{ "Event": { "published": true, "date": "2022-06-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-04", "timestamp": 1654387381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f98f4210-acf1-4c0a-87ad-426046e6e5ff", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017d7622-e446-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374986, "uuid": "aecbaa2a-2f5d-4aa8-90ab-213da7f9bcc3", "comment": "Malware payload (Mirai)", "value": "63bb069e4e980a658a00005a0a320d80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374986, "uuid": "525790f1-25e9-45c6-83a8-ac224f48feba", "comment": "Malware payload (Mirai)", "value": "0134e7a2026c0a19381f318097a8805b8070f2a982cedf4fb946820130be0d55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374986, "uuid": "9e8cad93-1e88-4462-880a-17a56e3da409", "comment": "Malware payload (Mirai)", "value": "9b82956b907a1e1cffa7ee653c5590c1e40dd00a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374986, "uuid": "f6931e6a-847d-4e08-8e52-ac6af6f436cc", "comment": "Malware payload (Mirai)", "value": "a28f49e1ca4ce0855086d8b5b60df8e852a28ba17f6cdca7375c5d5f070142c75f775f1ca3c18400c5b65ab0e2bc1fa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374986, "uuid": "fa34885f-5e4d-4591-82f4-1525bbed691e", "value": "T185D24BC19583DEF5EC2166F1207767929E7AE43A2A39EA67D3AD3521AC03B10D70734C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374986, "uuid": "018c11cb-e272-4531-bc0f-ff962887648d", "value": "768:nAYfjZlz4C93YDmNSMEgWRbnCa2LSzOozm:nAYLZlz4CBYDmn0OLS6ozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374986, "uuid": "5224a739-468a-4ca2-80dc-724f08a6847b", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374986, "uuid": "edb523e8-b2ef-4cdf-836d-844db912d556", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374986, "uuid": "3dc79fd7-b897-446b-b3e3-3887bcc10223", "value": "63bb069e4e980a658a00005a0a320d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a7a568-e40f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654351695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654351695, "uuid": "5fe6b6a5-3a12-4a2b-88de-dd5f9b9b5892", "comment": "Malware payload (Mirai)", "value": "b12e979da0e4949f0d9301e21ceb1fb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654351695, "uuid": "325a9992-fcf3-46d1-9493-6aeb61f70d79", "comment": "Malware payload (Mirai)", "value": "060b3181dfa885fb4c8e92deb210d9a145066c7697233187a28a9cc18a5f15a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654351695, "uuid": "3d3b0a7d-3a52-4d8a-9020-352e2de3359d", "comment": "Malware payload (Mirai)", "value": "00c56fd5630b1a6613d139aeabe2c1d253a5db52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654351695, "uuid": "983638a9-9308-42ec-9751-e466abccf339", "comment": "Malware payload (Mirai)", "value": "205ce06802ce1ae9f67c9f6f8b36ecdbe5210ee9b22e44a3461ff3f69b10c1dd86cd84c0ff3e6febf5d10aa627d4842c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654351695, "uuid": "8756d32e-90f9-4aee-97d4-e85cf8364702", "value": "T1AEA30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654351695, "uuid": "7ff004d4-1b83-466d-9094-71b13c316b41", "value": "3072:BdKLGdUvuXwyKQlU8fza6mumuxVqDr78fz1e:BdKLGdUfyKl826mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654351695, "uuid": "5ea092a9-5f78-4e2f-b56e-e29d61b3ef4f", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654351695, "uuid": "4fb3284a-bfbb-4202-8575-5037f532c7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654351695, "uuid": "bf4cf53e-e767-4e82-b436-3823d50d450c", "value": "b12e979da0e4949f0d9301e21ceb1fb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7111863a-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361859, "uuid": "3ee875db-01f2-4653-84fe-8421244d3198", "comment": "Malware payload (Mirai)", "value": "1df8248be4c017176b20019bde2c4dd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361859, "uuid": "6b9a05ba-6af2-42cc-8cee-60405047ee43", "comment": "Malware payload (Mirai)", "value": "07029bf1efc552fb6f95992cf81da6390e87d123ca067ad1799aed37df951e8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361859, "uuid": "e4f98f5c-6613-4c50-b962-22c5361b01d3", "comment": "Malware payload (Mirai)", "value": "38a791b8cbe0163242f8f3bae910e5257278f1f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361859, "uuid": "48b066b3-65d6-48f8-814a-e9089d578c5d", "comment": "Malware payload (Mirai)", "value": "0af5983c3d0a3762a555b88cf187e8923b8167cf99beab104579de81dcf7bf6764375dc377d943a998290d646f2d5bf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361859, "uuid": "cd7b7288-f705-4694-86bc-015a79baa277", "value": "T1EB92DF149269E1F1C6E0083CAE36D65A6E5F05FCC1FA302325A00C9AADE611B36B67C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361859, "uuid": "988d8a48-6e75-4195-a145-fd71213280a5", "value": "384:4+m5eO+5IouymNQ2eYc9N1yFCzGXvnRCKgBKncXirKHNiGnBSgXHhymdGUop5hK3:4+iehiy0QnYkN1BGfJAKnVrI4GBSms3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361859, "uuid": "9de9469e-d417-47a7-8136-dd59bbf70816", "value": 20420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361859, "uuid": "df17d7a6-a215-43c0-97e6-3c0b3d3f431c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361859, "uuid": "aac34062-a8dc-4863-a5cf-ff98bc1e6c3f", "value": "1df8248be4c017176b20019bde2c4dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b7f007-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352812, "uuid": "b1e95c3c-d1a7-49c0-be25-b19ff1608cac", "comment": "Malware payload (Mirai)", "value": "843272350c96a9e14358d563c2ed5903", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352812, "uuid": "bd453f87-1cd9-4c84-aa19-c5ea057ce8a5", "comment": "Malware payload (Mirai)", "value": "086b6b4921d1fc1a78a711c9a66d0053a8a86f1766b1e369cb1c8eedb25d7d03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352812, "uuid": "9aeaca12-daf2-4712-849c-7af978194bda", "comment": "Malware payload (Mirai)", "value": "c13ac25319ad940b2ec77dc2eaddb763b734834f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352812, "uuid": "8bc0d5fe-cdac-44e1-a72d-851cb7f8c4c5", "comment": "Malware payload (Mirai)", "value": "43d4e6ca2058eb92156a4816e5512bcc5585c63ff90d6e2262a72b5a9c8228347563a400e328b28e963fe6bdaca60eb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352812, "uuid": "dcb8680b-a8de-4f71-9ce2-a50b27d9ea77", "value": "T11F832B43E9A19FB7C0866AB565AB5E300B13E9912B4F1A4A313CA7F4434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352812, "uuid": "da2bfc47-7ca2-4497-9911-d2909931d985", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCvujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJM94LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352812, "uuid": "804f41dd-bd08-4cf1-a9b0-934102bde302", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352812, "uuid": "e02d312a-6dc6-440b-be81-435e8ea99ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352812, "uuid": "9d6ff7f6-c958-4e8f-9336-2f5646a6364b", "value": "843272350c96a9e14358d563c2ed5903", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca662dfd-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1654353419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353419, "uuid": "ad5428ed-1549-41cc-92af-88a5242b3131", "comment": "Malware payload (BumbleBee)", "value": "e57f7909e881106af3875d40e468461f", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353419, "uuid": "1484838e-ff2e-4c7e-98b5-293464d1a4bf", "comment": "Malware payload (BumbleBee)", "value": "09eb897e906b118629af771ae4ed012058d210301097f15831007a6dd8d47cdf", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353419, "uuid": "ce6ba813-5122-458b-b00a-f9588febeeb6", "comment": "Malware payload (BumbleBee)", "value": "acf66f42166635ff2fb599bb654b48a8f6e0d461", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353419, "uuid": "c0ab5e2e-8b85-4589-ba39-5523282973ec", "comment": "Malware payload (BumbleBee)", "value": "70601c266dce61b4ee2d12b9de304f10237f5d128ef56d4c491fe0376c1ad4927d918ccfa6a3d67909d1d68b19702099", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353419, "uuid": "968d7082-9e36-4b92-95cb-3cfa81cc3854", "value": "T13CE59F83477BD8B0E3C46B30745926666D3DF22ADADD18ED06D798C0AEE1A8111DCCF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353419, "uuid": "dd923de9-c9ef-4af7-bdad-80f8b3c1f4f9", "value": "24576:vhR21kF5kuycCyk1Exl3heoGA/FflpWh+CC3Pn1AhX1EzLs7o7/+:JR+YyjpO9/Nmh+t92lEzwqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353419, "uuid": "4089a5e2-b153-44c7-8f93-e9e40b6710d1", "value": 3211264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353419, "uuid": "d19db47d-17a6-4594-996b-36a9a9c5336c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353419, "uuid": "c92ffcdf-927b-4913-8137-d8039445faef", "value": "document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d19e96-e40b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654349921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349921, "uuid": "1ca1fb30-a9cc-4b16-9929-95521ca8674b", "comment": "Malware payload (Heodo)", "value": "5e604c6833ee1fd88b2e951d33a28553", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349921, "uuid": "cceceddb-42e3-4bc1-842c-d8c79f9ff2bd", "comment": "Malware payload (Heodo)", "value": "0ae12bdb4e9c769641961457a0d9d3cf55ef2234c451129f501b234bc5f12ee2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349921, "uuid": "f791d24a-7747-46c9-b471-8f158ac83bc8", "comment": "Malware payload (Heodo)", "value": "80b3fa53db5620c7710892c73886ad18b533cfcc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349921, "uuid": "0bc76127-5aa0-483b-8688-865894e27a92", "comment": "Malware payload (Heodo)", "value": "dccc5c72919f4b4095a98fcc0c4aa346b40a688afe050cf607472275580c38fca0f31e6522ca68951a1c81387b1bbf10", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349921, "uuid": "1d2e26b9-a635-43b5-9d7e-aef3890dd657", "value": "T12BC47D0772F1B5B8C205C034464EE532A736B9CD1522ED5F26E1D6302FEA9A22F7E65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349921, "uuid": "5b98417f-9aac-449e-bf1e-29e078b21fed", "value": "1c5c45f819ffed1f8a226b23fc12dfaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349921, "uuid": "ef60d387-d4ac-4117-a886-8892ae7565e1", "value": "12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZQ9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2UyyrmQ9MoIA3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654349921, "uuid": "7a2bfefa-1471-4df5-8f6b-eb59434717ae", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654349921, "uuid": "2874f188-455c-4e48-bd31-fbf132c5f5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349921, "uuid": "9efd8aa2-b1ee-4e2f-a763-5cb8927376e2", "value": "99zNE251OSACUQdHEmru7Ts.