3164-468f-93b3-35a890f590d1", "comment": "Malware payload (Amadey)", "value": "21f00934f27ae2300c62751300e434dfc57da484", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367314, "uuid": "b503315c-da3b-4e83-8b4e-3b72942f2ecc", "comment": "Malware payload (Amadey)", "value": "c26a155ea861c0ef6b001170306cea98d83bd6e9f4c520dd19d9eef395614f2d3dce833150755b216d71c2715cb82548", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367314, "uuid": "dba6ae2a-b336-442f-9e8f-6ad48f132b20", "value": "T1E8E39E12B5C1D4B2D97329310970DAF24E7DF8300F246E9F73980A7A5EB42C19A39D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367314, "uuid": "f1125a6d-85b5-4aeb-9f67-e9e254c9f764", "value": "c7c9eb7dc16fdf30c39a296c30ab2134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367314, "uuid": "15791cdb-c0cc-4d00-ae84-e303cb9b8c10", "value": "3072:5sF3z98m/NtBuu3P7gKOhiqvleDT2xns0yjzYQR22i9YpWTdQs4TJn:+d/gu3PkiaRnyY8iWpo94TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367314, "uuid": "43fd6ebb-e1de-4846-b345-878fe6b46d2a", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367314, "uuid": "655c3c64-f33b-4c84-aa39-5659f79f594d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367314, "uuid": "7e566762-2c06-4906-b51d-5dba62f5bdcb", "value": "7d471329ea736e0c6a2b0cd56eb47c5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc04b543-6b9d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697403624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403624, "uuid": "c6f66b2f-7b03-4f67-9776-6a6fdbfd1c73", "comment": "Malware payload (Amadey)", "value": "20e3f5c30e2db0d1104c517c2ef9f4a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403624, "uuid": "362edc45-dae6-41e7-8bcc-759ea66ad7bb", "comment": "Malware payload (Amadey)", "value": "d4d258b6aaee129094ae9881cb0cb13e19b827abbaf86e57e0767f0da359d28b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403624, "uuid": "e06b45ce-c1d7-4972-8a4b-d24777895f3a", "comment": "Malware payload (Amadey)", "value": "09e9395866c28fb7526ba6085cf85bcffff3bf43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403624, "uuid": "676e8b49-3623-4f5d-bcfe-f48fd6c80fd4", "comment": "Malware payload (Amadey)", "value": "7b5fd83daae9e240efa5de1a8481efe84443d2e0a34d3f792e5df02d33d58ff16c3a5f7244a2b5a7ff31482c1165d12d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403624, "uuid": "4e824865-3a16-41d6-bc4c-287fa53b12ce", "value": "T17CE3AE1275C18971D67338350963EABD4E7DF830CF54AEAB639C0A394F602C19A39D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403624, "uuid": "69d923b0-c693-43f9-93e7-4703649bc40b", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403624, "uuid": "608cb3a2-2867-40b8-a21d-b20d4cecd2c2", "value": "3072:1M5nJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQR52VnRXPe+SF6g54I8TJn:eZEe3bpi5aaYLVnRX2b2I8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697403624, "uuid": "4b406ea2-5501-46fc-a8fb-881af242f9e7", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697403624, "uuid": "3f22056d-7c2c-438f-bc16-23310a41622a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403624, "uuid": "0f9eef00-9002-4c8c-80c6-66b0d32c4fb7", "value": "20e3f5c30e2db0d1104c517c2ef9f4a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10464dcf-6b35-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697358614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697358614, "uuid": "015cc03b-db30-4d39-b21c-1b10c778bc52", "comment": "Malware payload (RedLineStealer)", "value": "c4615f78ccd2f5e90c7ffa9bf07a862d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697358614, "uuid": "b31f0beb-00ea-424e-82a1-1f5c03778697", "comment": "Malware payload (RedLineStealer)", "value": "d71520932d1c73d53d3cab395a453f28785648344969f5a70e5b30ca0afb878d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697358614, "uuid": "69c8fdf7-789a-4c69-aea0-2a13020871e5", "comment": "Malware payload (RedLineStealer)", "value": "bdba37bd42dae24e6ca5737a417f51158b70f46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697358614, "uuid": "c46358f5-e44e-4183-94ba-51c20360a0c4", "comment": "Malware payload (RedLineStealer)", "value": "fa1c9345a7c2b0a9797d0464825138f3bf4c6727f10b1749f65ac1a838c64a556e0240f8e78d1b4773d04b92653a62c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697358614, "uuid": "c380d4a9-f09c-49b0-9ebd-e7a583cd103e", "value": "T130152257F7E49473DD72777068FB06871A397CA29868432713A0BA1F0CB3495A83637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697358614, "uuid": "50ae96e3-fdff-48fa-bfc5-fc39a5d294b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697358614, "uuid": "5180f29d-2c26-4a9f-b351-437f97331aaa", "value": "24576:mywI9vAArCy6IG+sHq9ky0BWVenHXvGAZA1:1JlAArCy6J+ZO0eO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697358614, "uuid": "eeb7782b-9292-41da-80f3-27a5a3a95d66", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697358614, "uuid": "fb7d9e68-fdfe-4d17-bc9d-9f3095f44234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697358614, "uuid": "78cf5f04-a92c-4f7e-8a55-b4c755479539", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00da8dd-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353352, "uuid": "5a0f5d8d-78b9-4e5b-ac3e-ab8d3e13fa93", "comment": "Malware payload (Gafgyt)", "value": "2210372f3ab0e099aae22c8f4b31b1fb", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353352, "uuid": "b70e8ac9-4921-4617-9785-ff5da0b07e1d", "comment": "Malware payload (Gafgyt)", "value": "d7354f6a1ab125e4837d773011d76694aad5300e62c0c1fe30462b9c5df62eca", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353352, "uuid": "f28d06b8-066c-4130-90e4-982750fe273c", "comment": "Malware payload (Gafgyt)", "value": "b834a4b8684fbaa675a4fb992079fa23c82f0079", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353352, "uuid": "dce8a3a7-44d7-4052-b2dc-3ff05012bdf1", "comment": "Malware payload (Gafgyt)", "value": "3b46e634ba1d95537902dd5b7f70ac7510f38ea0e05b05dd5d9e491d372ed6053f1e601517db04133fc46ca18b77803e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353352, "uuid": "9d9cbddd-a785-4574-b4bf-b8145c1fc9d4", "value": "T140A32903DA60847EC48B93761BDFC6225623F8B90731621B63C4BEA92F169D9DE5D343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353352, "uuid": "43000a21-2d73-45b1-bb0f-16ffcf25a890", "value": "1536:Q9fT9WiC3txvWtfEo5vXJM9wypej++3hbEgL7nLGPTms5TDUMHYr/:Q9jC9wtsOnuejjhbEgL7smITDfHYr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353352, "uuid": "5a2d7469-4655-45f2-be44-a6dd11dc9f61", "value": 101269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353352, "uuid": "2d682ba3-375c-4cc1-bd86-e3305741f6de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353352, "uuid": "12c4fd68-67e0-462a-b9f9-2ec514459753", "value": "2210372f3ab0e099aae22c8f4b31b1fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ed779d-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353387, "uuid": "bc030e99-8393-455a-b164-2dc9bc2caf25", "comment": "Malware payload (Gafgyt)", "value": "63d906f1da0555adfbe9631aca68d4f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353387, "uuid": "e7c7b3aa-9a9c-4ed0-8b86-a80eaf01d413", "comment": "Malware payload (Gafgyt)", "value": "d7b7408f445971c73d30969c1dd5535e765ef8ff245a7dc4df6a2e9d09374f9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353387, "uuid": "21749903-2808-4e8c-8a70-4b6ee3f70352", "comment": "Malware payload (Gafgyt)", "value": "bcf784a52c0666cef845efd0ecd3c6206b677495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353387, "uuid": "c6ba0fce-d4f0-45a5-b1b5-c8001819dda0", "comment": "Malware payload (Gafgyt)", "value": "93cf9178a04f6cab818fec6c1112c8750c2f364f23d449b98141b719f091f7c6f3cd5b8bcef23e6141e81f301d87bc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353387, "uuid": "f115fed4-b99d-45a3-b356-5fb1db9f38ba", "value": "T1EFB31B93F511D5B6F44AE73308D38B247270FAA14F53152263177BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353387, "uuid": "47ee3c48-6602-46bb-8e55-0921ea95447f", "value": "3072:4wQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFj3mzmmHqzTQKHKtW:4wQeqacWucW0JcWcBYmVM978Oa58mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353387, "uuid": "8436c00c-e39e-42f9-bcb3-8b689c9530d5", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353387, "uuid": "02868a08-8665-446c-8f69-6c892c7756e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353387, "uuid": "b13a3daa-72c6-4492-915b-6addf1c01adb", "value": "63d906f1da0555adfbe9631aca68d4f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4f3854-6b85-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697393132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393132, "uuid": "2732def7-a2e2-48a1-9413-77ab71742b16", "comment": "Malware payload (RedLineStealer)", "value": "0cccedc9c55f8aa6372c84883b3c7e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393132, "uuid": "bb390597-77fd-475f-9274-4609ae9d1d17", "comment": "Malware payload (RedLineStealer)", "value": "d92e8b64128279d676735e6b40761d41299f986414d080898b16e4837fb18961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393132, "uuid": "3eed7383-a5d3-499f-8001-aac3caaf7b5c", "comment": "Malware payload (RedLineStealer)", "value": "634b6f2f683d90ce455788be65586fde65848d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393132, "uuid": "b3e3f1de-1e6f-4cb5-8ec3-6e206e7b6ffd", "comment": "Malware payload (RedLineStealer)", "value": "418e82a89ec83d4c9cbb9080bd2ba12dcc40b6ddf1202b31679c7d2f7e629681400fd6d94fac90ae6825b934f9588bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393132, "uuid": "6e98a9ae-f424-4030-9ed0-20df3bc8fcc6", "value": "T14D152363BAE86033EDF11B3098FA16C30B3AFC745C759BAEA755541A09B2E816171337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393132, "uuid": "d0f2c32f-5b90-41d0-84b7-8f58a6d68a17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393132, "uuid": "14430251-51a0-44a1-9656-2d25ac631b74", "value": "24576:Pyf2zl0jSvMYXnj9ObwwCb9w/5zCkS37R6TI3v7gfYFj23:afSvMCYwwCs9CkS3dgIfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393132, "uuid": "0d54b765-3ba0-433d-b43a-b07dcd7857ee", "value": 903168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393132, "uuid": "ca7404b8-e037-4ea8-bfef-94abaaf84874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393132, "uuid": "9996b14e-96fa-4c66-a6a4-c71ad2c28c4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0722f041-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409709, "uuid": "2266fed4-29e0-48d0-a4a2-11493bcc5c1f", "comment": "Malware payload (Mirai)", "value": "280f8b7858f5d17b3912566bb1d57f1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409709, "uuid": "721b6007-6ed1-43b2-a044-69267200276a", "comment": "Malware payload (Mirai)", "value": "db02d6e260cf8bddfe512d84aa82fb432caff9768ff932b83dd59635468f96b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409709, "uuid": "65758792-cf45-45ec-b1d9-d7698dff851f", "comment": "Malware