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c66d3bf-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352751, "uuid": "191bc292-731d-4fde-be88-a1981d421eac", "comment": "Malware payload (Mirai)", "value": "da9b99cb0d536020906a5648de2bac57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352751, "uuid": "257c426e-f40a-4dab-9738-3f024d21ba60", "comment": "Malware payload (Mirai)", "value": "0bbb257fdd158ad92b5fee2efb2a87469cfa5250cd4b74f19f616147494c514c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352751, "uuid": "b7e303b7-f021-4e19-8188-8474dc45d16a", "comment": "Malware payload (Mirai)", "value": "4473dcf85ab4286bfdc0ee430c16ccaa5c51d665", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352751, "uuid": "2fefafdb-529e-4213-b264-2bc754d4f660", "comment": "Malware payload (Mirai)", "value": "4ba38be75297113a7f7beaf0ed87794be43caa412ebbab1c703c9cbd7d34f03cdb3368e37cbb1a2a7a074f5307e3cf25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352751, "uuid": "1dbcfe40-8295-4e54-9996-5d24a111e81d", "value": "T110B31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352751, "uuid": "473f7f8d-1a84-4793-8d48-c56f6f7c2446", "value": "3072:MSk+U6m1qW/w8wlPbiRq6AmkZrQAhPDCXFke:U6mgW/1wlPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352751, "uuid": "27a91ae6-d4c7-4b8b-b9c5-30ab80e2e081", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352751, "uuid": "3101ce77-32d7-40db-9455-555e2e62ecc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352751, "uuid": "6ec74851-3a44-4a67-8bcb-7b632044a88a", "value": "da9b99cb0d536020906a5648de2bac57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f30d4b81-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654353057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353057, "uuid": "07f7a49b-d267-440c-ba3b-bf287cfa2622", "comment": "Malware payload (Mirai)", "value": "c407b20a8c7b339297916511e8204b02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353057, "uuid": "8fb8f52c-84d4-47f6-9e01-87976853b86d", "comment": "Malware payload (Mirai)", "value": "10b09939f481bd257819d3a87848cc195c92728d0361feaef7e7bbdc73770005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353057, "uuid": "77bf9ae6-1aaa-4126-a331-350fd1924fd6", "comment": "Malware payload (Mirai)", "value": "22b253c11d3b695419c805ab29bf58898349c282", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353057, "uuid": "7014940c-76f8-4257-a068-c077ec1abd39", "comment": "Malware payload (Mirai)", "value": "e392170982cb800cc6dc9273c8b6702ff4fb324a72b78583a2037ab8b0853532b1fb7ef2cb41113df1e14a530a5dec40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353057, "uuid": "b87e7827-de50-4029-9266-3ba0e9f8cc89", "value": "T139933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353057, "uuid": "d26a5ed4-6e9e-4eeb-80f7-5091b2989653", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8vMLumXxVqDrstKfz9e:99bzI9dtcaT0lMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353057, "uuid": "a8170db3-3818-4725-bcfc-145fa88136eb", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353057, "uuid": "66d0ad60-8746-4378-91cb-c0c44b54d361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353057, "uuid": "b747510f-8870-45ba-bc79-58de2e0ec27d", "value": "c407b20a8c7b339297916511e8204b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735caeb0-e41f-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1654358427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654358427, "uuid": "53b48ab8-9bde-4ec7-a0c4-49587d186c1d", "comment": "Malware payload (DCRat)", "value": "a6c43993104c0a1c57ef424be7e88bcf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654358427, "uuid": "974103b6-4792-4ca9-a22d-cce2956e3439", "comment": "Malware payload (DCRat)", "value": "1460c862ed99f46ed0a803a546a1e832e0fb623c8979da0c9a305fa6480c2102", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654358427, "uuid": "6df85e9c-0018-4d57-8145-e9218f7bb559", "comment": "Malware payload (DCRat)", "value": "335295a4546c0daa53a34adadb078a6dac30ccea", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654358427, "uuid": "101d8c47-c4e0-4b97-b97f-d21edc277e13", "comment": "Malware payload (DCRat)", "value": "ddc6454aac370840897468228e33315ccf2c127d63234a56183b215b7044a417fe10ad4f4ebb0d79ad2e9213de6c9a66", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654358427, "uuid": "632307a6-5ef7-45a8-9a34-3c004bd5bb23", "value": "T104A5777CBCA462BF97B6EB69CDE84947F1942C1733834E59E1D3478A890B243B2C416D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654358427, "uuid": "58af3eed-e9c3-481a-895b-3a795cd3f45a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654358427, "uuid": "c708362d-c963-4482-8585-ddf96ca56be8", "value": "24576:tIjRXnezOUZgQuwJHHI8xnQrByvaakZd:sFGZL9Vn8elI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654358427, "uuid": "657e3b68-6917-4064-bb6d-a7b7dc5bff55", "value": 2144768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654358427, "uuid": "657307eb-a169-4949-a2ba-97f63ad3bdf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654358427, "uuid": "fe6f8e47-ab38-407b-9a49-f282756472c9", "value": "a6c43993104c0a1c57ef424be7e88bcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b451e732-e443-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654373998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373998, "uuid": "ca27f69a-aacd-439e-885a-b3f2af4988d7", "comment": "Malware payload (Mirai)", "value": "ec0247430623d17676edd7378d8269cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373998, "uuid": "97d4d403-e384-4a51-9c94-b6fe32c225b8", "comment": "Malware payload (Mirai)", "value": "1646133aa2d185b08e1d32f85920e1883f3548243af29b46a451a61aaee2e86d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373998, "uuid": "195b6525-0c38-4309-b4fa-e54bf2f50674", "comment": "Malware payload (Mirai)", "value": "8178177223ee5e8ed96a50bb38497dd60ddf4858", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373998, "uuid": "524a3527-b6d7-4b39-9c12-5a750b328cc9", "comment": "Malware payload (Mirai)", "value": "3b52fc7d0a10e8c0670a4419e6645e4602f2dc0fb72fe19e2d27c4236e03c376c8b32b69d2a8768c1099807a3d72bb85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373998, "uuid": "185a4391-3aca-46a7-b293-6cf9d660a86a", "value": "T1EFF22BE1F802AD3CFC5FEB7D84474909F532725859820B3667A3FC675C322A85A62F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373998, "uuid": "0e443d91-a28e-41d5-a7ee-1917d9bad3e0", "value": "768:bn5etvj2+eSfZKZQd/Y8pIJ5TIHTNCRFM:bniqbKZ/Y8pIPIHTYRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654373998, "uuid": "6f1bde0e-5727-4c24-8d4a-73774a4bfb6b", "value": 34984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654373998, "uuid": "d1b22b7e-e11a-4562-890a-b7dd1da8ff18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373998, "uuid": "ec61a12c-1f35-41a6-872c-e7e7a36818da", "value": "ec0247430623d17676edd7378d8269cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfd4f36-e452-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654380295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654380295, "uuid": "d4478b15-af4d-4848-a1e4-4b3f4f235299", "comment": "Malware payload", "value": "a8285175b82b44850bc3df2e47233b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654380295, "uuid": "5ae29446-8788-472b-95fc-c084a538cc5e", "comment": "Malware payload", "value": "188f5a874f2eb356613cea4e1f2a023a0358c9a74b8ab110a970fa35dd39a213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654380295, "uuid": "ba087935-25a9-4909-8ee7-bcd4b802279b", "comment": "Malware payload", "value": "2968dbc9bb7c9a2d3d080e2615325cf739ab5e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654380295, "uuid": "1e34adaa-91be-400b-84b6-0d7e3b29a8e5", "comment": "Malware payload", "value": "e8bd792d63c2526e00f5e67629715fb6e28e72670fba5a5a8c027ebabbc09d4e595e76ab9f7b090ab69bcc599b6d4805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654380295, "uuid": "ebd6f67f-cf4c-4b04-b9a5-defcb679fa52", "value": "T17E720883B690E4A2C76C46B06231E9A6816737B10F7596977FC0DE3C1D3A9C1DC3491E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654380295, "uuid": "247dc89b-81c3-4b7a-a187-7f75c5b11841", "value": "f085064697140807ff9d1fa51c77befa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654380295, "uuid": "09237c7f-c2f1-499a-9ff4-1b6933111a86", "value": "384:vvgydig97k4fUHJpIYKUTjFQI/YOAQjQVQVQgRfGlnR7XmW9Ax:P5fUHPIYKUtP6I00Q739E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654380295, "uuid": "69f4ebd0-843a-43d0-85ba-2d18100659db", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654380295, "uuid": "9805d356-3f49-44e8-bbbe-f9c3b5e9fa6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654380295, "uuid": "a29112e2-2ba6-479d-b6cb-aa6086348fa5", "value": "9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023f73ab-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654353083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353083, "uuid": "ac314e04-6c1d-4441-a808-f29411f92c87", "comment": "Malware payload (Mirai)", "value": "ca0eff0746b0c14e564d62e21fdecd83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353083, "uuid": "3711bf49-900f-44d9-ad6a-043eec72fa42", "comment": "Malware payload (Mirai)", "value": "18ddca604544a03bdb5af64efd6f30bbf6afb62329581037860df6e1e4804480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353083, "uuid": "8070690f-e80d-4000-ad0d-a45c145eabe4", "comment": "Malware payload (Mirai)", "value": "3f1d0e9921e5c82a425e132674eb73fdcedd2efe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353083, "uuid": "c067ec70-6397-4f44-8313-e413cef6aab4", "comment": "Malware payload (Mirai)", "value": "bca76bae81ff1cf50d3440cae58cc96e2c9263b78d45f23448f55c9f7de786dd117dd99cc818053eada1155fef81cc7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353083, "uuid": "1ad2a339-914b-44ef-8e17-5e2824aa1ad6", "value": "T1C9C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353083, "uuid": "24a16d43-c4f4-48a0-b5c0-4068e06c170e", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBewERLWfRZrmW+i:/a1UW0MZQHOB6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353083, "uuid": "3956a122-9ace-4b8c-92ca-5a2157803c81", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353083, "uuid": "5a8fe910-f48b-4dc3-a941-b8acfe1d1877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353083, "uuid": "ba565c0c-f3b1-46cf-9be6-38cb067b76e4", "value": "ca0eff0746b0c14e564d62e21fdecd83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a6a614-e42f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654365467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654365467, "uuid": "2f52c94d-7bd8-4ed4-97e8-05e64046bd20", "comment": "Malware payload", "value": "a5e84bbc2cd3a99d24061c6b8dd0552c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654365467, "uuid": "c54362b5-88b3-4c98-b044-d57b0c125f3b", "comment": "Malware payload", "value": "194536a80e386c4972aad39c0c3eef8bf605eb1fcc71ea99443207e076044b47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654365467, "uuid": "5b93d23b-6586-4d00-9516-c2d1e6c69df2", "comment": "Malware payload", "value": "040f48bd277ef5666040605b5bd38ec00774568f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654365467, "uuid": "d2df25ba-cdb1-4595-a3d7-cd956562ad56", "comment": "Malware payload", "value": "080566b360a28731b67065bc2429258b9e29c443d5252d1ecdaf8f9ef8a6433fe99e666138ad0f0e5dd4ba9409a129dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654365467, "uuid": "29473521-81ef-468f-8462-674aa92c0534", "value": "T1A684F15077F19132F5F36A3518F4CA005E7FB85B2970818F17A822692F617D1AABD363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654365467, "uuid": "7525ba3c-7e0c-45fe-bcde-3c584a177d14", "value": "b8e78bd73afb771519a38767f795e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654365467, "uuid": "41bddbf3-0aea-49f1-9cc7-1c67839a4df1", "value": "6144:y+q5dghYySHu6PHqpmWt1am+DtKqzLPiVzroYa59x/:a5dDJHrPHu1tMn5KaLIzM/nx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654365467, "uuid": "2240fa51-fe38-40fa-b646-e646bba21388", "value": 372680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654365467, "uuid": "3be55b2e-e68b-4750-abe8-ef4d3031bf66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654365467, "uuid": "25ddd375-5671-40e5-afd9-d8b64968da8e", "value": "a5e84bbc2cd3a99d24061c6b8dd0552c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e12ccce-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361908, "uuid": "e3e5c34c-efca-406c-a5f2-2f7604076f9d", "comment": "Malware