payload (Mirai)", "value": "aa40f4e2dd69e6f63cd9c8ad45a989e3e7b3e9f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409709, "uuid": "38673fa9-f182-4fbe-949d-f1a7c09300ef", "comment": "Malware payload (Mirai)", "value": "b095f1b57af9dfc564ef7cf3ec6230d7e66bb2aa1891753eff820f31de1e0185684b590bb676d5392c4270660fac6fd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409709, "uuid": "e7bfe409-b714-45c3-8ecb-a0e3a3d5869f", "value": "T18B83080AB941AF02D4D721BAFB9F414933536F78E3F972019D24AF6123869DB0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409709, "uuid": "cc5212f9-cd29-441a-b42d-21bf9f32d866", "value": "1536:1Anf/yw4H82LagfJcbG04kW2lByxMJinEFo0bScZsYHtzN3QcK:Gylc2LaOJcbG0R0EFo0bScymzVTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409709, "uuid": "049e953a-ee72-4128-aa97-b8989c67b3fa", "value": 82564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409709, "uuid": "2569b04f-bcb2-404a-9926-280e736f2b80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409709, "uuid": "2af4fa74-0d7c-400a-b543-5edeeba66b59", "value": "280f8b7858f5d17b3912566bb1d57f1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77707da-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376960, "uuid": "d5f13fb5-851d-4e80-8350-ad8db5269781", "comment": "Malware payload", "value": "6f1ffaf230e9cce364c03fa4107a302e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376960, "uuid": "2bce1716-bf21-4fc6-a57c-bc1efaaae0f7", "comment": "Malware payload", "value": "db5b43b8de3ffb308b2d5823650595eec5ff88863ffa78e50e8cd859f00e4426", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376960, "uuid": "298d0816-f32b-47a8-9a95-31a4d7b85abe", "comment": "Malware payload", "value": "d3c1a1f4ca162d5d2eb685a1f80f9515daa5d2a8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376960, "uuid": "a5c3aa96-f537-455d-9fe1-50dea300a78a", "comment": "Malware payload", "value": "79aa6d082b87144855b02b6b8727e32fa458f525409af248825829ec2c16d8a259534be720286058672c6f7172d226e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376960, "uuid": "648bd711-da08-4052-b921-8038b38d487c", "value": "T1D03145C6C876081882B3D7A956FB0CC69A5C38424C109DEBFA8E74950F51EF16EF0B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376960, "uuid": "7112d0db-efeb-422a-99f2-5050915f15cd", "value": "24:B0w8+FjnoQ9cReZz/7/V/l76hhBBiwY1iJYoR4EaWwHcJ:29+doMB7V976hhuviJYoR4EPwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376960, "uuid": "9fb0601b-0383-428e-9318-9a8e22dd7a21", "value": 1518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376960, "uuid": "cf4184db-3329-4f07-a192-6f6a8afa9caa", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376960, "uuid": "d662d012-b540-4457-8420-53fa5bef99c0", "value": "6f1ffaf230e9cce364c03fa4107a302e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd51123c-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353375, "uuid": "d79cbfee-ca69-485a-8b0d-34582c99392c", "comment": "Malware payload (Gafgyt)", "value": "f946268a969d08164f5f9473674b0c8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353375, "uuid": "807cd080-5db9-4bd4-8c22-a7c25871ea40", "comment": "Malware payload (Gafgyt)", "value": "de7b741d52b9a3c2488bd50c966b50700d532b77fddb85f730eb15ee53ad5acb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353375, "uuid": "ef3fd26b-37bc-4e49-8a77-947462a8fc60", "comment": "Malware payload (Gafgyt)", "value": "eee06453f805d6d2ded3a1df2e2b16b42c60bc8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353375, "uuid": "485d1e90-28f5-4951-ac72-0cb343f88b15", "comment": "Malware payload (Gafgyt)", "value": "efc487ad79464255f71b2251b26a66af0e5b37d84ef6a2cd9f94b96285dd4d8d6dd63427cf6d809ded16bebe0a2bfb56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353375, "uuid": "503267e6-e82c-415a-874f-e54e3f2c9124", "value": "T1FEC32A2327670B23C4E9503441E75337B7B5CB943878934BAAD0AE9C2F1AAD435973E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353375, "uuid": "9c8ec2c8-620b-41dc-9d4d-7f63acea81f1", "value": "1536:lIR8jc0YyVNM2ZwoL0QImVv6Fuo+uU1t2TQM9KGmuwA/KiyYIW:ZcVyVNXZPVvaFZVX4GmuwACXYIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353375, "uuid": "73dd20b9-944f-4894-9974-d2c453b91272", "value": 119963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353375, "uuid": "7273b11f-c058-4595-a4c4-7cba1fd68214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353375, "uuid": "8edc78f0-4f84-46a1-83cc-87bf39a94bc2", "value": "f946268a969d08164f5f9473674b0c8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499458f3-6b7e-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697390063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390063, "uuid": "25e45e05-e6a8-4656-af37-b0fdd3878593", "comment": "Malware payload (Smoke Loader)", "value": "8f1ef200b8af9e31236a1637ec7b07e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390063, "uuid": "37a97e25-295a-4921-84a5-8e853e2a0a31", "comment": "Malware payload (Smoke Loader)", "value": "deab8c00637f509afc29190c048623d50e0aa2aa284ce1706b18c349ce157514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390063, "uuid": "3f581516-f85a-4e08-8216-08e6075c278e", "comment": "Malware payload (Smoke Loader)", "value": "af7b92e815e4bb1904ca4b29b5df127f868c4b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697390063, "uuid": "071b8e1f-0de5-438c-8ff1-5e149a426908", "comment": "Malware payload (Smoke Loader)", "value": "c6b56ed943f3531b81eb4caed1ecb98a57e71b2893ab3782614565a1412467710ca01e4fa298effa8deae074f9243da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390063, "uuid": "2b03c615-8b8d-40b1-87f5-1a9c4c794024", "value": "T1DA343A93D3E17C50E9364B738F2EC6E8760DF6508F897B69A61CAA2F0479072D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390063, "uuid": "eba23571-f01d-4369-8d9e-6d27283fb425", "value": "8b3011ba53b7e84f6ea65a7d8a93362f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390063, "uuid": "e3343811-bc64-4eba-8fdb-ab733cc042be", "value": "3072:SPuAigfBVBqZM5lJ0+RCg0bdwv6NcIYc5XnYPU4Jo:OuAigxCMvgz7YW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697390063, "uuid": "bebf49fe-53c8-41cd-9a7d-b5f120e77eb7", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697390063, "uuid": "99508dcd-fdaf-472d-974f-308abc890cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697390063, "uuid": "116bcdb4-0077-4d78-96de-35d8188950c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40397d26-6b29-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697353541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353541, "uuid": "599c36d2-e741-42fb-917e-86630ca511bf", "comment": "Malware payload (RedLineStealer)", "value": "6601f444e96b63a2333610ad4d97510d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353541, "uuid": "65ff4a10-4fb9-4ed6-8c24-40b75d2492c6", "comment": "Malware payload (RedLineStealer)", "value": "e07207fa4b032992e771e99f27f6e05ff2a30a59b51c3e2b69ff0aea7d24490f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353541, "uuid": "a8360d91-9d67-4c69-be1b-c4ee0b29bfc1", "comment": "Malware payload (RedLineStealer)", "value": "952751c7d5bdeb8e9e8688266009efcdbdfdf806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353541, "uuid": "7c4a6082-9ac7-4549-9b27-d8f41b7044c2", "comment": "Malware payload (RedLineStealer)", "value": "b276e45c8e8712f45c09303dea91ee1024ad7dd771d063f6c8b48986091ef0618b1bb02986fc2cf7f7715939a6d205f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353541, "uuid": "c8747ac8-ff04-4c0a-9250-41fa832607b6", "value": "T17E15231377D98532CA3997F028F903930B397CD0A9AD439A3946A85E0CB3655E4367FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353541, "uuid": "d77adecb-0582-4a1e-afe6-ef5933f447d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353541, "uuid": "4b0b9dbb-c522-4563-8953-eb3fad445fbb", "value": "24576:SyWIxG8ouMeOor8ykAnjnqNTpDMK69rD2fs:5TIykAnjnqXDs9rD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353541, "uuid": "b33eaac9-216b-4807-a28c-9992029634e1", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353541, "uuid": "e7bb9ba1-a44d-4b7b-a03c-210b72ae470b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353541, "uuid": "0a5d8c2b-8f68-4ab2-834d-06500a57ad19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea6ca1c-6b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386206, "uuid": "88187430-67c3-45d1-9285-d684c0362f78", "comment": "Malware payload", "value": "758138cf292edc7fc200b8853a34dce3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386206, "uuid": "a3952568-e371-49cb-b8e6-a63239ff9660", "comment": "Malware payload", "value": "e0977281cff8d83f21d9f210655e3cae51da32499369e4a99410c186c5f5a734", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386206, "uuid": "d5be1577-0c89-456c-9726-0601297c2ae0", "comment": "Malware payload", "value": "d0afb86be46def1d4d0cc2f312cffbf5e23947b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386206, "uuid": "0c66d5f1-522c-4926-8dd6-a07ef76ac022", "comment": "Malware payload", "value": "f22d4f5c88e7669a0395fcf280b7606dbfeef599fa2a9c05c24e2623992dca782dfdcaf8b71c5a129ca18d50b8ac9aa6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386206, "uuid": "7e72d0fa-b9e4-42f7-9a0b-0e0cd4a137db", "value": "T1DD01BD3F4437F36109ABCA1E503C82A0E30BC34F8344D5C476B88D8AA535898D49A7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386206, "uuid": "69b73689-bce3-4717-9245-c6278e316a26", "value": "12:w7xNS+R4Aun4Jk6UKIgeX2e80Qpcm1JVgKD3HNr2qofmrk6EW:w7xgdf9FKHgqVgmVSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386206, "uuid": "756b7a16-3157-41e4-b7c0-e61323519430", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386206, "uuid": "4c52ce2a-3920-4f4a-a55a-684ade8b15d0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386206, "uuid": "51b21e86-ae8f-41bc-b250-220fbc1fdae9", "value": "758138cf292edc7fc200b8853a34dce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6313e2c8-6b3d-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697362189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362189, "uuid": "b99e3972-0994-4400-a69f-e756396fa08a", "comment": "Malware payload (MarsStealer)", "value": "eec9b1c908b4d51384d70f55fe724ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362189, "uuid": "85de232f-947e-4dc0-b85e-128c56ad1912", "comment": "Malware payload (MarsStealer)", "value": "e0dd365543f344a5a3b384023b1111ead3fa0ab9fb591690b68e81555b4446d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362189, "uuid": "0b2e5500-2ce4-43b1-9211-b77607136af7", "comment": "Malware payload (MarsStealer)", "value": "d97d9783e5dd69ddb39fed68953609953eedc3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697362189, "uuid": "b0921859-9ddd-472c-82e0-05dbe0b51192", "comment": "Malware payload (MarsStealer)", "value": "0a9d959e5c23212d526ed0f13da9475df179b0d91a0f0e8c136b9b8eff3c5eef141ae1e07cd51ba7c2fe7729701c5d88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362189, "uuid": "ec1f92ab-81eb-478b-8bab-602aa4a0a430", "value": "T170E6482439EA501AF173EFBA5BE4B5E6DA2FB7733B06645D109103860723981EDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362189, "uuid": "4035c410-909f-4d08-91e8-e5379a6380ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362189, "uuid": "9f0cab18-8caa-471a-9f8c-6b97a5b7b31f", "value": "12288:slJI3AogfFrEUoAAziI1/qd1haTK1/KJ9WF62zE:lmA/Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697362189, "uuid": "608d3c0b-b7ee-4460-8911-78d096b8dd8b", "value": 15016896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697362189, "uuid": "6bb0fe7d-44f4-4e96-85d7-99f870972322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697362189, "uuid": "b8b15a15-3e3a-477a-aec5-90c606f273a9", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.32841.9309.10859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07fc179-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697377002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377002, "uuid": "32605a93-b071-4baf-a0e6-449d8422ccc1", "comment": "Malware payload", "value": "378e720efd30b4b948f081594b9ffb0d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377002, "uuid": "e2909df3-0777-40b5-94ea-4c362eb01252", "comment": "Malware payload", "value": "e1459c99ab707adb64bed233477e3056d5287a05ac802c3ba38eb41d4e47b716", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377002, "uuid": "e5d6ba2c-7c78-4bda-92fe-11200b44e259", "comment": "Malware payload", "value": "7145cad88d44e55afd8db68812e2096661969c25", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697377002, "uuid": "1bc9ff00-fdd4-489b-b25d-90451a40025f", "comment": "Malware payload", "value": "d6647c8ae5b1e0f8801a672373c4f5f149d3075c93448370f7bb69c392e73edd1158ae1d77ed5346fcfaab1601b39c62", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377002, "uuid": "3f5053f6-deb4-4aa4-ab00-e43cceea9748", "value": "T1DF41E3635F6D24D1E6B6880AD0716294F32F16072BF75A18FC9D46503FB10368266DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377002, "uuid": "62958f3d-fb8e-4b98-a602-f2b2a129e363", "value": "48:YlgrKSVReUB8oaGmDZ6obSS1qSB1/KU7xby2ao5:Ylgr9CWtZml6obSS1qS3Ry2ao5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697377002, "uuid": "8f43b77e-62d1-4937-8c4c-f6dc4d61a804", "value": 2145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697377002, "uuid": "5b716e65-444c-480f-99ea-0a6098efa755", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697377002, "uuid": "b6fed8dc-3443-4f62-ad03-9549df4f5e24", "value": "378e720efd30b4b948f081594b9ffb0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d058c11-6ba3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697405987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405987, "uuid": "95df7dd9-853f-423a-8590-c8f74a7d2048", "comment": "Malware payload (RedLineStealer)", "value": "534bdd188bb2c65bec88a0c6e7f6cf80", "object_relation": "md5", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405987, "uuid": "cb3c25f8-1134-4f8b-a4a4-f0f3346eb721", "comment": "Malware payload (RedLineStealer)", "value": "e3839c7ae17c63e808619ea7b85b4d147f548a117aa3ad1b015c6eaad894bbbb", "object_relation": "sha256", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405987, "uuid": "e80fd8e1-991e-46c1-9950-16d48d23e61a", "comment": "Malware payload (RedLineStealer)", "value": "5d672fb40030634b9446d89f53dcb36a9c120ac2", "object_relation": "sha1", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405987, "uuid": "70fbc0f5-592e-4cc2-b7f3-b59dea61ac15", "comment": "Malware payload (RedLineStealer)", "value": "ecc265f836548906776a3b626474ad7ac32ef25924525dcbcc08117cce316205fe42738cf7642d689aeaded0c7fc8c44", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-124-80", "colour": "#942A46", "exportable": true, "hide_tag": false }, { "name": "95-181-173-155", "colour": "#034CBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405987, "uuid": "d0daa1b6-3308-4fef-99b4-5879e9f10ea5", "value": "T1CF140B0AD389F813D27951FA60BB7188C2F1D5E1C66AC25AA810F3F7A761749B9F110F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405987, "uuid": "773d4fdc-47fc-4985-aab1-d867952f2d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405987, "uuid": "c19d6d81-a8af-4cc5-96b7-a8e5e61fd625", "value": "3072:lHGF+mQsSbv07IAbSsqzgpxtN6cXPIsqATnsrC1dU3N68WWey6w6OXuvyivvWAT:lmF+mQsSbv07IAbSsqzgpxtN6cX/srCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697405987, "uuid": "01801c2d-500c-4339-a23b-aac421a81b33", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697405987, "uuid": "803c974b-74f1-46ec-bd11-29f1e8f2424b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405987, "uuid": "b7281584-697b-4d13-aa42-f6c5d48aedda", "value": "educationdeveloper.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e85002c-6b74-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697385911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385911, "uuid": "8c05cf2d-2408-4881-aef3-560aecd118f8", "comment": "Malware payload", "value": "db2fde02752a7a3ddcbf39589acdf815", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385911, "uuid": "5da1f9f6-a513-4a94-a357-3a6b29a02630", "comment": "Malware payload", "value": "e44605478a95d78476e430f40a5720fe3286b768cd7ab6e52943553516c2b484", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385911, "uuid": "9e3e1204-51f7-4b8b-a622-3974a3449086", "comment": "Malware payload", "value": "34c8d74e2225d250fd46c5ef02cbbb8a2bd0c4ec", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697385911, "uuid": "06bb4760-9cdf-4719-985c-8dfafd79d281", "comment": "Malware payload", "value": "f049c4fc710adab0372b2692fb2e32f21aab4059377c3879fbdbcaa7c5c91adac59ef83dac7458b4e6948c4ae0a4fc01", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385911, "uuid": "91ceb6cf-121c-42fb-a130-b4900198ca92", "value": "T13122665313B88FB4E3FA540341A0F839166B4C696C31AC869DC765EE5E2121EA4FF5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385911, "uuid": "d2a32b21-b0da-4c83-8d0d-1883b43f2416", "value": "192:xfsOsiCk2SOsCjFeZ2ZlHeBsehk0PHi+PLr:xf2+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697385911, "uuid": "4ec956af-f0bb-4b0c-97fb-30bc929fd842", "value": 10504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697385911, "uuid": "dbe5e499-ffb6-428f-974e-8449b16b0771", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697385911, "uuid": "2d3c0b5c-ea6f-4f42-8b96-741b207597c8", "value": "1b72e9020156a7a2d05aa099aad42c9fda6c4adba58c77e4928330c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4917bd-6b54-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697372299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372299, "uuid": "64a4dd44-9ace-4786-b059-650b4cc5d0d9", "comment": "Malware payload (RedLineStealer)", "value": "57e7edd6c99626ba063c22837b75b642", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372299, "uuid": "7bdbadc2-6138-43ee-a8e3-4e9628ac3f16", "comment": "Malware payload (RedLineStealer)", "value": "e52c3ad4cafd72dafd117c779e6935dd996eb05ed430e9491cd7048e57296bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372299, "uuid": "d0184d74-3cd5-4be3-a490-7eb0c70c3e70", "comment": "Malware payload (RedLineStealer)", "value": "834ba3c854a3e35e91eaa0368772550cdc4b6f81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372299, "uuid": "b30fc104-47b9-4b07-b3f7-d497d1ce499e", "comment": "Malware payload (RedLineStealer)", "value": "2efff59d51bc1ed2a2a31643324d961de1210d8ce2ee29427c277b72e3f05593eb21bcac358a950737a9296dbbaf62df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372299, "uuid": "94a1fe11-44bc-412d-a5a2-79b3ad44e44a", "value": "T149743A91E08AC5F1C51C907622D2A6327C16FD2C6A5CD94B5A2AFBFA3940F4E50E7CD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372299, "uuid": "ca94702a-7efe-4015-a8d0-fe40431afca4", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372299, "uuid": "c364bbc8-8760-495f-87be-d28d63fd3a3e", "value": "6144:8LJsICnU9Q8zObMjxGFDUNHdYi9wgVbckvEoATKa/ZXqYNPoJ:8NsICnZbrwNHdYi9wgVbckvEZPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697372299, "uuid": "15bb9b66-65c3-45a0-83e7-8f4f372833e7", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697372299, "uuid": "304e1685-446f-4367-93f4-b83b2eb56b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372299, "uuid": "baef106d-d58b-4875-bcec-ab4e7352a86e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18928e69-6b6e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697383109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383109, "uuid": "9926a853-92e2-42a0-8708-6a76d4e5d45d", "comment": "Malware payload (RedLineStealer)", "value": "3d683bae0039e46ad50bebf4681785a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383109, "uuid": "2b4ff0c1-db3a-44ff-8021-42ae2fab61ef", "comment": "Malware payload (RedLineStealer)", "value": "e69e93cc1b989513d5bb4660d326f2e9aea09f903781ef9bdcbbbe2c24dbcc58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383109, "uuid": "ffd939f1-8b28-47a4-baee-d4ca656080e2", "comment": "Malware payload (RedLineStealer)", "value": "e8662a8cf438ec8521d71dc8b431c1ba592bd881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383109, "uuid": "7850117f-0a92-4d90-a2f7-2172a4392aeb", "comment": "Malware payload (RedLineStealer)", "value": "472de6aadc53df29af30d57ddae580222c903bb387ea8712d69f6907b0068a17db25750a60d5c7f833fccce64fea3379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383109, "uuid": "537ab4db-0b8f-4360-98ab-0aa7099b1797", "value": "T18D7429D0379CB9CDCC4F8EF161610A688A70D442E297BB537C8BACF7385A3955E056E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383109, "uuid": "c1c5fd0f-b2ea-478c-a174-d2141a236748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383109, "uuid": "2ac500dc-755e-41fc-8db8-0f131ab48664", "value": "6144:5RNZq8DZAGAgq2e4ChFcopU1Bhchvbfv8Iz6N1aDTi:7qqSv4CXrvbfv8IzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697383109, "uuid": "d5442c9b-6b8d-43cb-a8c1-51a3ac90ff0e", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697383109, "uuid": "3f8edcc1-d3cc-4fc7-a5f2-ae9d68580b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383109, "uuid": "4ad225bb-5a84-40de-aac5-3c995d5f2246", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140f904b-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697409731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409731, "uuid": "d7c87c49-aafc-4004-a2e6-053899d28524", "comment": "Malware payload (Mirai)", "value": "33125234fe70ac17bcbe3e29a9e88e6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409731, "uuid": "3e7882a7-551b-44c5-ae44-24e3bbdef76f", "comment": "Malware payload (Mirai)", "value": "e88b5330651979ac2f255ad93a6cc62f6ddd2271287f9fc0a14eec689c2dc6d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409731, "uuid": "954185ee-05d2-4277-b816-0b4f28c3d859", "comment": "Malware payload (Mirai)", "value": "4724cd042fe918537bcc0fe73f71b4f849914b4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697409731, "uuid": "2155c508-3ec2-4eee-af7f-3b79280b15f9", "comment": "Malware payload (Mirai)", "value": "d54b995881735fbe92185ac588409a3981a5c616bc311305019edccb79892dfb90d751ae5b6d05b3b7880818e4e719af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409731, "uuid": "f170f847-c0f7-4dc8-b2ca-65f82f094e0a", "value": "T1D4336C36E029DED0C6560134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409731, "uuid": "98458f89-4ba0-4db7-b6e7-bff63b7c68e5", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697409731, "uuid": "3f5cf655-fd25-4784-9713-a06b1f72d172", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697409731, "uuid": "165590bc-beff-459d-add9-7fa491454f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697409731, "uuid": "966be3a3-1ace-4306-8c84-767c4ef90003", "value": "33125234fe70ac17bcbe3e29a9e88e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db76fc-6b6f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697383499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383499, "uuid": "258049a2-9391-4750-b739-91bcd59bccc3", "comment": "Malware payload (RedLineStealer)", "value": "f1553d2f1a83a682080149817a2bb21b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383499, "uuid": "65399a2b-d92b-4db1-a390-7a2565656b58", "comment": "Malware payload (RedLineStealer)", "value": "ec576104db3223d3769792565565e302699c2b714d13e243537d05dfcef8ebda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383499, "uuid": "e3d7ba06-f6b7-49d4-bd48-e8447fed324a", "comment": "Malware payload (RedLineStealer)", "value": "a1a601c2234da9ed5210d6c8fc9ea16406b58e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697383499, "uuid": "2ecfb1eb-ccd7-4855-b983-a9cffe218786", "comment": "Malware payload (RedLineStealer)", "value": "819a92dfd9cd645f916d138d8ae0963c36e05306f15d989e9b3ad6b689aed756894d9653424786dd71df51176d3301a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383499, "uuid": "20d5ee83-01ca-45c4-a9f5-e7ecf3c7448c", "value": "T17C151242ABD45132E9B207705DFA13C32BB27DA09D70932E27898D5B1CB3795B87072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383499, "uuid": "91a90025-ccbb-46ca-8436-8cc4cf138f3b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383499, "uuid": "b3407076-04b8-499b-8c62-1cc7ddc0607d", "value": "24576:GywlyJC38Qnt4vYkjdVi9t0wtr+M8fGghHS:VwoJOUgkqj5sZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697383499, "uuid": "5636b0b0-021e-484f-9341-0038e63b4d23", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697383499, "uuid": "a99a56a5-b6ad-4e7f-9308-06670730f234", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697383499, "uuid": "8e5cd096-b528-4b71-b777-88386e5a4169", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7c594b-6b5c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697375417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375417, "uuid": "870752f3-05c8-47bd-9588-1fb51023ad13", "comment": "Malware payload (RedLineStealer)", "value": "a33447d58731fd61f43887586da0df5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375417, "uuid": "af598f22-9237-434d-8518-3b9a7ce6845f", "comment": "Malware payload (RedLineStealer)", "value": "ec959915aa5f00161e165a6b3a4298da829322750748eb0c4229fd4cf0839cff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375417, "uuid": "f2b4afdd-34e0-437b-aa59-21ecec42731b", "comment": "Malware payload (RedLineStealer)", "value": "55902ffca5b489a5fe7ba94a6f86db70b4de07cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697375417, "uuid": "f4e3c83c-5c7a-40ac-818a-f8e943f2e0d1", "comment": "Malware payload (RedLineStealer)", "value": "4307d542a1c80f5516ad4fd74db458a6f250062c0d8cb6d6f6687f3aeb02f5db7ece4f52a4dbef2d0b75eaeb205738d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375417, "uuid": "2f30a17c-9d32-44fa-b60e-45c73426a9d2", "value": "T1FBF41263EAE0E032DDB217B294F602C31B367DE44D78C36B2694A86E1C73A519572337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375417, "uuid": "34b7ab8e-3b40-4927-b746-531cf58b9427", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375417, "uuid": "797916c6-754c-42e5-9ce7-08bda73d375a", "value": "12288:0MrZy90ybyrCQDIeqtmA2dN2PTGXvkXVpNrtmLTg+buEjvew3asQHtF201Rk:9yliDIXswTGXvkX7H8yall701i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697375417, "uuid": "f034117e-5f9a-4735-9ef6-f8cd8fbcf968", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697375417, "uuid": "ed5f4f59-733a-464a-afc2-f3d698f47373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697375417, "uuid": "3ceddf78-abc0-4bab-b557-4bc35d83c887", "value": "a33447d58731fd61f43887586da0df5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818e354b-6b37-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697359663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359663, "uuid": "50f92ea1-bc7c-4726-817f-517930fb7d08", "comment": "Malware payload (RedLineStealer)", "value": "ad1af3867b32354ed9ec0c9028dd7dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359663, "uuid": "518a9658-5ea2-4447-9ac5-60754b8f140c", "comment": "Malware payload (RedLineStealer)", "value": "ecb88775757282aa27566caba098f53a43bca0f9a49c1f798d7a22e910510bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359663, "uuid": "f197530f-d1fb-4628-8e28-26b93c1ebd6c", "comment": "Malware payload (RedLineStealer)", "value": "7b9534c3dbf9c209df34170b333f21370a4ecaa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697359663, "uuid": "f1beb784-a6a5-4641-8cf4-a88646e97817", "comment": "Malware payload (RedLineStealer)", "value": "6c86131bbfa8364fb852da09d877459539dfbe381152df07882ac18042e04f723138c29af88d456894c7fa03b3bff434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359663, "uuid": "1a1ef50a-ed26-4014-bacd-66ade51c0c78", "value": "T1FE152341B7D89132F9F66FB02CF602931A367CA1AD7083AB36455A1E5CB37C4953236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359663, "uuid": "56850a97-70af-4fbc-b37b-3cf3d1d20395", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359663, "uuid": "11fedeff-9f8f-4d7c-a09d-d8b211fb7486", "value": "24576:SyWVjWaUpahx8QidRpabsQzPNc5t//cg:5WVjWaUkaQidRTiNcb//c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697359663, "uuid": "52582eaf-0f1c-429a-b024-bdf2047fbd0f", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697359663, "uuid": "f84a6c5f-3774-4c34-972e-c951564b918a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697359663, "uuid": "7cc25a84-2ad0-472a-ba57-4a1f57c508c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0e0730-6af3-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697330579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697330579, "uuid": "02f8a32f-e4d3-4e35-847b-96e36c2ee82e", "comment": "Malware payload (Amadey)", "value": "654fb3e0e40ba59b5efd8e2cf8cffbf1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697330579, "uuid": "294e94ac-3029-4d2c-872f-1a2c3b610159", "comment": "Malware payload (Amadey)", "value": "ed85383070a7d0811bea2aadc85bd086a55da944baccfe1a485e9704d3c3544d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697330579, "uuid": "4ae13e11-7c90-4825-93b0-8e4826ea2d91", "comment": "Malware payload (Amadey)", "value": "cae47170637cc2813608f5b80eae9e24f3e94e8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697330579, "uuid": "168d8d5f-0847-4f5b-99c6-ddc0df8a94f9", "comment": "Malware payload (Amadey)", "value": "9b5a8a148585c1f1c4be53d7aed5eca0c87c3ff54e91de8aeba350e72a4dc462bc3762b52a7df722074d4664d8c2746d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697330579, "uuid": "65d6a9f2-2a9a-42b8-87eb-05bdac842886", "value": "T1C2152256B6E89073EEB813F06CF503970B367D6288744A2B6B51ED5D1EB1580A83273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697330579, "uuid": "e5620b83-8527-4ac3-9704-af41ea8d8d26", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697330579, "uuid": "1574da89-910d-4053-9d9e-fb22731e43c5", "value": "12288:LMrLy90i0k5p/j9o0O8mBqK+Fq6A/FzAaOCSxM6X2Ja1fNaGDdJ20+ktoIlLqy3+:Qy3dTtWz8EFztmaqi0+ktoIlT3NwsPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697330579, "uuid": "0885dd49-7180-4253-81f2-6d245935842a", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697330579, "uuid": "6a37a942-bef4-4ae5-b1ab-b9ae9e697129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697330579, "uuid": "f41c1e0f-f3af-4992-b556-899779913fef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a04f37f-6b75-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386333, "uuid": "6c7643b7-c168-4ce0-acff-54e6d9ee715a", "comment": "Malware payload", "value": "cae0bb39b1f0ea02217d3a938b56c2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386333, "uuid": "ba73a564-8dbe-4557-9680-2450b03e4430", "comment": "Malware payload", "value": "ee122c6e78855e55d7ecab5981dec96185006eb121c3ab39d93e5845ebb3910f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386333, "uuid": "29431148-f779-41d7-a6c0-df8445a6a261", "comment": "Malware payload", "value": "d8830879c21f06d35054df1ded116b188ef630e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386333, "uuid": "04f49fc8-184a-4fbe-a542-5687f9f948d0", "comment": "Malware payload", "value": "c4f5d60eaa6ee864bdaecda8cdd475652ad240307314ca3e5714a04ff7483aad0d89e2bb4d4f2efb5830e02bc3900685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386333, "uuid": "cd062038-eedd-4d55-a523-f9ef140cb0ac", "value": "T1C1724B8CA76719CBE056833885B34B51D5F8BA132333A79F53E0C52D2EB1590AC36FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386333, "uuid": "c065247b-a9f3-4df2-91b4-140656532993", "value": "dd7706099232fddc4b2bd01109553eb6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386333, "uuid": "24f10320-073b-4dab-9031-0fe3a393074c", "value": "192:dUfcKr+kAUtQYkNwEBWevhvzCoLHt8WQKgr81eThEqcNG6cO5tfwp75:dookAhYkNqMhWkKRT+d3c/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386333, "uuid": "5a796264-92d3-44d6-be13-ce3d1b1f1509", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386333, "uuid": "df91e484-e910-4dae-843a-d974aefc7d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386333, "uuid": "cadd6754-9246-4df1-a172-b3840b2180a0", "value": "2f167aa5c392258cbbe81183339c1fdad7ef4e5d72efab1c21eb1f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1238f4-6b8a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697395220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395220, "uuid": "a0838dc8-84a3-40e9-94c6-57ac16ff6310", "comment": "Malware payload (Amadey)", "value": "ab5076bcfd24d627a573151b670eb1d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395220, "uuid": "256669f5-b1aa-4f73-a64c-3c8dad6e7d43", "comment": "Malware payload (Amadey)", "value": "ee5698f8fe2cc025827365a9c83d79020d9ef8f9889740585801396199443815", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395220, "uuid": "ce4dfea2-1008-48a8-8ee9-8dda4490d3ff", "comment": "Malware payload (Amadey)", "value": "e75ea91f55c0cca0548d8b61653d86c18824d392", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697395220, "uuid": "98cb3647-50c7-4526-8960-33d5edf2b6de", "comment": "Malware payload (Amadey)", "value": "ed0ede8904e85cbfeff461e87e6894e117ae78a5439075ebbe45e6c6ffe35b8eeddc9beb9cb57a29b1657b570aded4b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395220, "uuid": "e6cd3b9c-d4f5-40ca-a444-c683310c13a6", "value": "T1F9F41342BBE84877D4F417B05CF607830F32BC629D7082672B86A94E2DB3690B57176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395220, "uuid": "f57ecb2b-d5d3-43bd-9cb8-4c23abf7104a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395220, "uuid": "652f1c65-22d8-4cf4-86ff-3e0b823a0e97", "value": "12288:SMrBy90NdaQL2WFy4hTbJKbLIbSjj+umCAmg3neZVoNLPvBxPZ85VBY5x:TyuD5c4hRKbLIqmC63eM1vPZGu5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697395220, "uuid": "90c0d97a-c171-4f46-82da-0424d5200e93", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697395220, "uuid": "e148595c-f93b-4eaa-8bc0-6b8f2d4565cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697395220, "uuid": "865e9025-4e3f-44f5-b20f-260c44d5b040", "value": "ab5076bcfd24d627a573151b670eb1d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772e20c3-6ba1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697405172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405172, "uuid": "2c888971-5a72-46d4-ad4d-96d35f7ad904", "comment": "Malware payload", "value": "1127918eafab58e3a67584ca184385d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405172, "uuid": "f09956f6-451c-4c4d-9c02-fe65f76c2f71", "comment": "Malware payload", "value": "eed0a2cd8d9a34873658e5bf88cbdd42ce0fff95c99344dc2ec688c5f279457f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405172, "uuid": "e90c9edc-9960-461d-b352-4bc0d1fb0f46", "comment": "Malware payload", "value": "25dbe3eaaae0e8b08054a543629c51f36bc52396", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697405172, "uuid": "746968f8-6c67-48db-96a9-e879c50c930a", "comment": "Malware payload", "value": "0dbc95bf40ea581d1c46fe55eaf241264bb65b66a3c611141c4bc408760d7ec4127e7a1fe59c60a2df762da4afc96969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405172, "uuid": "cfc08037-0e0f-4e01-b7fe-6b8c0e6c40d6", "value": "T18B25234197E885A1E4F427700DFB43C32A34BEC18DB5C75B6B54690E2CB36C0A9B67B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405172, "uuid": "11f65271-2f1f-4557-a032-57dfc29e0357", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405172, "uuid": "19482d68-b3f4-44b2-8d22-4d18f36d8c60", "value": "12288:mMrDy90DDDgoXAt3wABxxK2iMg1lxfAQE7Sr3/DhuVhymAfy8E0d4sFhbdFBFl6i:tyeQdwBMuucMVDAnHJXb33OpMlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697405172, "uuid": "c558c4be-52a3-4d85-ad40-3717202d51cd", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697405172, "uuid": "ec5f8978-68a3-4ead-a7f7-79f76a2ced49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697405172, "uuid": "7fe76392-1d9c-43f4-97bd-50be3707dd19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b5bdb4-6b82-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697391933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391933, "uuid": "80b282ef-2351-4c77-b4fb-e2e61eb83f97", "comment": "Malware payload (RedLineStealer)", "value": "aa172e16d6644cfbefa1311a1f521edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391933, "uuid": "27ba42e4-4a3c-43b4-9210-b9a6051ab4fa", "comment": "Malware payload (RedLineStealer)", "value": "eff2206213e940dfd2a870d50307649a3c9b9b38b15d8510ab6eb6063bbbaa57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391933, "uuid": "6ed23ade-82fd-470d-8669-6e8b05cfb4b6", "comment": "Malware payload (RedLineStealer)", "value": "0695a430bf8eb7d03fc0e4d9c6f426d9da168c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697391933, "uuid": "60488095-62bd-4f70-a559-f9bc19fa29b8", "comment": "Malware payload (RedLineStealer)", "value": "33edca2b889c056592bc7cfcee73ae177413ade21581c18d820a600cbc29008891c7602f83c8821169ce74bcace830d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391933, "uuid": "68772561-63ad-4ed4-b89a-e5e146103c67", "value": "T1E1252313A7E80133DDB967B018F747D70E35BCE14D75823A6748A91A9C73AD4A83272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391933, "uuid": "89a41ac9-d9e8-4949-904c-c520219c0c7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391933, "uuid": "0a863003-7891-4dca-ac0d-963f387c5751", "value": "24576:eyd8om+LxcCWMTTIQYlR9az/WwOBbVF/Ysu8ZpbiH2:td8yLxckCSWwOBbnXZpbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697391933, "uuid": "ca45e085-0ea9-42eb-a458-65e759fd78c1", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697391933, "uuid": "735624a1-d2e8-472d-841a-b8ff1a8997d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697391933, "uuid": "686d6871-cac5-43a1-af09-3e2207c195c4", "value": "aa172e16d6644cfbefa1311a1f521edc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265f3c4e-6b87-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697393870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393870, "uuid": "d645ccb5-5066-4a55-b2c7-46fbf530e8a0", "comment": "Malware payload", "value": "453ab02bff77c89625c7ef4c64762b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393870, "uuid": "a554235f-fa74-4930-9236-95f273c8a09c", "comment": "Malware payload", "value": "f05e028c0fe4ab4cc7335ee4e99c67ae0414b61aa4bdfe73895d2cc994f58113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393870, "uuid": "39b9c92a-5874-4d72-b973-42930bb0f92d", "comment": "Malware payload", "value": "a2b2c509b7c1e68e0c59c85ce1f4b9e5f1810796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697393870, "uuid": "aad04c5e-40a6-4110-bce5-c4a6ebfc6a4d", "comment": "Malware payload", "value": "77d4a1b2afe10afed9ba66bd189225c1dcc425f0029fa80082f1487d7bd809ff0ab9ad094dd1b966434b6e88595b3db5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393870, "uuid": "37d3113a-b447-40e0-b77e-60178c9aa797", "value": "T1EA25231376DC84B2F5B653740CF607831B79BC92AE74027B7B82591A2CB35C6A07276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393870, "uuid": "cee0362b-cf5e-4827-9007-ac0b77840332", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393870, "uuid": "62ba9d83-39fd-4c22-a69f-33aa6bae42c3", "value": "24576:lyfosTdUZMnVnJ2B/6qcqcaPh+jjKWI7O1pzWi:AfJTBRJ2B/6q6urQpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697393870, "uuid": "c6d0fcfc-0839-4178-971a-b171793d006b", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697393870, "uuid": "2d080d83-4465-455b-991f-832c8f6da88b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697393870, "uuid": "f008e953-3b73-4a5c-9d75-87e88a893915", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2840c724-6b6a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697381418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697381418, "uuid": "517b8319-da5c-4308-882d-a634d3f97d85", "comment": "Malware payload (Amadey)", "value": "dbc20b3308015d9595988cd92e5ba068", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697381418, "uuid": "4bc909ef-6c67-4039-b951-c7d507f1af9c", "comment": "Malware payload (Amadey)", "value": "f0bdf776607582da4976e6c3724646bfeb7743f308a054a3d4903f3c66665533", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697381418, "uuid": "caaa1b55-84a3-4ff6-b88b-c1fd42736338", "comment": "Malware payload (Amadey)", "value": "0e0bba82dc667ea53ea4e9b7ccc52ad5fb334c8d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697381418, "uuid": "e07b8548-1b5a-44d0-bd66-0a5f70621dcb", "comment": "Malware payload (Amadey)", "value": "1ccf9f1b7b8fdb1ff6b95f2451f406b4a6be5fcef6c501bc832652f7782db26f622a0bad233d66dc96cbf37f5c51d6b6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697381418, "uuid": "d2ca3050-b74e-4b22-a417-31d9b4dfda02", "value": "T1E91523529BD8943AD8B53B7094F705831B71FCA22C7C860B3B86C95B4CB26D4A572B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697381418, "uuid": "ad76a853-4796-43dc-952e-3db545206794", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697381418, "uuid": "78ca124e-63f2-437d-a064-32db31d446f2", "value": "24576:myLLP6sV3ji94yCLBTy02UxembqUaaY/y:1LbVzo4yCVTyRUxembNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697381418, "uuid": "f848cb58-4c51-4951-97b7-66540c6070c2", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697381418, "uuid": "748a2d06-2895-4e1d-86ba-296db7bb844e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697381418, "uuid": "d841f133-299e-4fe8-83fd-789003b482c8", "value": "dbc20b3308015d9595988cd92e5ba068.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f6d453-6b50-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697370467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370467, "uuid": "32a34e1b-143a-41ca-9346-565b612d954e", "comment": "Malware payload (RedLineStealer)", "value": "c0daab7f86585f0039077e089966973c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370467, "uuid": "fc0fdec0-e5a1-4f00-807f-3b7c24fa5b01", "comment": "Malware payload (RedLineStealer)", "value": "f13ecc16aa2ef2e930aef1ffff0e110058c33f54946a702ff92a758ab2904e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370467, "uuid": "ee8e32d7-a355-4aa8-a51f-4dab5e9b7314", "comment": "Malware payload (RedLineStealer)", "value": "0ff08e095c83589c7194dd2d2ed5f998ed4abd38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697370467, "uuid": "2574bd68-23b4-4c36-accf-25220a0e1fd1", "comment": "Malware payload (RedLineStealer)", "value": "7b5b836c8384ec6f3d60d73a35c048506430548d387a80cfb1a756727c6fd348f1362b98940413c85b1b17603c9c9db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370467, "uuid": "d27d7829-696a-42b8-a71c-9e78d2f2457e", "value": "T1321523129ADC61B3D8F15B71ACF643C70B36FDD20A78422B5784E9190DB29C9B4317BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370467, "uuid": "91bc022d-9446-452f-b3bc-5969160d860c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370467, "uuid": "b3c69c83-cd30-4c32-936a-ed181ed27998", "value": "24576:CyvS19Tcbv/UEwRsbnzHtpkOckQtH7me/8rdmwD:pOOLZwRsbzHbk/hhKi8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697370467, "uuid": "8a082c74-1dbd-4902-ab54-043ec0afa182", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697370467, "uuid": "2aff66b2-7679-4211-9266-84fd4f46dcfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697370467, "uuid": "f15c73e5-8223-4718-b0ca-4e71ca42d9a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb78e96a-6bac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697410038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410038, "uuid": "83fef81f-eb53-45a0-85ea-06225769f87e", "comment": "Malware payload (Mirai)", "value": "67ea62236d209e0d9b63958286e44f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410038, "uuid": "61b2ad00-ec9f-40ca-8e7e-781114c7a71a", "comment": "Malware payload (Mirai)", "value": "f1a231d0a0fb9db3563bdacbb65dfec1acc1c1e52cecf14930890c2820cf5abe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410038, "uuid": "4c8e6a37-07a9-4138-bbca-57275b56363b", "comment": "Malware payload (Mirai)", "value": "c073c2791c45e6ede4798868563f6002e6f593a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697410038, "uuid": "8a6c3b52-be01-4464-b9f4-851d375ac581", "comment": "Malware payload (Mirai)", "value": "517d8a23f7f07d31f84009e1b0a5481d56ad513a44fa0cb7d47d733ba47e1efa9b8a2acfeff44185fe03a4af3bf3f515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410038, "uuid": "51c0108c-9e22-470e-92a3-e8f3b420453f", "value": "T1C4432921B53A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410038, "uuid": "9552f6ed-4d84-4ad9-bf80-cbb5419688d8", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw5:RqtmZPuutfbltZFBSJsBcfDSTFI+BE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697410038, "uuid": "c8c39cbe-8325-43f7-9243-1648128892be", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697410038, "uuid": "dde3414a-93e6-4291-8a80-00659378f5b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697410038, "uuid": "ea69f47a-e5d6-4565-8192-24a8bdde7465", "value": "67ea62236d209e0d9b63958286e44f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5080cbb-6b28-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697353361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353361, "uuid": "a0c00837-6441-4e94-bea9-5870f07eb58f", "comment": "Malware payload (Gafgyt)", "value": "4b03e0b7ecc037526136c9f99b84d5b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353361, "uuid": "f1ba9d7a-4c37-4771-a1c8-b027de47f7a5", "comment": "Malware payload (Gafgyt)", "value": "f2262a95203cf7d2381c7ba9156f449bc2f351988f0126427bb4fe361f9bc093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353361, "uuid": "3ddfa1c7-0c5b-449c-a9b5-f987ea287543", "comment": "Malware payload (Gafgyt)", "value": "b2aa27eccd484cb03e98da975b214b07969d6cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697353361, "uuid": "35cd874d-03fc-41e6-a95c-0c8ac1535ae2", "comment": "Malware payload (Gafgyt)", "value": "40d2ef1fd837395cc170f1d81575053a5dd41b9a84e3fa9c9b309ab114bf4b257b23cbbe7f5379511ca5d8dd3fa417d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353361, "uuid": "1bef5090-515b-4857-ad56-818e6e6bd234", "value": "T1FEE33905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353361, "uuid": "08924e10-0a68-460a-986a-8a905092f037", "value": "3072:ut8iFDKEfFN+Fa+1sWFh7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaN0h7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697353361, "uuid": "54a81f48-482c-4f90-8e18-aca7afc7d9fd", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697353361, "uuid": "91861df4-b0c3-4dcc-a972-ce9eeb6d3dfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697353361, "uuid": "24e7cc77-db63-412e-971e-36a6565791a6", "value": "4b03e0b7ecc037526136c9f99b84d5b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ef0da6-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367138, "uuid": "a254fa2b-f5aa-4cbd-9af5-d971ef848ecd", "comment": "Malware payload (Mirai)", "value": "919bbdce410dd32cf2d77f40a8f2f468", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367138, "uuid": "a96a0435-0fb7-4289-b4af-1e6c61bf070f", "comment": "Malware payload (Mirai)", "value": "f2833f0042f4014bde8893ad8bbf3e7fb428283a48c9bd6fb8a8bbd4d99f725f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367138, "uuid": "4e243576-afd0-44a1-995d-1a72e7098671", "comment": "Malware payload (Mirai)", "value": "9f03b7d33c721e2a9a354d05e10f4c2fdf2bd032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367138, "uuid": "cbee160b-1161-4dcd-8ec8-99bd44757fcb", "comment": "Malware payload (Mirai)", "value": "578a359394cd0fd7a365ad7eade060e56525fc481f367929ac573b01eda3fd652787bfb29b132f98c879da7f9a7bb37b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367138, "uuid": "45d85eb2-4c63-479a-bc0a-fcf3ab8c438a", "value": "T1A0A2D031472A7694CB701C79D46E4E85B3511BF1FBF138B75614B32E3AC2E5128E8257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367138, "uuid": "d0a2c35d-4948-47dd-a492-1cd5157b4bbd", "value": "384:53HTK4baXdapZsH68dD+fMm+JIWi4UZGmv6O7cGqMqXh7qmdGUEpiaV:tHT4NacHL+IIWi4G/k9q3UELV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367138, "uuid": "ad4fad5e-278b-4ce4-b420-31f87ea94d6f", "value": 21972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367138, "uuid": "ff3ab869-a901-433c-9349-9552fa4d02dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367138, "uuid": "075159f3-a65e-4f51-8714-53e12e7b2810", "value": "919bbdce410dd32cf2d77f40a8f2f468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bf32af-6b55-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697372716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372716, "uuid": "3539a16f-0e42-488e-b591-4c74d0ebda49", "comment": "Malware payload (RedLineStealer)", "value": "a1d4ec96ae267cb7d21d2ea96fdb5d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372716, "uuid": "3a4fb76f-f688-4769-b817-a577f3a4c9d6", "comment": "Malware payload (RedLineStealer)", "value": "f38fd8ac7aad70ba7424385d67daf5d0cf0c395c7412827c03c76c1833c9d6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372716, "uuid": "5285198c-fcf0-4268-8565-0f2e1a9f3d7e", "comment": "Malware payload (RedLineStealer)", "value": "de0679fc2da8afba646299ed6aade3241b5373f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697372716, "uuid": "89571332-06af-42ee-a828-a58449234e47", "comment": "Malware payload (RedLineStealer)", "value": "b7056aa742fb916ec5f4617495708a3a194bbefa106681e9a9ce5ec3e70905659a2f6cd70e89b3b0ff420639ed9ce935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372716, "uuid": "cb48c915-75b2-464a-ab62-980de4a572a2", "value": "T16DF41262D2ED9072E8B5177028F703831F367DE09E68466B3B85A80E0D736D4A574B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372716, "uuid": "0cee4670-8a47-43ce-9705-656da116d0ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372716, "uuid": "d47f540f-5531-4f05-ac03-664c3d1ad7bd", "value": "12288:7Mrty904+l5BBA3wDVRk73gyrtJzToCLRSHQoRUvCcrS6hUVgns56Q0gVO0GjU:Ky85BawDIbgy/zToCLRQRUvLrMVn5ygZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697372716, "uuid": "9f9c236a-5c78-4e76-8aed-04e5508021cb", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697372716, "uuid": "189d505a-af11-48d5-8718-078689e07557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697372716, "uuid": "2edf60ef-5127-4b54-a8fe-c974e64efa1d", "value": "a1d4ec96ae267cb7d21d2ea96fdb5d83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7739ffe-6b43-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697364881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364881, "uuid": "240b6380-473e-4d97-9d61-b26bee61c371", "comment": "Malware payload (RedLineStealer)", "value": "da3c3e99a004146e53004d1a16e58624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364881, "uuid": "a47d33d1-01ad-4934-b95e-167aabd236f0", "comment": "Malware payload (RedLineStealer)", "value": "f4d3994e6c3b556a1b4a34c7f4d467cd15b84d3a30e917ebff987e7b6f4bf61a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364881, "uuid": "1c92731e-e143-47aa-bd9c-af87731ec8a2", "comment": "Malware payload (RedLineStealer)", "value": "da9faa4bf0c13d6339525576fcdc6b8dabd344d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364881, "uuid": "69e12114-84c4-47a0-9ced-bd30f660e58e", "comment": "Malware payload (RedLineStealer)", "value": "9bc50e3f2c49223e8d7250a4b7026a102303962659169826c69211a20339c4780765892016c8e7c0d342b6e28002efcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364881, "uuid": "0abb9874-3e1a-40d0-9f46-b9db9e49d42d", "value": "T179152303CFE594B7D8F563B068F726D31E377CA16E78825A27041A690CA3680AC76B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364881, "uuid": "5dfd01f3-d5f5-4016-9f41-66987a9ea130", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364881, "uuid": "d8b18f0d-9080-4ee1-a2e6-5e18cedc71b3", "value": "24576:IyNK4n6dEavwSIpQIzSQPQpBRgs1ejSrMVeY:PNKY6KaYSIpnzbNjM3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697364881, "uuid": "56195f9d-c678-437c-a2d7-050b6cf7c03d", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697364881, "uuid": "ac122194-b4c6-4db4-a91b-8b44365dad34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364881, "uuid": "68ca0171-a2a1-4352-9301-dfa82431874e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d5ae78-6b98-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697401521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401521, "uuid": "d42b2865-b279-4bfe-ad62-8dbc11b75a3e", "comment": "Malware payload (RedLineStealer)", "value": "2f10c7ee102dde69f12b8282de4007e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401521, "uuid": "6c3e4cc7-3659-4a0f-85d5-ed28bf835a8b", "comment": "Malware payload (RedLineStealer)", "value": "f6ecf026ba3bfb6c5221d65a255a5bd2cc0dc8a8d7373a0dcaef5499ee6b534a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401521, "uuid": "e15713b4-e736-4fa1-94c2-dfcfaa72d08f", "comment": "Malware payload (RedLineStealer)", "value": "423dc28e38014d7df6596ba1602b792aa2cb269b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697401521, "uuid": "924545cc-c073-45f3-b6c7-0fa7d26c0f89", "comment": "Malware payload (RedLineStealer)", "value": "a26081b2d542032a1e66de9603dd67450cf7f2178237184c10861df1efce2736d1fd137c0d90d6a6fb9227c7742184f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401521, "uuid": "33e4dc39-2a95-41f1-878e-318aea1b139f", "value": "T1EF4523639AE65026D9F21BB528F703830F353D6258B4477F2649AA8B5D337A0E538733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401521, "uuid": "4093440f-3794-4895-a516-c4fdc4bb84b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401521, "uuid": "5f8e55a9-1965-4af0-a38b-edbf281d67d9", "value": "24576:9yqWaZrcguMxxkszciBVaSAGw2YD1F1xeZOCVBPPcu:YXaOguMHkEcAVdZOsr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697401521, "uuid": "cf0cf32d-8cb4-4dfd-bc7b-738f41f7209a", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697401521, "uuid": "d9db4d58-b7d5-41a5-9c7f-54e20c0dd30f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697401521, "uuid": "0840304c-1ff2-43cd-b53e-96b34a0ddfcb", "value": "2f10c7ee102dde69f12b8282de4007e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513231ec-6ba8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697408115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408115, "uuid": "a007211c-078e-4beb-9c38-97033cc62bd4", "comment": "Malware payload (Smoke Loader)", "value": "3fb8d2afa98e57a80a55a50e034b99ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408115, "uuid": "834cc520-efbb-4a2d-b42a-e12cc700e8f0", "comment": "Malware