payload (Mirai)", "value": "e2e106aab8faf0bc9a17a10a9e085b09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361908, "uuid": "9f3b76af-dac8-4541-ac46-91f0b0acb484", "comment": "Malware payload (Mirai)", "value": "19746d1829c6ee6a715e49d9a180acfafbf5ce6b574463134e954eb17d36d34b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361908, "uuid": "20bd1ac0-e5ca-473b-8673-35227e2a3def", "comment": "Malware payload (Mirai)", "value": "296a69600a3fb51644d2cf62ec56207ad39cbd5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361908, "uuid": "8841fce5-87cd-471b-8b7d-827a2dd8b7cf", "comment": "Malware payload (Mirai)", "value": "5cffa66808f7a7cf1921610402bc5cdfc091080a4114c5668160b58cabe5ff62804b67b88fcb24494f53e1d27473d9bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361908, "uuid": "f180d393-82d1-4894-bc08-f8f13306e6c4", "value": "T10CB2D1BC3A8219E8F950E8F818E507546F224F659223BC7B291DFEC38E82D7534532E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361908, "uuid": "0b320e57-0e87-43b1-bd1e-79ca0dcf5b32", "value": "768:8v8mJxLiW1ejobWeRDmfEoj1DqJgGlzDpbuR1JrS:8v3FF1QobJgZMVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361908, "uuid": "bc9ae8fe-6895-4eab-a169-212cec121229", "value": 25420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361908, "uuid": "b28b65fe-be16-4e45-ba92-24f265cd8172", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361908, "uuid": "06a50ea3-b704-4a3d-8053-6cc98147ba2a", "value": "e2e106aab8faf0bc9a17a10a9e085b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d613232-e40c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654350283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350283, "uuid": "15ffdf24-6119-4a69-ab50-37a166e9c3f7", "comment": "Malware payload", "value": "1fd53adfc1ff5f6262567592dfc88fd4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350283, "uuid": "3ae42177-6a9e-4dbc-964f-94d8cdc011c2", "comment": "Malware payload", "value": "2192345562b9fb1536465d31f465015cb8b0a029fa118166de0d6975bd00448b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350283, "uuid": "265d73ea-a35e-4c52-b2ee-39278137a2b4", "comment": "Malware payload", "value": "596ea1190a357e17169ad8d3b63fa31ee1cea3bc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350283, "uuid": "844eafce-1b47-4096-8300-b910a4472a3b", "comment": "Malware payload", "value": "a8efbc4db15450e82787893d91499a3d0cdc8e07d718543f637ec8608dd9b308b68badd0272a3a1289ad4596e7250f2d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350283, "uuid": "a57ec4d2-cc29-4b51-9f71-df5e71813451", "value": "T158271256F38CE92AC4B79032CA553636A5564C24AF02D6D32D14B39C5DF3EF08B49BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350283, "uuid": "32e87df7-6e89-4d4d-b073-cc159ce524f4", "value": "393216:H0MN1xjIAbL4d73dW9HL3cd03LCd2jkMRjC4FbKLm9xjXZfL7:HxSAbL4d5qHLMd03OdZCC40Cpf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654350283, "uuid": "9ba846d7-246c-4451-85e8-2ce2a8e74689", "value": 20724209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654350283, "uuid": "5ced286d-e7f8-4b97-983a-6f18b6035bed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350283, "uuid": "2f4c37b7-927d-4c7a-9fa8-1e9d7b157078", "value": "Phish.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027dcff4-e41b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654356519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356519, "uuid": "1c95eb12-f8b2-4c1d-990f-0113f057f6ca", "comment": "Malware payload", "value": "efe3813a66322cd3b5d4e6fbc45526ca", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356519, "uuid": "f6655e91-f50d-4039-ad18-a7b05ee434ac", "comment": "Malware payload", "value": "2212aeaec558a6d2cf571820e3d029c227aa44dd8f81fbbdf5d5dd4d13a0eb00", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356519, "uuid": "67b3e83b-e0ef-4630-b0e2-ba15a995b562", "comment": "Malware payload", "value": "af5e77a0ab5ea4cb973e637864ee08e5722456b5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356519, "uuid": "ce097319-3706-4f74-8f0a-57b687ce5eef", "comment": "Malware payload", "value": "9f184b2a68eac45b1e58a5e54776247fb09f776930feddca12185b3f8d33a1f120f6a8f8f62a4b3a1aec2970c60feaba", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356519, "uuid": "8d936907-e660-4a41-8ea3-e9e71592ff8d", "value": "T13A170243E318DE6EC4F38332893D6222345A9DA09F8397AB6918733C39B39D55745BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356519, "uuid": "3f4b4da2-1832-4b0a-a1d5-51118cd3daee", "value": "393216:a4r90x1uJjklt57vF0RE55pkovgWTX0PmVUenKR7NIBD20C:a4r9G1gjklyRSpkovN5NKlNq2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654356519, "uuid": "c41bf16c-ad25-4985-8da8-9434c244f394", "value": 18816300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654356519, "uuid": "2c915afa-7875-4986-aa8b-368a9f5a8128", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356519, "uuid": "8a394fcd-50ef-426e-a411-82ac208a27cb", "value": "Send SMS_1.11.9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c374578f-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1654353407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353407, "uuid": "6d17c5ae-5a23-4f65-9ba7-f1241ae8624f", "comment": "Malware payload (BumbleBee)", "value": "9c8f7f0d2c83e2c5e560389c025d4cd7", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353407, "uuid": "05d6dca8-6ad7-4f4c-bcf1-01484526aa80", "comment": "Malware payload (BumbleBee)", "value": "24b28f37f908ee50527eb47dae4ca50e413ccfdcd88b9f44309c843725050f97", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353407, "uuid": "15ab5abd-b30b-4a22-a54f-896392dc74e3", "comment": "Malware payload (BumbleBee)", "value": "69b9af694d455057f61d125eac695c81b750ca4b", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353407, "uuid": "db9b473f-386b-4409-9b1a-9d12ecdb66d3", "comment": "Malware payload (BumbleBee)", "value": "efec98a683bb585e8b16e8af7f2d674d11d7353d27ab49ba034e5f7b9e3d4ecc4894d1f7f50e1a03c6d6ed8e80f137a8", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353407, "uuid": "f097fb87-d4c5-495e-bef0-16d5bff0f48e", "value": "T11825232331B2114CE4FF993AEC8A2FE49152443A9CA17E0879B4BFA9DB41F5571037E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353407, "uuid": "91207bf4-36be-4841-8e92-629e55ef4309", "value": "24576:MS8ZQp3yMCkjO5E2vTWnfB9DwQtL8lh27DpwH2J:4Zq3pDwvTWfB9DDKmRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353407, "uuid": "b2e54587-5964-4538-9ea2-f34fdbff5243", "value": 973316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353407, "uuid": "e9e07fd9-2901-4ffa-8c79-0e0b1eec8f6f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353407, "uuid": "ea8a79d5-c806-4cd2-a11a-7b072fd6cca2", "value": "StolenImages_Evidence.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6f4d16-e414-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654353580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353580, "uuid": "4e4aa62e-7b7d-4832-a0df-1dcc6679bfe4", "comment": "Malware payload", "value": "3733b05a4ab64469e97cabe76f3ba848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353580, "uuid": "e00874af-d1cd-4e0f-b73c-4c4f1d7598ce", "comment": "Malware payload", "value": "26cb1805b360f9cedc91192e47cab483a588b3184fe603d5975cf521972d1a54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353580, "uuid": "db4f8830-7eb8-4606-ad9a-2004e42f6b71", "comment": "Malware payload", "value": "88ca204fc4a6f2952e33ececf96dd198b60dcfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353580, "uuid": "afe3c2a8-5b4d-4049-b131-52fa1aae276b", "comment": "Malware payload", "value": "3a5919eb4494543a65e6598ac63b64d7e77a841d6c6954b82da3843d95943dc3210a435874e63bfe9eda793a4a98300e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353580, "uuid": "32de508b-270f-4b2f-85f2-c138fd35f52c", "value": "T12895BF12FB8285B2E98701B561675B7F8E399B249328C9E3C7D11D758C212D1AB3F3D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353580, "uuid": "59908f8d-c55b-4a11-9d5b-f6f721963eec", "value": "98c0f0d8f0772527ae47ad42fd715da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353580, "uuid": "8b02d563-f0ad-4cfc-b8a1-a38468736821", "value": "24576:h+KpPLltIzkQ2QfGqbD4ykMiPPI+28xGJ2+5Jh3y2CJAZBUoWHGuYY8hg5CPSRiI:x5Mn2FvGA2EX5CPSRibKOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353580, "uuid": "fdd24c64-d7d7-4fb0-87c4-78a9daad7376", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353580, "uuid": "8d17016a-ca6f-4f3e-9158-2e7ec8b28566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353580, "uuid": "3fe2be5b-7e4e-4fc0-ba9b-6fb2a2ece277", "value": "ransomito_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca05133-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654353181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353181, "uuid": "c6a8c2cd-720a-447b-9d2d-faf310426ebd", "comment": "Malware payload (RedLineStealer)", "value": "853b9cbe15c6cd5dab5297af902f87c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353181, "uuid": "db87c939-18aa-4bd9-8286-69048f016336", "comment": "Malware payload (RedLineStealer)", "value": "27fe46091103ff31e398ccfa5aaa75a526bd3a91bf991f76139ff52dffba9ab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353181, "uuid": "63b2a602-f169-4a29-acab-41b4fb578308", "comment": "Malware payload (RedLineStealer)", "value": "411e5bc81105c2adfa3ad37cf37b6b6122e6c1c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353181, "uuid": "9e2f05f3-1e2c-4447-afbe-649d3109cdac", "comment": "Malware payload (RedLineStealer)", "value": "8cdea57a83db0fc5fa91ebba03728f8740e594236cf673b9f0842256a261f4f9e5400ff0a8b8a1312abb776ceb413c14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353181, "uuid": "da7687ce-2e29-4849-aebe-f418bbb6b3ae", "value": "T19464F120B3F2C831E5F346744874C6E1167BB932B971948A379452BEAF257C1AD79323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353181, "uuid": "c7b7ccf8-8593-4c77-8a41-ca16b11d6456", "value": "36661493c289414c02e25c0b7465e587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353181, "uuid": "9cc46516-232d-4762-af29-bd2cee334852", "value": "6144:yHVtSoPlxRYeAHGO0H1oW3kgk6rdyFaqM3/:yHvTtBAHGO0HKrYAaq+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353181, "uuid": "e840c941-fd23-435a-bc9e-edf529f9d4de", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353181, "uuid": "d31cdf92-6746-4c3c-ae10-9ed1f68ee1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353181, "uuid": "3dee7479-7c94-4dce-9f4b-4d2d7a721643", "value": "853b9cbe15c6cd5dab5297af902f87c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93148137-e444-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374371, "uuid": "eb2bbd34-554d-4445-9696-91ee7426f902", "comment": "Malware payload (Mirai)", "value": "91d0a7bf5c128e320e8a4aca8f0f0423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374371, "uuid": "bd62538a-1f55-44d4-913a-87a92153f176", "comment": "Malware payload (Mirai)", "value": "2ef96ec3b27f9c948a3a7fc9679a5ef8341111f598594a74755bce17a3d072d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374371, "uuid": "21f1584c-dff8-4cd1-95dc-2401cccbe8f7", "comment": "Malware payload (Mirai)", "value": "371530858641d943a4ff8eabb9d906413316a42b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374371, "uuid": "ddc81161-f25b-486f-99a5-34c3af9bf688", "comment": "Malware payload (Mirai)", "value": "acba2152eeea2d8fcbfc72865011764154b4406e36c56a084f998eaf0b80081269a8e216ca22cf920e9608dc32a199dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374371, "uuid": "d124246f-4dba-4d0e-9bdd-1492141ee344", "value": "T1D4D24BC59682C9F5EC1606B120B76B52EF76E4326B25E67BE3A53732A813310DB0735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374371, "uuid": "2c95ac7b-2edc-4273-8bb9-62b898686108", "value": "768:bjS8wXIdeA/G8jFvHd1G/t6auaYWNPzS:i8wXVJu5HdCUpaZNPzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374371, "uuid": "50897cc3-7cb0-4618-bf6a-0cdbee090c09", "value": 30768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374371, "uuid": "ee506504-afdb-4bfd-a0fa-0261a93bc802", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374371, "uuid": "4c39bd9d-9b00-441f-be98-026dcc54d97d", "value": "91d0a7bf5c128e320e8a4aca8f0f0423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edaac1f1-e45f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654386120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386120, "uuid": "fc08f466-9581-4287-9083-75d37c63cb74", "comment": "Malware payload", "value": "9c878d95d08aa3083f2e9cb9c80472ed", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386120, "uuid": "9ec9f146-231f-4c1b-b67c-8a1eca844c0a", "comment": "Malware payload", "value": "2ffb08e74dd1529e3d1e2eca9ce81e65bcf4dd360c8825dbe4c6905f46b039e3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386120, "uuid": "14ab0f10-de35-40ec-aeef-837979c7471f", "comment": "Malware payload", "value": "368350f1d39a016044ad687116075a6efb118f92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386120, "uuid": "34df9c7c-39b6-450d-b543-978fe81b6572", "comment": "Malware payload", "value": "71be234edec32b6eaa7ff69485578eb60a7c46fc93f8c4a5d9acada6f9da15b130ba3546c8f5e012b935d6af06c6a26f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386120, "uuid": "32c4bd7d-7e37-4456-87a9-f17d275a4e4d", "value": "T12F058E05FD5ACE2BD249D9364C96D2EAF778BC06AE84A603305D732E2F3E780944E745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386120, "uuid": "5f3c4054-3c0b-4566-9cc8-896a1a9efded", "value": "24576:SJkibpcQbQCkfWjbPZOdVEVqpjoaIRqmWHc6:SJkibpcQbQCkfWjbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654386120, "uuid": "217d87b1-a127-407a-8e3e-ae6590d4ad2e", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654386120, "uuid": "e920b97e-3962-482e-8aae-e540cf8ad661", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386120, "uuid": "c132c6e2-311e-433f-a6ce-06af6d5187cd", "value": "SecuriteInfo.com.Heur.20256.19056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49505c84-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352773, "uuid": "8ca6eb2e-72d4-4482-ace0-dd2583773a8c", "comment": "Malware payload (Mirai)", "value": "476d1bdd2ca13a904d0815a50be13c49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352773, "uuid": "fa2ac506-dcd9-4c4c-9b2a-e43591f3279a", "comment": "Malware payload (Mirai)", "value": "30b7ac2136a7d400e4f196b303a3679f96a82210abd8814bb476fc74c70bb438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352773, "uuid": "8db04cb9-637a-4bf1-9ee4-52c9fc9aead2", "comment": "Malware payload (Mirai)", "value": "b400cc757e0b8b68b96ed56ac887654c0cdd6ad3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352773, "uuid": "0481ac06-09a5-44b8-b64f-803fbfbb5b43", "comment": "Malware payload (Mirai)", "value": "ac71c78263a9394556786ba73327535b9953fa5df31963991e5c6b973e4717525b26f6db0a2c324ed05e96997309eb4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352773, "uuid": "ba505341-614f-46c1-8621-90b5eb749784", "value": "T13FA32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352773, "uuid": "026e03d0-653a-4ab6-8f42-fee6d8395b2a", "value": "3072:1Sd+e6mKaGP0NMD3PpShtKmZuqQ4DPwXXtse:C6mxGP0MD3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352773, "uuid": "23d20421-0821-44fd-8982-137f0cf89ac5", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352773, "uuid": "8356311e-269f-41ac-a1a2-bf9db11df4be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352773, "uuid": "c036c90d-a893-4c98-98e7-4155a7a235d7", "value": "476d1bdd2ca13a904d0815a50be13c49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "645c6874-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361838, "uuid": "a65aab66-bc7b-4e51-ae07-2733ed949e2e", "comment": "Malware payload (Mirai)", "value": "abfe55a6271ee4e5facee70bd02ec004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361838, "uuid": "8a40b143-8603-4006-bdea-7f05699b9c87", "comment": "Malware payload (Mirai)", "value": "3151da3b584a162c2aced6dc10b2ce3463e42d606fa80982ecf68638af5833f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361838, "uuid": "78a2caac-7fbe-4ce9-a20e-04688c29d870", "comment": "Malware payload (Mirai)", "value": "02f875ea8d13464aee6d903cf303bafe0ba90096", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361838, "uuid": "7958250d-c5cf-4a9f-b52c-9719bf19f2ca", "comment": "Malware payload (Mirai)", "value": "f2017a186603aeb0313cded72fbc5a3f417846e701a29acf14e023de9dab54e41e3c53768d5e4235a815e295bcd2784e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361838, "uuid": "1f1684be-a2c4-4dde-96b1-721a910e8ed9", "value": "T1AAC2F124A37F595FC82A8B3B1A1F4E931C611031568D9B87B1674EA2D2C7C27633B430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361838, "uuid": "d7750923-79e3-4f6e-ba67-0495382fd45b", "value": "384:MOU9bi8ZDbXnq5z/nOoW6WLex9drQGBL3w4fwl8cs1P9PQpJkMwia4ZJLr0mGzbc:JUcEa5Kb7c9uT4DP9GJkM8qKhm4HDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361838, "uuid": "5bbbe475-12ca-4b68-abe8-cdabf7afc0d1", "value": 26168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361838, "uuid": "67e5bf1f-c322-476b-a82d-02358a5bdefd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361838, "uuid": "e7c05986-68c6-478f-8447-1963dfd16e0a", "value": "abfe55a6271ee4e5facee70bd02ec004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8671fa-e3be-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654316809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654316809, "uuid": "63a9b091-67e3-4efc-971a-037736944ec5", "comment": "Malware payload", "value": "712cccb9406fcb0b55ec3808f4eceaed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654316809, "uuid": "1eeeeda7-939a-4cbf-88e0-539524dcdd90", "comment": "Malware payload", "value": "34008d5b7a7d1704f8e2e7ca4e0bfc35586b59840253e2eff8dd35c6779d62c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654316809, "uuid": "0c7bf4e7-7847-4694-a2e0-f0f7cd9e22c2", "comment": "Malware payload", "value": "443acf33d7102bf4a2d2ac6c7c5443e375a1bfe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654316809, "uuid": "27672bd9-40e2-4115-a38e-a6ab5582dc08", "comment": "Malware payload", "value": "50872ff53a883d9cda05cc9041a035228f2aa56eb58c371886fd683cd73f4d3943a8715d1381d62b1afc58a0c0686055", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654316809, "uuid": "a3fc73e2-4e1a-4e05-bd92-8e56f7660a62", "value": "T1ED663346850449A6E8623B388831CC39D4777DA6BE56D19B8DC4BC637F732C278339E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654316809, "uuid": "e6589b3a-b6c8-4aac-b119-5855b1a5da91", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654316809, "uuid": "d425046f-c48c-4e77-8da8-21a207cb6fc5", "value": "196608:rD4PmCsXDjDyf6L2WliXYrHW1nb+jX1TsOF:YPmCEDVL2ciIrHW9CjXh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654316809, "uuid": "385e2614-31da-4575-9ea9-1d52f7969a7b", "value": 7115938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654316809, "uuid": "a3e5aa4b-e2a7-4cbd-acfd-749ffc5697a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654316809, "uuid": "02d9d6d4-9ca9-4f47-949e-ea463d60154c", "value": "712cccb9406fcb0b55ec3808f4eceaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e96712b-e42a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654362982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362982, "uuid": "e8c855b5-b6fe-47bf-8764-3db8cbc5d4f7", "comment": "Malware payload", "value": "dd60d164419313a1380082239625bd05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362982, "uuid": "e0062f26-9ba0-43c4-bfdf-e66afd084e5f", "comment": "Malware payload", "value": "375936bf7aa03853467c743030d7ab3d25aa4735a880dfecd0ba1042ffbaeb79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362982, "uuid": "0b9ee046-3f77-4781-b2bc-6d97f068aca8", "comment": "Malware payload", "value": "170ac471173eba0f169bcc48fc74b6711924103b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362982, "uuid": "123a4369-b41d-4599-945f-7f25012f636e", "comment": "Malware payload", "value": "cc6d8981aa77ee895812d62b9adef47a707fe953a81f192514cb19765d8a96b539deeaffc376699022b459d457306b6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362982, "uuid": "e7c408ed-bf13-4ce1-ad30-76ae850328d4", "value": "T1EF840121B7F18430F6FB4B7068B0D2619AAFBD522030869F1754696D6FB0BD19AF4327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362982, "uuid": "d995e067-daac-4eb4-a950-721bfdc3fcce", "value": "b8e78bd73afb771519a38767f795e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362982, "uuid": "79a44eb1-b580-411f-9060-dda657db3592", "value": "6144:fSXbSHTYf+yzCGbdU8THgZbEGAeo4Dh61GJ55aF:KrSziWRG5eo4DcwvQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654362982, "uuid": "16130f95-64df-4a31-a90c-b3deb3b85596", "value": 373192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654362982, "uuid": "9f9a5fcc-3a98-4f05-a10c-aa956fc1bbf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362982, "uuid": "3cf60e9f-7136-4b36-a550-4afc9760591b", "value": "dd60d164419313a1380082239625bd05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8807bbb-e39a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654301393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654301393, "uuid": "712db90b-e815-44a3-8310-84b0bdbbc4c0", "comment": "Malware payload (Formbook)", "value": "23e4f0e539e59c7dcf6c4d44f731d826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654301393, "uuid": "95be0be0-863f-458c-b19a-e9533674b9e4", "comment": "Malware payload (Formbook)", "value": "39eac1d90c2b7b6a02c496fc6b3177ca7802c07fca01a5314c1d5216c22b9b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654301393, "uuid": "897eebf8-4870-4ca1-a16c-76240484113e", "comment": "Malware payload (Formbook)", "value": "c465290a3556d4188ba5b98e4cbf223e129dbcd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654301393, "uuid": "0002a700-0824-4b90-8a50-2cd4b7013286", "comment": "Malware payload (Formbook)", "value": "d471ed9a47d38d6f946b0def6645a4cd8109de29149fbc0e9c6642b9a618c8c1a1705c8d83f59f03dc1bceadae0d4239", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654301393, "uuid": "83aac97a-177f-4755-9c70-cc9fab93f25a", "value": "T1CC945BD0E286FCE9E039007699B5E525261B972EF4B4093F25AE741974BB34360BBD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654301393, "uuid": "52e509e3-c58d-4411-91a4-f5cbfcbbe07c", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654301393, "uuid": "c7f2c9d8-e921-47d1-b643-5c01995f9098", "value": "6144:BG26skS7ogS5QDKUau77TpWv0kCI5qbIiHGfpxAUEendQd0:HCQDKUau4vOhmxDlndf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654301393, "uuid": "4aa793dc-86bb-430f-9eba-c75712fd56ce", "value": 421974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654301393, "uuid": "840b426d-54d4-42fa-95a7-38857a879bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654301393, "uuid": "9613cbe7-2226-4091-9854-cb4d99577fdc", "value": "23e4f0e539e59c7dcf6c4d44f731d826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5937c6f5-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352799, "uuid": "99861aaf-b1cd-421d-903e-65bbad8a76dc", "comment": "Malware payload (Gafgyt)", "value": "d5304e6030f79b395256937f4a29f5db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352799, "uuid": "71f7e9cd-c245-469b-a060-3fd4623f7fdb", "comment": "Malware payload (Gafgyt)", "value": "3abd7c8370f70c2ec6e38519adc1f66fb36828858fb7f22e5b587dc34b22df34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352799, "uuid": "766ed7d3-1caa-4bf0-aebc-eea5a623e962", "comment": "Malware payload (Gafgyt)", "value": "077cc5eae93d7dc62ba6c2304e648694bc31d81d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352799, "uuid": "b4630d11-084b-4bdc-99d2-3bed6931935b", "comment": "Malware payload (Gafgyt)", "value": "cddf217223d9c3b7dec12e7965fa13b3d6da5af7a73d61fe25dda66f99421d76e3c0525466db8374590d9629f6a061be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352799, "uuid": "16d16a44-334c-4ec2-882d-6c8b62f001bc", "value": "T1C5E34B09F6408B53C0D32775B68F534537239BA5A3DB33069928AFF43FC27AA4E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352799, "uuid": "ded479a2-c26b-455f-8500-8bc1cc3b770f", "value": "3072:UdGnUax5nUy4XSWA/N5Y5hgtGVDRM/9hQm5wTsL/Qpyn:oSUax5nj4a/N+5hgtGVFM/9hQm5wTsLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352799, "uuid": "130f4f50-c76f-4b11-af75-cdb2591e58d4", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352799, "uuid": "63b91f72-c871-4b2d-95e8-5f9809f37b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352799, "uuid": "fc4ba433-287a-4413-8ba7-1822450eb486", "value": "d5304e6030f79b395256937f4a29f5db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00e552a-e450-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654379547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379547, "uuid": "835bab66-a7f0-4f43-ba49-456104fbb004", "comment": "Malware payload", "value": "351c5c93842f1915863c19ea0864e73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379547, "uuid": "ea35d1c7-3de3-4254-8ffc-401e5cd5217c", "comment": "Malware payload", "value": "3ce109a140b0a26f8bb70bb1b5393bc4901586c6f47c10337dd1a952c55dc0c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379547, "uuid": "64583145-c0d9-4a7d-acbc-238f4db8727f", "comment": "Malware payload", "value": "14dd36b31aca1b36b6765ea5d706a219bea58b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379547, "uuid": "136e1bb8-e6de-44ef-97d2-20a866894d8e", "comment": "Malware payload", "value": "f4fc4e221453962817099bca9e626b8bbb837ed114b08629009d1937fb37f4d59139b51f84c5653e80990a3f76890be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379547, "uuid": "504a9fa2-361d-4042-b243-59b678c71700", "value": "T1ADB533C49B490628D03851766232CF6E6B77F43C2DA0C76B7790265CDFA02E7AF67864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379547, "uuid": "c883f26f-238b-4b1d-bda5-64424446e34f", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379547, "uuid": "b8be17c0-8ad4-496e-8428-d2470b03cfe5", "value": "49152:T6cat11vYVCwasNP6BO5USNQMESUqviNMGB+l5xoJ1r0I58UZ:ar1vYIsNP6tSUii+++uAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654379547, "uuid": "2489959b-8db2-4360-9674-9d75669b42b3", "value": 2426880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654379547, "uuid": "eac43f2a-5f57-40d7-aec3-9c8436fa56e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379547, "uuid": "80ee2872-3622-41c2-8ecf-fdc69e0c499d", "value": "351c5c93842f1915863c19ea0864e73f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c007da-e426-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361404, "uuid": "6efbbe69-af11-4fb1-8b6d-fe3a7dec6472", "comment": "Malware payload (Mirai)", "value": "670b6ec467a9477aa21c23e12ae2f2e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361404, "uuid": "395beb37-63fc-4e31-88fd-9e68eaf55e14", "comment": "Malware payload (Mirai)", "value": "43127fd924a8cc8b304efcda2d7b7bb19a8d728eb2b2c11901f381289c24f245", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361404, "uuid": "96b8c6d1-c500-41da-9552-66e68f573bc8", "comment": "Malware payload (Mirai)", "value": "bae8ae1497614cbf70e59a7fb6dcbdd8c7451fda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361404, "uuid": "78bb76fc-53e8-41ef-8b26-eb887776cd6c", "comment": "Malware payload (Mirai)", "value": "e43b0eb5fa7e12d0e67719c7f677f1605586b1c4487551bbd4370a4b04a06c0a161f8e1e67e4ff5efab622b7006239d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361404, "uuid": "e8538bc1-011f-4197-bbe5-fc10477dfb86", "value": "T18C2302716B3A9F5796700DB4CF3845C375CABFB88C0B219276944E4C2F912652AF0D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361404, "uuid": "b0a07772-7ea1-4eca-b6e1-432e9e34ca2d", "value": "768:nhlEeauld3fldEjYhpsPW751+B4TfnOkmOTDwZTtCS9q3UELnQpDLkJcQMfU3zFZ:nbEeDpkjYhmW75WUzTsB0HLnYLci83ZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361404, "uuid": "bb8ac68f-c399-4532-b080-c3508c1291b5", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361404, "uuid": "a8e41a65-d91e-433b-a9dd-5df602a9829e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361404, "uuid": "e37b252b-2625-41a6-a93e-bc6955fccfe2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc88ce0-e3e3-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654332673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654332673, "uuid": "4a68f749-c7a8-4693-b993-2163631e43b2", "comment": "Malware payload (RedLineStealer)", "value": "f240dda6b320cab08c2aa92971a7cc30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654332673, "uuid": "0d79f761-8652-4198-bfcf-15e04368f934", "comment": "Malware payload (RedLineStealer)", "value": "447e7e5073636979b91f0d8c49b0eb36790ceec3b41c771b163aff66049fa238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654332673, "uuid": "413d7038-9ba9-499c-889f-bae772df97ca", "comment": "Malware payload (RedLineStealer)", "value": "32d6ec605740bbb97d3d89d2bbb0d631e666b564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654332673, "uuid": "a31cd737-4de9-4e2d-99ea-2c6c709e15a1", "comment": "Malware payload (RedLineStealer)", "value": "5036047703c2b9a6f58b1969389c736b53e006952315667a2507b2368824b72bdc38ad7febb52d8fe8c46dca5db7e8ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654332673, "uuid": "aaac4e72-f212-435c-ac34-34c1b0372758", "value": "T12805CE45F2C4DC87C849F93A479C827CC3239C898982D54FBA4CBEEDD97A7684D4129B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654332673, "uuid": "1a39b185-0d7c-4588-a797-118d78fa3375", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654332673, "uuid": "032c6d3c-3220-4808-a2a4-1e63969dc7c0", "value": "12288:1r/WrBYwJkqdIbr/GnBjL8nAGXrffi8yA:1r/eBJJkYBLwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654332673, "uuid": "9bb102bb-5a93-4352-9622-b1ac365a336d", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654332673, "uuid": "b82ed6df-a0d7-4e71-a347-70de0541ccae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654332673, "uuid": "727c3779-b64c-46db-a5ad-a8d7ca2e9691", "value": "f240dda6b320cab08c2aa92971a7cc30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0081c6-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361881, "uuid": "81316a21-feb3-4c21-9921-ce05f26deee2", "comment": "Malware payload (Mirai)", "value": "1d66607c6164d6eca4dba55c12e00ba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361881, "uuid": "50c61a53-0cd3-425c-8a13-97b25041f01e", "comment": "Malware payload (Mirai)", "value": "479da7ba8ec6433fe277112db96b98ffe002bcad6aaf7c4551ffb06ccb83dbc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361881, "uuid": "7202e3f7-ff05-452b-91f2-ae177819fbad", "comment": "Malware payload (Mirai)", "value": "782cafe61d56dc8640db4fa0c9fd907dd957ca8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361881, "uuid": "3233bc08-964c-4bda-83e3-159f8cf14a1d", "comment": "Malware payload (Mirai)", "value": "120d85d76d8b22f6570400aa090c71ab204e4c9f96a115c0e2b6baeb9e4633ccb8bdd54fdf82645b217b264549ff8736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361881, "uuid": "9f00fd6a-721c-49b7-ae15-5593b8df3650", "value": "T1CBC2C04EB3655666C50D0EB5B2EE03C4CF69A04273832F2DD7145D88BE2FA0B3EE8464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361881, "uuid": "fbe70618-6a47-4eba-8baf-c0a8ac5b57f6", "value": "384:/sGn5I6vQnheNcpQCKzsZ/XsLo1o4Caz9nxN8TPZU+5yrRWGVCz0NvJ1:nn5cheN5v0QoN1zqZU+5KW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361881, "uuid": "1221a0bf-40a9-4c38-b04d-5eb1d9edb853", "value": 26288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361881, "uuid": "a4a04112-f89a-4f31-bfb9-86cf416b6b99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361881, "uuid": "e015b643-7afd-4553-bb68-f01032c2c3fb", "value": "1d66607c6164d6eca4dba55c12e00ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf86902b-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1654353427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353427, "uuid": "6a57f7f7-f724-4378-b644-c72452bef443", "comment": "Malware payload (BumbleBee)", "value": "f04b1b5c47b7aa791006e106ba0256ae", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353427, "uuid": "96558e73-9aeb-4a3c-ad8d-c4f1c7044c82", "comment": "Malware payload (BumbleBee)", "value": "47fa907c50a09bc2fc41cf50afac4e178f7ce51c9592f18335db53976e87e92e", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353427, "uuid": "db19f257-6db9-48bb-9b78-c851beb79967", "comment": "Malware payload (BumbleBee)", "value": "b3e181a44bd112809c879992f4941782b2fee817", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353427, "uuid": "781cc58a-6e21-4fbb-ba37-e2cfc5f0d1fc", "comment": "Malware payload (BumbleBee)", "value": "1c22c35e9d4a42cc1407ddadc472e2e8064ffdaa6a6900301a4a65e2effb94b935859d07e8268f3ef38f93d1a31a145e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353427, "uuid": "ba412a90-1684-4b46-816d-55a45fd035fe", "value": "T19F859F87437BD8B0E3C46B30345826669D3DF23ADADD28ED06D698C0AEE199151DCCF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353427, "uuid": "0cb34665-2963-4228-9b0e-1761b5a18e9e", "value": "8f19232df0e53b49535c9ed7cc5e9bfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353427, "uuid": "7a098e57-c855-4776-a1cc-23a61fd2372c", "value": "24576:chR21kF5kuycCyk1Exl3heoGA/FflpWh+CC3Pn1AhX1EzLs7o7/:MR+YyjpO9/Nmh+t92lEzwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353427, "uuid": "22eccbd5-92ec-4d14-ba39-c953feadd5b7", "value": 1718272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353427, "uuid": "216b8a68-8d27-406e-89c5-d0e3d6f45bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353427, "uuid": "553c31bb-d0dc-4f95-807e-c06b8daa269d", "value": "uplam.