payload (Smoke Loader)", "value": "f837ab360eb5e0fd1297d14760bc6f8293da24b0de08ef0863fd76c63bce92ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408115, "uuid": "20d966f0-7b29-48c1-95e7-bfacf2babee8", "comment": "Malware payload (Smoke Loader)", "value": "a0087b9dd00dc6c6d0311e1ec838968e00d3078c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408115, "uuid": "d983f23f-8298-4d1a-8b70-3f8af71c8b34", "comment": "Malware payload (Smoke Loader)", "value": "e0c23d6b33142bb715537e45cde6ab2d593e05cbdfe8411eda09b62c21246145d81b5ebc509702e4ce53997394814fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408115, "uuid": "8c30b59b-cdd9-4572-8916-e3fe6691cdd9", "value": "T152252353FBE894A3EDB117B058F242831A39BDD16E74826B77E8680508739D1F93173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408115, "uuid": "5f47e28c-8616-44ee-98b4-bd40d4ca75c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408115, "uuid": "8a3915e3-171b-4780-9253-1c421850b08f", "value": "12288:yMrJy90Oj14sIDBnc4T6o0f2B3ZGf6KfcM5buOhyYT+a98poJY8EhAcF6ktV:Ly+c4o298gOPiaAoJY8EhAcYEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697408115, "uuid": "3284d57b-9fde-49cb-9dcf-9ee925f2a7f0", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697408115, "uuid": "365689c0-9e6c-4c92-bcb0-0eec13dd1f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408115, "uuid": "12c4290c-3f08-4a1f-9de3-c526cb707182", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbfef72-6b43-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697364915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364915, "uuid": "94af0267-983b-4faa-af6f-4e991f3f5804", "comment": "Malware payload (Amadey)", "value": "1dd4a0adf955519b2d637c98dda066e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364915, "uuid": "93793bba-41fd-41b0-872c-e7ae1257b632", "comment": "Malware payload (Amadey)", "value": "f8f15a43caa4a592b4aff56180f0f2569b58197b7a38b132500da2bc65dc08bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364915, "uuid": "7e80396d-f4e6-4793-b345-9a7f9f596d36", "comment": "Malware payload (Amadey)", "value": "cdea2ab435f378c99f878a788f3bbcae0016dc0a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697364915, "uuid": "fa260073-3472-4d85-8cc3-8ae5a9e93502", "comment": "Malware payload (Amadey)", "value": "bc7fe18a8a6525a2f021d44bdc4a7c8745733229441f04eda843f248de5088f44a8e09a5db9ab60fd028cf65a8fbbc97", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364915, "uuid": "e62c47ec-a0ed-41cd-9d18-8ae3008fd7f5", "value": "T139151243BBE88472E5B90FB41CF702C70A39BCA1193582AB3B45995B6C73780A935777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364915, "uuid": "00449e88-af08-4b26-97c8-849270c3cb3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364915, "uuid": "249326ea-7bb5-4034-a58b-6f498cb7b807", "value": "12288:xMrBy90LGg7PGPS5Hl66o3ABrWaU5SB4xWljBR3IbLCO7onE6SlVicXs4nYHv5NO:wyCIyj5PU+umj2p7oUlVim3nYHPxtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697364915, "uuid": "c9d7160f-07bc-4d51-8cf7-45d8d2a9e002", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697364915, "uuid": "722d3ebf-c14e-42e7-bed1-edcb0d2bb21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697364915, "uuid": "088848c3-7587-4889-8e7b-16b673934db8", "value": "1dd4a0adf955519b2d637c98dda066e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7d7521-6b9d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697403436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403436, "uuid": "d94f6302-4b64-4865-aa4c-fa7b3cf1ee49", "comment": "Malware payload (RedLineStealer)", "value": "7cf7dc6ed1612a58f8c9d279500274ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403436, "uuid": "01213079-aa33-4664-8b45-2e6c3ee7407a", "comment": "Malware payload (RedLineStealer)", "value": "f93196ed4057b70010fc2b09a8580ce115cb58f1e777ac88f74dec4707f52225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403436, "uuid": "0324f4d5-20af-493d-9679-092cd2219c72", "comment": "Malware payload (RedLineStealer)", "value": "4391f44eb385690fc4813cbc1d98d89d911d7023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697403436, "uuid": "fcbdd624-dc7c-4b90-b70e-2f0899247369", "comment": "Malware payload (RedLineStealer)", "value": "92b6df4d2da2ea7d25c256bc826ff6a20eb28f1728cd6da5e86c54e54dd1fa7ed3af9aab0d30deeedfc52a9913d80b17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403436, "uuid": "aec219a3-65ee-4ed4-84bd-f9dde2b4469b", "value": "T191252207E7DA40B3F8B61BB048F902930D35BE206DF5865F2B62588B4C72795687A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403436, "uuid": "e0668c37-396f-4e49-aa00-e7550fba3cfa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403436, "uuid": "fb805fce-aee1-48e1-b2f8-74644494546d", "value": "24576:KyElDVagTn2DgX4RRcITsTcN1yNhxIAndELn:ReDnQRRXTsY16xIAn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697403436, "uuid": "2cffe2ab-77a8-4c02-bff7-2814acd45b42", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697403436, "uuid": "6bcb356a-2b46-4c77-9697-c0e216fe03bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697403436, "uuid": "7e404076-54e1-4b6b-993e-fdc99452d292", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed3da53-6b76-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697386636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386636, "uuid": "d5ae753a-84eb-4511-943d-a686a1968f33", "comment": "Malware payload", "value": "8b7206461bbb4915ba048be77cb59da3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386636, "uuid": "2c0fa5fc-6926-4116-83a9-b9633bd40204", "comment": "Malware payload", "value": "fa2b1cb4f93907c4649391505ba431f05788aa936a7753709ee86e0bc05667bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386636, "uuid": "9ec9505a-eae3-4244-9978-80d4edeb8f7b", "comment": "Malware payload", "value": "ebc51e095a86e20eaf66ea544b216aec57ac302b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697386636, "uuid": "e0bb5eed-023d-4bdf-874b-1c671c4c6daf", "comment": "Malware payload", "value": "b9473d26b1735fa9204a0909d5d0834e09d170caa529fa63aac7c05ea3f6c85949ce9cdcce70a3da76413e7c5a741b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386636, "uuid": "1c6ac69f-7223-4f73-9f59-bc4d7f52e855", "value": "T1FC15236397D454A1EDB06BB048F707C3163ABD558CB0877722D5A8AF4C71788E632B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386636, "uuid": "634aa80f-2ce0-4aea-954a-6fe13fed7368", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386636, "uuid": "e0fe1092-2ac5-401b-9b76-2e5da7bb457a", "value": "24576:7ysd8o7WA6CYUjJFEmsbtAZ5bnHQLMY4tXYMblhU4g:u5XIozbsbnoMY2YMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697386636, "uuid": "d84a6374-1e1a-468e-b5a4-c54e6d6e830c", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697386636, "uuid": "6b633c48-33df-423f-bdfa-d17cc5959465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697386636, "uuid": "0cb7a256-c56a-4dde-ba03-1d68a432a9be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f363940d-6b0d-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697341815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341815, "uuid": "607163c5-5613-4873-8bc4-a36fb5b19c70", "comment": "Malware payload (Smoke Loader)", "value": "e6960393ff942ea2c75d82aa4d5de77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341815, "uuid": "329a3fa2-d9ba-4389-8efb-70b8fc003eae", "comment": "Malware payload (Smoke Loader)", "value": "fb63f267129065ef3a1c4fb394d5c67cc5180cf145e614b41d46c154f2da9ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341815, "uuid": "b5efbc65-08b1-43e4-90d4-7906eee16982", "comment": "Malware payload (Smoke Loader)", "value": "4ebb324150ce476365d80d106f3bc760cf69cb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697341815, "uuid": "2bd852ff-0dd7-4525-9247-5f4473521c7e", "comment": "Malware payload (Smoke Loader)", "value": "00f7c0435e5d154243ca9484fc9520bff80d66f265cb4c4ba1775329d2ae20403afe06f2bce223fed40e8b13254f1ec6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341815, "uuid": "e9635944-a440-4f28-82eb-b22652660183", "value": "T110151316ABD8A0B2C9F02B706CB702C70F74FC915D79931B6794A8D61C63A98643737B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341815, "uuid": "e1d16573-6069-4c10-ac39-a9ac5d8618e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341815, "uuid": "7f7a1d1a-3f29-4c19-9f94-efd289016691", "value": "12288:pMrZy90bk/SLQJfIq4wmZeCT/e6ioHLb+fGrc+CNkXZQmkFCUwu:4yo6AqY1qroHXKbNwZ8CUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697341815, "uuid": "83f90c71-8023-48dc-865d-7211cd9595b3", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697341815, "uuid": "86242f16-d502-44fa-9699-47fc59b314fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697341815, "uuid": "94014a3e-004e-4232-a50a-9e9c98529a1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad8d007-6bb3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697412883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412883, "uuid": "e0d9c9a2-c338-462d-9d55-96a1830c83b8", "comment": "Malware payload (RedLineStealer)", "value": "b909c05c408cea5149b9690baea6c6e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412883, "uuid": "ddc6f652-3a7a-49e9-b778-99db542b3a0f", "comment": "Malware payload (RedLineStealer)", "value": "fbaad5fbe2162a8c91ad9b217de1e4cb453c65962a7b6fb1f26bfb38b5b11eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412883, "uuid": "9ec9a91f-8b30-4828-bc6b-32b6fe7328fe", "comment": "Malware payload (RedLineStealer)", "value": "dfc02d93fd86871b337fbe511c8459888cd27f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697412883, "uuid": "4f67cb51-18bf-4512-8576-01aab30e9ca0", "comment": "Malware payload (RedLineStealer)", "value": "7dce7764f5306775dda5bb67c48a26d1696ed95d780fbb6654f5e6c78be4f5da656572a410f596493e9a7d3501205052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412883, "uuid": "578dafd6-cf53-457b-a785-48b46393487f", "value": "T10A2523177ADC40B2E8FC17B048B702C31B79BDF65A38566B3295991928736C8B4373A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412883, "uuid": "ea14a115-f09c-41a2-8595-34146c042cda", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412883, "uuid": "d2af9467-4ac8-4e87-aada-161b462206ff", "value": "24576:Yyrh7b6aLPW8pfQLB9pVwdeEPIVQCdcbjf05VhlN5/iW9mr:fNDL5yB9paUQocbEVd5Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697412883, "uuid": "fa4e5cc2-6430-457e-92ef-3a2264a68bd0", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697412883, "uuid": "af9ad710-07d2-4af3-8b6a-837268aa3088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697412883, "uuid": "299f8f5b-1d83-4057-a842-d64b8edc1add", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca37115-6b48-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697367171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367171, "uuid": "989930cf-819c-4b76-b805-96f53e7f2a56", "comment": "Malware