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17262631-e40d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654350541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350541, "uuid": "386f3123-2645-4dee-89e3-843f19a994d5", "comment": "Malware payload", "value": "80074b574648fb1879389d28e657c50e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350541, "uuid": "b2d33f2c-5e1e-4c9d-92c6-cd14de82d936", "comment": "Malware payload", "value": "484ca148f597901cbac2b9d3bc3d8344de3132b6c47570e5fe470c684d2fb73c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350541, "uuid": "a058d341-3095-48ef-b50b-e05fbce9380e", "comment": "Malware payload", "value": "320151176c5c1641dfbc4ff659243defd4b6fc6d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654350541, "uuid": "10d1ecde-e5af-4aad-8697-7f2365056e49", "comment": "Malware payload", "value": "90a7653a25888fd05beb4300da4919fc00faa3e9a7180832e4816de30217224a296b794a482a83315cf67921e5da7af3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350541, "uuid": "b7be3c85-7a76-4201-9c83-f2317ce82958", "value": "T1F03393007291C96BC94859364CDAE7EB2B30FCA2EE518B0B32C5771F3C3A685DD62746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350541, "uuid": "225d8c42-b3b9-4cb9-8575-09130268424b", "value": "768:JSQgLeeCOpCLMkDklzFLcVrbCUb3zuaXp32:cQgLeeCOpCLM5FL0tb39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654350541, "uuid": "0bd7e4dd-9c67-4a08-926b-c931a8ffecda", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654350541, "uuid": "415b381d-9eed-4f5f-bc1b-92a1c45d06e4", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654350541, "uuid": "c91d82bf-f8e3-4758-b7c0-c993ce6538fb", "value": "SecuriteInfo.com.Heur.15242.27500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf32cc2-e450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654379406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379406, "uuid": "65419942-91fa-47e6-93c0-d7f71df2f2c9", "comment": "Malware payload (Mirai)", "value": "0902c8d1f6c5d86bb82bd3c5058fb663", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379406, "uuid": "1e559d29-e836-41c8-8aee-eb6954f5566b", "comment": "Malware payload (Mirai)", "value": "49cdb9ce3a5e79336881a5a234d207baedc2b19afdcbb9db8c99ea1335e8eef7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379406, "uuid": "3f5bae8f-20d3-47eb-8974-d2860e67641a", "comment": "Malware payload (Mirai)", "value": "d562db39d91715a6979862f1555f8fffaea32e90", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379406, "uuid": "b60ea2cc-c40d-40c3-9b15-5b8c17c5d74a", "comment": "Malware payload (Mirai)", "value": "8af04f1f51d256b35f8a90e6aa480df3b42e411bc53dbef05ba77d4d531946c1474750baf6a1946cd0ec6c4ac9b3cbef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379406, "uuid": "189c2546-25d7-402a-bb42-9cc358ef226c", "value": "T198D2F1A02B59DD16D821823BBB1F09ED2B7679CC0E4E452267D4C1C172637D8333F6AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379406, "uuid": "09f02e8d-5486-48d0-a39a-7c3932434ec3", "value": "768:70Wb/DEU3MJyBO/p3XEQNlzsecK68+4WxyrW6ZCklmeXI6iDR57:7Jb/DAUOx3ZNxsFN4VH8klTXI6kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654379406, "uuid": "6a2e93b6-30cd-4d74-8081-f4901c398dea", "value": 28972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654379406, "uuid": "34cb4f0e-22f0-4e03-965b-f933ea0d20cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379406, "uuid": "219adeff-1e38-4aef-aeeb-8f92555f7603", "value": "isis.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc42ffea-e3c8-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654321290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654321290, "uuid": "74fe7568-c474-4820-9507-85ba9f856a44", "comment": "Malware payload (RedLineStealer)", "value": "5f42bf85f0f7813399b88ffd3f040a11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654321290, "uuid": "0dc7ba0f-795d-4639-81d4-55cb455ad4ec", "comment": "Malware payload (RedLineStealer)", "value": "4ae9e2ab85203d10c2d5a8e4a236204af82bec2d6aa3bca13772ab7eae2b986e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654321290, "uuid": "7a23fec0-e9d4-43d5-8794-8cd8aedf650d", "comment": "Malware payload (RedLineStealer)", "value": "239db22bb972043162ad49060f5e064f71111072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654321290, "uuid": "d26e341b-212a-4ce4-be52-6a2a3bf7cf7f", "comment": "Malware payload (RedLineStealer)", "value": "b8c192357a5c1e46b182e09fe34a64c9a77967d47602767174c3b5e28e140a4defd508f8a93dd26a0495ae004819a356", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654321290, "uuid": "eea07b04-feae-461e-aa62-409034361ea1", "value": "T131449E49BBEC5899C7AE4BB9F46034E0D7E09602B0C79B9F301516FC1E433A1EE46667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654321290, "uuid": "26ec9f6c-867f-49dd-9b77-8b2e7b301c3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654321290, "uuid": "f0a6af73-e4cc-4da4-a82d-b6738869560a", "value": "3072:psS4wLlcKAnrdtGUBv4h2DvssTx77Vtda5Lqg+QRoGwe1gJs3Dy8Z3nukhgEL35H:psqInLG8vM2hTt7gWQDYyl3ukhgEL35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654321290, "uuid": "4e86dd51-fccd-4cad-9df4-187c7d36cccd", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654321290, "uuid": "98e1e6e8-3e14-40e2-8374-8d6f3389a6cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654321290, "uuid": "3731a511-1587-46f3-822f-9a3c18c71f27", "value": "5f42bf85f0f7813399b88ffd3f040a11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdedfcf8-e39e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654303254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303254, "uuid": "28e628ba-db41-4b06-84e5-69dc058e1949", "comment": "Malware payload (Mirai)", "value": "dfd140c56229e8b68a6d44f83c6d67fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303254, "uuid": "9be48c79-8d9a-46db-9c4d-28b5e88bfa72", "comment": "Malware payload (Mirai)", "value": "4c2e5ebc73c172542a9f3dd48236432c7d726828e631b8b395260d3bb0d918cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303254, "uuid": "8b5f60ab-6e59-4162-b65d-804d3ae69b7e", "comment": "Malware payload (Mirai)", "value": "15d7a5edd1e590232770d788ffd9c93506d7c0c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303254, "uuid": "cb0ad501-3928-42f3-999d-21d01abef1b7", "comment": "Malware payload (Mirai)", "value": "52f04927e1bc5c5a2cc32fe5c27a1bfecdcf96afaf86429d311b64b22ab606d5a1bead4fec5a0db87b501aa1e6aff426", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303254, "uuid": "3df4b268-25da-4245-9e0b-5eb00a11b1af", "value": "T19073BF72C41C6C58D1694675B9A089785F63F408919B6EF60AE6C71B800BFECF61D3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303254, "uuid": "b4055a52-9871-404e-a712-13b2b7406ca5", "value": "1536:ne0/zJbJ9wsEma4wtKQbqOI6WVMzybsaKjSHrqI9wrCG6SFOhY:nrrJl9hXP4bbINMubuj/I9wrT3eY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654303254, "uuid": "bf98ffaa-71cd-479d-adf1-21eeada69acb", "value": 79712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654303254, "uuid": "2f12e6f5-4931-451e-b2bd-e2a55ed145d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303254, "uuid": "cb23d534-eb09-4d12-ba9e-6e1d74923494", "value": "dfd140c56229e8b68a6d44f83c6d67fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b3ad4e-e3d6-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654327210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654327210, "uuid": "9bd2229f-8e19-461e-b592-b41e57b4bf53", "comment": "Malware payload", "value": "d6520eb576c4a6611d350b137125978c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654327210, "uuid": "3e9eee48-5b49-48cd-ac34-acff9dfa55b5", "comment": "Malware payload", "value": "4cf2a67878fe03e299fa5089554051c1aa963f9477b0367a50919fc45331eb7b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654327210, "uuid": "38dfb9fc-959c-4ecd-8e2f-b578760449bf", "comment": "Malware payload", "value": "0cf914512f17fe00d97868c9b9cdbd36b61d5431", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654327210, "uuid": "77d4b242-c15a-49e6-ac06-51ce81bbea76", "comment": "Malware payload", "value": "9f4b6bc522fc63469f7c02a46c2148d17f13203b6b511e054ed8409ead7a8737d4c2840933af752cfcf19622fa3bb17e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654327210, "uuid": "1b6791e4-0271-42b4-af3e-3794fc2ee9eb", "value": "T1ECD3F16ADA850671E5140730FCDF8B960D1E3C11CD1B557EB8AAFBA904F62930BE6F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654327210, "uuid": "ac33b8b9-da5e-4436-b056-472504d1d3ef", "value": "3072:gzmpiGHMsh1+54ldm5evMpZHN2CN8bdwIG8gooMetdGzo3C:piO1SZH4CNoG8goFetdGmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654327210, "uuid": "800315cc-c7cc-4c63-b900-2c114b7ba68e", "value": 139368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654327210, "uuid": "5d9141d3-986f-4398-8ff8-cb93f051a795", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654327210, "uuid": "abb6f201-48eb-4ac9-8ef1-8137e8a25e3b", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1446af4-e3a1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654304495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654304495, "uuid": "3e867d04-7bd8-4988-aa51-ea716e5f34c9", "comment": "Malware payload (Mirai)", "value": "bbd68e591245023058622a1c3fbe8c02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654304495, "uuid": "4df6734e-5b33-4ef0-abe1-3e6fed5c2ffe", "comment": "Malware payload (Mirai)", "value": "4db1966b0e0c6bfab9fb16551eb4d14921dbf3b522467829cea99fa3afc7a1ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654304495, "uuid": "b6b8e5eb-34f6-461e-8f31-7592eda74aa6", "comment": "Malware payload (Mirai)", "value": "877cdcaffb2fd9ec4947391e5f9ed1bd44a42392", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654304495, "uuid": "a451f72d-2e50-4528-be5c-a9dda4668e81", "comment": "Malware payload (Mirai)", "value": "2fe73f358a6c01b1789ddf71749c364b42f79df2df0d7a7d810bc38065d83417d68a5abbce3bc8fe0b19909f30a796c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654304495, "uuid": "8dbc37f2-dc4c-40f5-a305-daf1425ce875", "value": "T192A32956BC818A11C5C512BAFA2E018D331367B8E3EF72279E14AF2077CA92F0E77555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654304495, "uuid": "3b5eb9cf-444a-4fcd-84bb-ef09b28171ac", "value": "3072:HfoL1H4LNJVMnJoEuoz/TiyWa/NOteDDHH+kD:HfoZH4LpMnxuw/xWalOtbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654304495, "uuid": "0a88fd5c-1a73-493e-b35a-9f0b486b4398", "value": 101292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654304495, "uuid": "cda68321-d5f7-4561-adf2-df2b642ba1b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654304495, "uuid": "6a611b12-2a4b-424a-acd0-eb7bc6ef44e9", "value": "bbd68e591245023058622a1c3fbe8c02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4714e9df-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361788, "uuid": "f554c8d2-c3c0-4650-ae53-5ec4c70ba680", "comment": "Malware payload (Mirai)", "value": "773852cc66bd431a750504646db07687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361788, "uuid": "036846ce-eeb1-45ca-acb0-0297b34b790a", "comment": "Malware payload (Mirai)", "value": "52fab53734c450b6ce34daff20631d0db5c8a657dcb86a38c744f7b8cd84c4ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361788, "uuid": "b089dead-0fa6-4af8-a93e-5163c80344f2", "comment": "Malware payload (Mirai)", "value": "578df2a21203e623cae6fbd20266627371c2e98a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361788, "uuid": "a9718b0b-2ce0-42ff-811f-7c222d20ffc3", "comment": "Malware payload (Mirai)", "value": "317deb4c0fece1592ef78511b9d84eb387176bace944cda7c8d7c71e9ae36e72d527511b604c39d864d527e9399f9ea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361788, "uuid": "a426167e-5c79-4bcc-9c09-cb55c1c4542b", "value": "T18C338C7685A89E98C62085B4B516CE385722F004866B3EFBD784C791E00BEFCF1987F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361788, "uuid": "e13b6e92-05ad-40de-9a17-0ddd30f7ebe0", "value": "768:7aTaAejehjeywvmO1KN1ddFuqMUbzofs3I+qn8vG19CMQodWzIkCvC:7a/akjFwvS3FuqMoofs3vqnW83djkCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361788, "uuid": "aa97c03f-78b7-4cc5-9461-77d7e78e23c8", "value": 52712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361788, "uuid": "8f12bf96-d779-44b8-acde-9ca621fb6a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361788, "uuid": "34215439-3711-4a89-9942-f520889b2ddb", "value": "773852cc66bd431a750504646db07687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4bf800-e3e9-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654335225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654335225, "uuid": "93c2a3c3-7652-4a1f-a991-2161a9c5fcb8", "comment": "Malware payload (RemcosRAT)", "value": "7d3c6e0dc9276cbe01540ea5f86c333b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654335225, "uuid": "09d5281f-2830-47dd-8bf3-2a7d909f7860", "comment": "Malware payload (RemcosRAT)", "value": "5846f8d9e5caeb811b302cf2742e0747b436d891d4803d8ea9f98e6e8125a94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654335225, "uuid": "d5095b29-7880-4d8a-9c2e-1a839f321c33", "comment": "Malware payload (RemcosRAT)", "value": "aa33ff0c9b3c6d894e2070b3ef049db14c58adda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654335225, "uuid": "4651ee76-853d-4628-9bed-3a48cea485d1", "comment": "Malware payload (RemcosRAT)", "value": "ea4f8a64ec8d0729b881d6b447d7c1e83906d6a3464f979116b4569edfe37d9ba509149bfe4f1d2f1ab96c82947cc707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654335225, "uuid": "0ee7244d-5dec-4f38-a5ea-af72ee1e7aa3", "value": "T1E9156C25E391D4F7D33A05389D57266A2E2ABD10EE58184D3AEC6F1C2E342416C2BDF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654335225, "uuid": "f1a7337b-e01a-4f89-a414-dcba5329dd6a", "value": "3e48bf6577602f80c1272235d4172ce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654335225, "uuid": "17555936-d000-4f7e-874e-373a7e12511a", "value": "12288:zDzHKiH6ZK7o81KuTXiBRkjK7mcxyq/DU0dg99iaA5bX3+oTHQ:zfqbi/KuTSBRkjDiyq/YkN9H+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654335225, "uuid": "9df94445-ed0f-4a79-8996-7ae281b96c6a", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654335225, "uuid": "cf405985-649a-47b6-b590-1931c301b28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654335225, "uuid": "f8f89157-82a9-4502-b089-13fd42817abf", "value": "SecuriteInfo.com.W32.DelfInject.EJ.genEldorado.27793.30115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9b0357-e461-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654386606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386606, "uuid": "d2ce5a0f-c21b-4ee4-b3d8-f48867d8c738", "comment": "Malware payload", "value": "bc63840ce86c966da01505c2d375212a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386606, "uuid": "177452f0-4981-424d-bd24-be094edfebe9", "comment": "Malware payload", "value": "589aabb1144a81978ba4c31b505d538b1e884ddb755793701fa96e2a41d77505", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386606, "uuid": "2b30c372-41e4-4f42-878e-fc21a7cfea10", "comment": "Malware payload", "value": "af39f78c5ba934cbb906844a4f2f95fa7e600dfc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386606, "uuid": "9f9a221c-1264-429a-b417-77dc63aac641", "comment": "Malware payload", "value": "4f123619a750d5b21e3e7b16c86be25c6908cecc7defa76b1828ed90a0e4e0d6475e76fef803c8c08e3cfa59e9ee621c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386606, "uuid": "f20cc9f7-a59f-4f5f-81fb-4f84beaf3e92", "value": "T138B30945FD508B67CAD215BBFB4D439C3A2B176CD2EE320399196F31378B95B0A3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386606, "uuid": "b307c605-a1f8-4b64-980c-7037d984ab49", "value": "1536:0xxAyKbtjRvDcNk0UyhTmNQAkn++sWHahl3Ewywlk2mstL0WpDSnQHOW0vzvZ:0xKyWjuNk03qNIxLHYyNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654386606, "uuid": "a689eea7-d92d-4e15-8a5e-4fe214e99138", "value": 115940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654386606, "uuid": "15aee362-1a50-46de-9f32-b247d71953bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386606, "uuid": "f0ff0318-91b5-46d3-9564-199960a23328", "value": "beamer.arm-20220604-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470f88fe-e438-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654369090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654369090, "uuid": "a8d9a203-25fd-47f9-9775-15dcdd936741", "comment": "Malware payload", "value": "fc81edd28db937a188ec6f9f8b6b3029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654369090, "uuid": "4d1f704a-110f-47fa-93e0-5d8d35f425ff", "comment": "Malware payload", "value": "5af4f4f3b00e7b215432c843c69ee987abf26f61fff18c206f9a8114726786c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654369090, "uuid": "0e51bf94-d768-428e-aa10-4a6b7fcd4c4e", "comment": "Malware payload", "value": "4399f06d1d2c76afa8bdee7aab55850866d171b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654369090, "uuid": "978616f6-c88e-46d7-9724-b322b029c66e", "comment": "Malware payload", "value": "e78b95c48ceb7fa0e16a4b74ee9124004edf71d7b069ea1c707f2dada7957a3f28f690baf86a766a8e5da3040d0d5cc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654369090, "uuid": "222c5876-f8eb-4a09-8a17-0591087563e8", "value": "T11884F121B3F09071E1F35A3468705B512EBF7D136A3081CF6BA4272E5EA57C2A9B4397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654369090, "uuid": "7e48a794-99a8-49f7-a679-15454b84f0c3", "value": "b8e78bd73afb771519a38767f795e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654369090, "uuid": "200d70f6-b1d4-4489-8b7d-5f630eb97747", "value": "6144:ox/QDrxzCcNHyRuNuLGCpTHMlPsa2+n77Jhdrh0HNkmvay:oxOr1RNbNuKKMlPp13r6Ckay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654369090, "uuid": "1c37c009-7f45-45c2-9b71-49a06c5a4d64", "value": 373192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654369090, "uuid": "64c9da7f-dbb7-4a19-a29c-337734183d03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654369090, "uuid": "c977ead4-11d7-47e3-9cd4-87b35a58edb6", "value": "fc81edd28db937a188ec6f9f8b6b3029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b2f4d0-e414-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654353570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353570, "uuid": "ff3264d8-ac30-4c77-ae4c-26ffdc8018a2", "comment": "Malware payload", "value": "7e7d66378813bb804f819d9823746e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353570, "uuid": "7da904cc-db96-45bb-9927-5e520b7b9de3", "comment": "Malware payload", "value": "5e8bb9cf9da6b05a04a2a65749931534c55992715cab51d79ae070931078a508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353570, "uuid": "a174ef7f-e79a-4207-87fd-88f1f4310e31", "comment": "Malware payload", "value": "39cce762766bd837cc818774110fc02b9878ac02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353570, "uuid": "e78af24b-5c15-4678-9065-bfdedd96b353", "comment": "Malware payload", "value": "da88e0b7fc841b60a4add08799459d9fb7997cb7b49a4667b28ac987d6c95954a062bdcf6eb0ec6a9047c5f1aa205f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353570, "uuid": "2965ebf1-c08e-497a-b742-2307365693a7", "value": "T13195BF12FB8285B2E9870175616B5B7F8D3A9B249328C9E3C7D11D758C212D1AB3F3D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353570, "uuid": "eb5664ac-bf09-449f-8722-f097d4a69cf3", "value": "98c0f0d8f0772527ae47ad42fd715da3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353570, "uuid": "af406c97-8f38-4aed-8571-5c61a010be12", "value": "24576:7+KpPLltIzkQ2OZ9Mm8Zbkz4iqsPpUnh9QRJ8+XXiZ5Ijtxpk9LkBG5L1QOduGfF:/5MGF0q4WUDpe3CPSo10/8Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353570, "uuid": "692c836c-2540-4392-af30-f780342ee21f", "value": 1991680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353570, "uuid": "bc5c94e1-bc39-4d13-88d0-2080282c33c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353570, "uuid": "3c951e75-6e6a-4202-824e-52c9909060d9", "value": "ransomito_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a3b3d6-e42c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654364125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654364125, "uuid": "f1952ee6-aa4c-4210-b9ed-c98c2902d198", "comment": "Malware payload", "value": "f67b7072d2a53fa618394b579edc7c09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654364125, "uuid": "4f2f1333-f156-4fe6-98b1-b2450aa8eafc", "comment": "Malware payload", "value": "604ea692ed8e041b45cf1961fb7439e269720de29f9052bf081b71767506a92e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654364125, "uuid": "f14cd679-c316-4313-9310-18af86f43398", "comment": "Malware payload", "value": "ea421fc28d9e291f2654506a9b9814fc393d1a30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654364125, "uuid": "c1ff343f-4610-4629-8ff8-9b7848e4205a", "comment": "Malware payload", "value": "09d05c662b0c3148d1e9578b761c092b6bf4af318c37f69e566b1cfa875af928ee6ef0416853300f76b09cc942afa525", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654364125, "uuid": "cb747152-6f45-4d9b-b1e5-f897d2a24774", "value": "T1C76512C33ADD4336ED8A7A3A003199233124FF84B72665663F72796899B3AE1DD30355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654364125, "uuid": "6e64aab9-edb7-4fb9-ab9b-4f1f640e2513", "value": "cd43202d52ad2b833bf98ae882b64415", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654364125, "uuid": "01d4c9a9-68f2-411a-b4ce-80d5ccd4ec96", "value": "24576:rtWrRFMaIRHBUXoi4h5vG10CF1Y/5sHzVwCfAp93+T5ntptGXV:5WrzMaIRhSoi6u10T/5aVwCfApmvpMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654364125, "uuid": "a2e4a743-71b5-46f8-bf91-30a4639fe178", "value": 1523640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654364125, "uuid": "069f5d77-7f98-4399-a5bc-bf4f58c5dcbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654364125, "uuid": "c771d489-8825-409e-99fe-e42b0abfb98e", "value": "f67b7072d2a53fa618394b579edc7c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c2ff94-e443-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374007, "uuid": "d1de53db-d941-4614-8b07-0b3f6732fd88", "comment": "Malware payload (Mirai)", "value": "8c4fffa9c7e3e32746f964b2d148766b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374007, "uuid": "586910fb-4742-4a30-80ac-a5b0b04e1703", "comment": "Malware payload (Mirai)", "value": "6281ba2b3ccac5261db9ab929c6e3db704f235be64feb2760932eb78a72c0f09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374007, "uuid": "18542c02-4ae2-45f4-ae32-c8a9ecad2367", "comment": "Malware payload (Mirai)", "value": "541361928f267f2f7714d0f057a0a70da3573eee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374007, "uuid": "29c9bf15-0878-4e79-9a47-99914804ae0a", "comment": "Malware payload (Mirai)", "value": "3c1b40b269f3dfad264216d96632459aa67efb09fb1925cc2d87c294b5540d4d9c8e6be1bce7c3f5c0c817bd5e6b8f80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374007, "uuid": "a8001a58-86a5-4d86-93fd-b522798772b2", "value": "T171E20981B32C0547D4B62EB4357F1BE0D3ABAA9220E4E389751F9749C472E379906D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374007, "uuid": "e9a50522-bb5b-4455-9472-1b101eec2240", "value": "384:w6ah6odtcHpsqrsNFe9eWBfxAjucN5SwiYJgbaNhBtsNqyoaHhg5zWP28JPZY/OC:LuXdqWl/UHcj5N5yaHvyRHSx8JRY/oAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374007, "uuid": "d0f68741-17f3-448f-81d7-33aea94e9640", "value": 33888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374007, "uuid": "8441df81-ca8b-4963-9b0e-6b0c2dba12a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374007, "uuid": "013af099-7311-4901-a5f5-39c8496a2f5b", "value": "8c4fffa9c7e3e32746f964b2d148766b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eee5386-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654331710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331710, "uuid": "bf364003-106c-4a9a-bc68-58e1e72c29b8", "comment": "Malware payload (Formbook)", "value": "ec27cc107bbd507062b1846097f50494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331710, "uuid": "416c7be8-c0c1-4f7c-90f9-273de1432ead", "comment": "Malware payload (Formbook)", "value": "6380291d3faa6bd28fb5d0adf2716d707d72154bf048316bcf9ba663a56da686", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331710, "uuid": "5a7655ec-d391-4292-9112-3f1b15ad1add", "comment": "Malware payload (Formbook)", "value": "9efbd447492e2a9e6c14d252093509223d107c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331710, "uuid": "98469240-d11d-45d7-afdf-cfe5855b4e3b", "comment": "Malware payload (Formbook)", "value": "b0ea608337b58b98326d70e8ede0d51ef2fd394b776bb6079d1d68dbb008c29a625f5537aba57a733b5c518cb8eb21f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331710, "uuid": "50f104b4-f163-4976-93a2-72b483df6e55", "value": "T1B2B509039A8B0E75DDC23BB461CB633B9734EE30CA269B7FF609C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331710, "uuid": "160fd670-b622-48ff-a763-445e0d67860c", "value": "1c09d997bba3225142a0281004608efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331710, "uuid": "1319dd70-5794-49fa-ab10-e0993ccef58b", "value": "49152:nMjHL9CTy7Qjj2pIHoa4/cFI4+IChcgCEBr4:nMjHL9CTiQjj2pIHobcQLhf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331710, "uuid": "f5a366f3-e00d-4265-93b4-c69519da6f7f", "value": 2398082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331710, "uuid": "5dca4667-7acc-43cf-84ad-6012349f285f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331710, "uuid": "5a979814-05e9-4e40-aadc-eb8b1b477c7f", "value": "Injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5342c126-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361809, "uuid": "19907ac3-07cf-4d74-b21a-16b1233f24c0", "comment": "Malware payload (Mirai)", "value": "532166809828a95660b1cd5508d12379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361809, "uuid": "08fca1f7-4240-44aa-a013-898daab572ba", "comment": "Malware payload (Mirai)", "value": "66cdc0461c42120457ee55f250ce2771ad83c68e7d47a1471d463cc55582432e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361809, "uuid": "1d95608a-43c7-4ebe-a08f-16a2558e8c12", "comment": "Malware payload (Mirai)", "value": "8c61e167938fc20ffb902906bfc807433d53f128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361809, "uuid": "267c6f48-933f-4557-ae52-dd5e783534a4", "comment": "Malware payload (Mirai)", "value": "31502986ffa2e89610e2a8abd5b9ec3da9c8cf8afdd5449e97bfaa121ee9e60a09748243c0905c6609e95e6db3cba9ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361809, "uuid": "5cf614ac-c4a2-43fd-af32-33a1852e4352", "value": "T17E434BDBB402AD7DF99FE6BD8023090DB93072205093072777A7FC93BD322689956E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361809, "uuid": "191eda2f-eb74-47f8-89b7-cb8f471d7a6a", "value": "768:ZKexZ0heQrB5z0UlJVWrQMnjQQ4O4gFHujkuE2SQmSoCrq5i9C3Vm8Y40e:YqqUr8ZuFujtE2PoCrqI9C3k85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361809, "uuid": "69e45233-c17d-42c8-823d-90ec18261802", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361809, "uuid": "57a68cf2-b961-40bc-896e-209694319065", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361809, "uuid": "bcf6eff0-fd9b-4b89-a28d-387c22e7dd07", "value": "532166809828a95660b1cd5508d12379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1a992c-e428-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654362309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362309, "uuid": "264fb33d-b0e9-4802-969d-4f61f9186d8c", "comment": "Malware payload (Mirai)", "value": "e811a5e2d3c731902d3c47056389db3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362309, "uuid": "b863fb29-4445-44a7-be68-c88d558a601d", "comment": "Malware payload (Mirai)", "value": "6783b3b95fd4737a356f5861ad60a5bb1a07c278b17b79e259575cf33eb32186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362309, "uuid": "2faaa0ff-d116-45b9-8d63-3da5e7b4cb48", "comment": "Malware payload (Mirai)", "value": "1a3e5d866b48a1b54631240e624330b55eb192a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654362309, "uuid": "eae41160-66d9-4ccc-9dd9-4338ef7d10cc", "comment": "Malware payload (Mirai)", "value": "d6af2eaaa98d91f9e701ce3426172053a146c2f69dd366c75f7eafe4e01d3ecb7d9b45f2cda69e822b13083f36e05a0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362309, "uuid": "02778f33-07cd-4712-b0c4-104d3465fbcb", "value": "T1F6535C34AD392E26C0D4A57E21F78365F2E6234E65B8D61D3C760F8EFF14A8068172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362309, "uuid": "e177beb7-c1b7-4807-9823-ae4d0c08ed9d", "value": "768:+VoUo3KSybT7h6pbaeoH4+Y5ZcVpKcogAWsyoU9twd8U4EO3mO+WGyz:+Vno3KSybT7h6pbaKcVpKBgAvyHfZkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654362309, "uuid": "b7182722-8995-400e-aebf-8b9187a7ba43", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654362309, "uuid": "d48cfa0a-a0cd-46fc-ad5b-f93ac6ead54c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654362309, "uuid": "990bb352-4fcf-48cb-b63d-129d1e05b85d", "value": "e811a5e2d3c731902d3c47056389db3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50d04c61-e399-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654300816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654300816, "uuid": "04026305-0e9a-46a6-bcf3-836304065c09", "comment": "Malware payload (Mirai)", "value": "8ef72d8b288ff383dfc06a0b489acfc6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654300816, "uuid": "8e802672-6b79-4c5a-b04b-ed51f6430419", "comment": "Malware payload (Mirai)", "value": "6af60fffd712b51b5f86bb94850098aa6e8e6511ba53eb1d255f69a7e4861003", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654300816, "uuid": "b36ce7d9-4d9a-4ea8-9d8b-ecc9f037d690", "comment": "Malware payload (Mirai)", "value": "f6f11d2c7004cc1c2abc8b1dcdb4ad750794f64d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654300816, "uuid": "d27c4fd1-c1fb-4f88-b45b-ed30e9e0d073", "comment": "Malware payload (Mirai)", "value": "065dfd8a1fb52d2c89fe00c7db1f354988872cbecd9f73cece06b65e953fbef6596df4f71e663cfc1078a2cbc04c08dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654300816, "uuid": "f83127e6-9aa0-4581-96a2-c7ba86aa8307", "value": "T1DD935A52BC818612C6D522BBFA2E41CC332263E8D3EE32178D256F1177CA92F0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654300816, "uuid": "38f8f50f-0431-410a-8f0c-e6a4a729eedd", "value": "1536:+v3WgcwUVQKaBUoZnDJLaUJj6cggRwmwi8830AwAGiMXKSU8pgDJoQ4DKvoOovzI:8mgcwUVV0J5jtHRtd0lAdN8pgDKDQQde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654300816, "uuid": "0c673b14-498a-4c79-92db-445f63b57c6a", "value": 92496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654300816, "uuid": "3674de83-713e-4d4b-a48e-1f622aa61d6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654300816, "uuid": "5688841c-66c4-4133-9e5a-7e8d11cd7c34", "value": "percarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b174b57-e3c0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654317584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654317584, "uuid": "f00765ac-112e-4c62-8288-846806e29c50", "comment": "Malware payload", "value": "84c3df26f305fc5be6d79e2b821b9f86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654317584, "uuid": "0583a69c-5fdb-4292-8e45-14f2fb2324d9", "comment": "Malware payload", "value": "6b36c4bddb7d130bd1b1b5242d62e5e30966f4502fc4823fa7e0c4c81ed05410", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654317584, "uuid": "8d350b81-a52a-4627-86f5-cc34e486dc6d", "comment": "Malware payload", "value": "5cce13f76990d2669a79d3b040b7fcb8886aebf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654317584, "uuid": "16b355c2-4b22-4847-8363-ef502a02a5f5", "comment": "Malware payload", "value": "566bcfc7dffe6c2a290a5df0eb8d9f2ac6e3c91643147e388246c5e1a60836db7c8678a881a94085a598da0a04e5168c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654317584, "uuid": "1567417e-e57f-4979-a984-91fe867da44f", "value": "T1B6058C22EB50B929E9A3083D47D843255A7E41B3339162CFBB4885FC5E7D6E2B03479D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654317584, "uuid": "34a4f48f-8196-4587-a651-59dda2e5fba5", "value": "c84c1027327b354a17f1cc3cd5f25f3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654317584, "uuid": "60eae606-b86b-4552-96c7-419d377fd7b1", "value": "24576:kMSouSFSf51/gA2ZYW+AQqtgCIfRUBR4iET:kMSouYSf51/rWYW+AUCIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654317584, "uuid": "a6e8f1b2-075f-4793-a985-d202b0a6018f", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654317584, "uuid": "88d74acb-6e98-4db0-8f6c-4e2bdd2dee0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654317584, "uuid": "e464face-f8f2-46f3-bc10-271b4a4887be", "value": "84c3df26f305fc5be6d79e2b821b9f86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70343627-e3f0-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654338235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338235, "uuid": "6862a0a2-e024-4cc4-be0a-d65fc558d042", "comment": "Malware payload (AgentTesla)", "value": "ab16019f6de46dc8df86535f8e32c6d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338235, "uuid": "f3862920-1d3f-4a92-a5b6-65fc21a76b11", "comment": "Malware payload (AgentTesla)", "value": "6c5c691b8220592e29ed077baccc2b85fda2a851e96655aae685e5918becb087", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338235, "uuid": "a8b692e6-c530-4da8-8eb5-9e62581a6212", "comment": "Malware payload (AgentTesla)", "value": "701dd0536a0d551a2106bd77d54dd0279b45f6ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338235, "uuid": "4ae24a61-a360-4cf5-8c4e-6f80f16824f4", "comment": "Malware payload (AgentTesla)", "value": "c96c2bb12685faa8b97fc2a3a1b90dac181d5d35b3f699347eeec9ce7c7b39d2659c5ded6b858fa66fb1b1b6ba7e9b55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338235, "uuid": "b20cf2b4-b07b-4b7d-aeb2-9fb24c1bbc57", "value": "T1993582983319BDBEF857E0719A581C64BA5838BEA3CB414F901F519D991CA47CFF08B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338235, "uuid": "0d3829e3-ada3-4733-a161-d65fc1417992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338235, "uuid": "14746f37-5058-4abd-bac0-01fb39067784", "value": "12288:PIcw1pNcax0F5+htb7lPwYzgmF4a1liyk5M5Aaec6UdYVmU/GZoNid79fV2CStc7:wLncax0CJria2EG+oDOwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654338235, "uuid": "023948e0-033d-4fc2-958a-1ff894fa5c52", "value": 1129984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654338235, "uuid": "fd4d4d45-7c07-4940-a6d7-bb76b499780b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338235, "uuid": "d3e38f6f-8456-48fd-b98d-bf57d0841114", "value": "Payment Details for confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eed10e9-e461-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654386605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386605, "uuid": "efac0bae-eec6-4020-a3d0-6a3c0a81ce5b", "comment": "Malware payload", "value": "80f7276722e926aa18fe00f525b4b7e8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386605, "uuid": "c5ff7d3a-2f7d-4ea3-b4ec-b1b6a2102e65", "comment": "Malware payload", "value": "6f671fab1268f8907b8c3bf0df7ab8a225e84f38ece0154da9ac3d9e83ed9a10", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386605, "uuid": "a341fd06-0403-4d7a-bd93-ec822c7924ed", "comment": "Malware payload", "value": "b1cf870bc7f156169ef7fb0f54f429ae7bf3bd35", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386605, "uuid": "0b0af597-8e84-447b-9c8d-663752dfda79", "comment": "Malware payload", "value": "20f65839adea0f2be29ec7b4cf26bc885e7b2d540134877b8b5a4e3911650605584e6390a0eb5aa65efdd85823681a1e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386605, "uuid": "6bc2c88d-76f0-44e9-8a51-4d681feb1b9c", "value": "T1FDC31A06E7904F17C0E21BBAB6EB82113363DB5493D77306552C6FF43F86AAA4E27506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386605, "uuid": "5ef07990-0cdf-42d2-b694-42bb88b73ce9", "value": "3072:AM6Xl2cawp7dPxeu5x4+3uvaWSM/9R8I8amJwo27xV:16XAcawp7dpen+3uyZM/9XmJwo+xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654386605, "uuid": "cc0aba58-fbc8-4d86-8d26-5c2ca61f88a6", "value": 129734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654386605, "uuid": "1338f1c2-3546-4038-a07e-b89992c8498f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386605, "uuid": "83791501-581e