payload (Mirai)", "value": "323a65b87f76a0e70b6077668555e77e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367171, "uuid": "18760e5b-4eb2-4284-8e08-d8f8942be63a", "comment": "Malware payload (Mirai)", "value": "fdca2d4f0952b5b542119f48da94336f8bd640bb8c0bff1c6482c204c03be842", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367171, "uuid": "4aee3a5c-7396-4c76-a615-fdbb8294d18d", "comment": "Malware payload (Mirai)", "value": "d13b294566aa345b6e39b2cf6e7f37a678295b61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697367171, "uuid": "fbf94d9b-344e-4e6f-90fa-e7ccf43f85dc", "comment": "Malware payload (Mirai)", "value": "b7c2cd4835374b0d461f9eb8dea6c0231b7cfb36cb0a4bfe7c6276716439d0b90081c6477a8bb44f0a9c05c3e00b3021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367171, "uuid": "f1208083-d2d9-458a-a425-beeb0c149a40", "value": "T1AAD2E170C21E5DF9EEFE3D386D7ACAC43740AFB932665EA7911527430A1A81B6606CD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367171, "uuid": "a8eb370c-cce3-4a19-989b-11404ee4a671", "value": "768:wtxZ1LkNCA2mDJgNa7PpXuw+r+Fad+f4uVcqgw09N:wttLDA+NkP5uQA24u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697367171, "uuid": "c65af164-a4e5-4fd8-b908-3c7c5156007b", "value": 30668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697367171, "uuid": "08276c39-7618-4b48-9271-38bf09922c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697367171, "uuid": "4d89ea7b-f91f-4c48-a238-295ce21a26a5", "value": "323a65b87f76a0e70b6077668555e77e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff66b53c-6b24-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697351714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351714, "uuid": "5638b123-0d06-4e21-96a2-0d856fc5102d", "comment": "Malware payload (RedLineStealer)", "value": "acd04f5aaaac68a0c6c5675246998fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351714, "uuid": "72ee4266-fd3d-4988-abf1-e0367f2548a3", "comment": "Malware payload (RedLineStealer)", "value": "feb95fcd3f7b5f7c95340657c808bb5e31f6b61960b0842ff3ba6f08a1540c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351714, "uuid": "b55835c3-aaed-4903-8df6-26f496ecb084", "comment": "Malware payload (RedLineStealer)", "value": "7fb9ddecc4cecc93c28a6af4de072fe279b2be09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697351714, "uuid": "59208e8f-0c93-4c94-8930-e8009b2d4531", "comment": "Malware payload (RedLineStealer)", "value": "46042526f58f51674bfbbe43e8b7e36a934776592a7193854accf65a1cb114ca4428077eede8ea9239fe2d32fe6fad11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351714, "uuid": "b2d47e5f-df98-4ee3-b786-8cdce80c90c5", "value": "T165E39D0175C080B2D57219310AB4EEB15E7DF8740F10AEABB39D16B95F20AD09A75EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351714, "uuid": "8995b2f7-1e4c-453c-92fe-1c4eb78fa3c1", "value": "89b4938a013d6b8954f68c2ef1293c62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351714, "uuid": "cfb36b20-7425-4aba-b5ba-92bf3a92c928", "value": "3072:GWTJsU12HlWCnUewNzrQuUUpBt2973rC9imaaQKhzgHRk8idkmdfzal5g1qtMDP4:dJsICnU9Q8y3IigmcPoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697351714, "uuid": "38915701-37af-4028-b22f-10d41f0e2d5d", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697351714, "uuid": "5bb914a5-34f8-4773-8895-31a43bfe9a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697351714, "uuid": "a7e50404-b709-4ac0-97ce-5af28fa73d51", "value": "acd04f5aaaac68a0c6c5675246998fe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78412469-6ba9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697408610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408610, "uuid": "36662f8a-9ae4-4b8c-9edb-b3cc8890d937", "comment": "Malware payload (RedLineStealer)", "value": "d1c6f534ed99e48438b09d519c392d1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408610, "uuid": "fd7cdaa4-9786-4c9e-926b-7c36b6c9eb7e", "comment": "Malware payload (RedLineStealer)", "value": "febb7ca5e46576693b590dd0505fc04f6a1869e8b33710610945f41cdd748ef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408610, "uuid": "7d58b8cf-f667-4ff9-b870-3ff6a9413852", "comment": "Malware payload (RedLineStealer)", "value": "9807bd326ac0e7ec154a4a8e1ef0188bcdf29437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697408610, "uuid": "d357f454-3bb9-440a-a135-8df87dc64abe", "comment": "Malware payload (RedLineStealer)", "value": "53c56648b6f3d06602b9ac3afb9a5f3fc6bcf1efc9c4a162da8cead5201cfa7a019bc25ddd250bed2bf88885eb6c629f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408610, "uuid": "b157904e-9964-438e-8216-58ce1777aee7", "value": "T18224E637E304555DE83E433DB01C38B09E707C52E16EE32E45AA7EED683BB499A245D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408610, "uuid": "d26dd04d-a413-4b0c-ab8e-3d9cd3fa902a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408610, "uuid": "68118708-7372-4640-a1f9-a15571a26d0c", "value": "3072:3JYiCnaNgcWhx73J4ziUoGDet/q/1Bfm5CeDQ94/Q:5YPaNgcWL73W+j/QBe5Ts94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697408610, "uuid": "4d02ce9a-0168-4bb9-89db-f38addc81bdc", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697408610, "uuid": "7af0f7bd-5f48-45d7-bc2c-3df87534f893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697408610, "uuid": "9aeb130f-88bf-46c8-9960-8334f343c4d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45787b2e-6af2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697329927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329927, "uuid": "453bf7f8-bf71-42d7-8df8-cbb0f682fab5", "comment": "Malware payload (RedLineStealer)", "value": "2a18252dc867ef66e1ccb9f82b4c424b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329927, "uuid": "c9866279-f484-40ad-9b0c-61e50c656fc6", "comment": "Malware payload (RedLineStealer)", "value": "ff00055a35efe9bd6d09593ec0ada0b8dce10aa852b5d7f9c15166142841ab10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329927, "uuid": "0912c637-7129-49c7-bbdb-e6053a422b78", "comment": "Malware payload (RedLineStealer)", "value": "f980309bc6eed16561474ef2a43d88a681fa8832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697329927, "uuid": "ac0a7152-4284-4545-ad54-becb62f23556", "comment": "Malware payload (RedLineStealer)", "value": "37fe54102ec4724bd8acd965cadac38abd0f8918ce4b9aad289061a8a81db71e4f83a9c076ec0e5686c258746fc8fae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329927, "uuid": "d8614266-cae6-4f38-89f9-4adfdd320de3", "value": "T1FA152313A7E84166D5B927B04CF35783063AFD918DA0D22F67CA595F0CB26C4AA7073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329927, "uuid": "af761a4d-c6b5-4a85-9f1d-624b383afa50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329927, "uuid": "df9a76c3-2ed5-4d18-a664-c461122e7aca", "value": "12288:NMr3y90/pa9XCjh/mUGO6aUq9fW3C5rmW7zi3bcnqNYqxP7vHGcQ7Egq29qdwzuD:Kye0XEUqJokmWHi3fNY+zIQg7zgBJy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697329927, "uuid": "c5509ab6-57ba-45a6-aeed-15f69f38972b", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697329927, "uuid": "cba28237-f2e0-4a5b-bbd3-13613483d0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697329927, "uuid": "b0e87cb7-300b-47cb-8328-e7133d7a7755", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826a9668-6b5f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697376844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376844, "uuid": "11e0ff49-8b6e-4f07-9e72-ec938a7547c2", "comment": "Malware payload", "value": "3d6bff60de6de81086b14da1ddc4a08c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376844, "uuid": "99219cdb-9c8a-4e98-b865-d95d014a557f", "comment": "Malware payload", "value": "ff20574be6cccb3dfc1ab5bd0f94a0849d683f1eb83e05b2c3dea89230036ec4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376844, "uuid": "def4b3a5-e8ea-4d05-b127-f38d074c2ed7", "comment": "Malware payload", "value": "fbcc5640efbb08025b4a2eed3dd1d9079d3a37eb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697376844, "uuid": "31ffbc4b-ebca-474e-b94d-7a43714e7def", "comment": "Malware payload", "value": "200df1eb980a88c32cafccc979daf09e124cb3819a7e4c1adf4efdbd6ce903ebdecdeb5e796d4caf522e65dfe2dacecf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376844, "uuid": "83cfcde5-f236-42f2-97d4-d22cd8e7cd92", "value": "T165A3218123C7C3351185A32CA56C369B8AD6A49C43E576C5E229F8ADBFC482D36FC5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376844, "uuid": "425aa1d0-ac4f-47a2-98ef-57c92972310c", "value": "384:HVd5EVd5EVd5EVd5EVd5EVd5EVd5EVd5EVd5EVd5EVd5EVd5AVd5EVd5EVd5EVdq:Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697376844, "uuid": "c98db752-28af-446f-b5b3-787973c435b2", "value": 102209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697376844, "uuid": "72e84ba1-befb-4832-a9bd-dbd62948aaab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697376844, "uuid": "186c0d20-3322-46b2-97b7-36707c0a2c4d", "value": "3d6bff60de6de81086b14da1ddc4a08c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2898b7c6-6b9b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697402464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402464, "uuid": "7a6cc019-d5d5-4c23-b18e-b1a4c14ef4e4", "comment": "Malware payload (RedLineStealer)", "value": "5521cf8d520cfd036f021788ebb10d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402464, "uuid": "886aa932-4696-42fc-b283-48b4a6ecac75", "comment": "Malware payload (RedLineStealer)", "value": "fff09ecc7f9a716b3ccefe10d4690967c68d7f594c259e3b30a39dcdc3955fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402464, "uuid": "18316eee-b474-41a7-b793-9b7819effabc", "comment": "Malware payload (RedLineStealer)", "value": "492623bab777a097ac51e5348a2c76459e2e9740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697402464, "uuid": "8bed1623-ca89-442d-805c-f726ad02cff9", "comment": "Malware payload (RedLineStealer)", "value": "e89732f234aeadb672d4f0f1efa099850a3a1cf6ccdccc5d814e5704b6661a4fbd36e4a9186210bfda9fa1cd899a581d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402464, "uuid": "1f455eba-d2c5-46c5-b612-8c82b5f90ebb", "value": "T17A25238366D94162DCB56B7298FA03C31E317DF15D78862F63E19C9808B3B80B97573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402464, "uuid": "8ef69198-212e-4514-bb4a-e514cd80c92a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402464, "uuid": "535bdcb8-5353-4e1e-9b72-03cf1a260274", "value": "24576:hyZLoqW2PIUUVxmIdETniX2VPelBUny6RieBM:UcmUVxmjT2qPeL5Qie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697402464, "uuid": "4daa39bf-372b-4f45-9c7c-b303fa87f05e", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697402464, "uuid": "175d95b1-31d2-4684-b2ea-56221aab181c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697402464, "uuid": "d6dff746-2c67-4bed-b3fd-e15e7efab5bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }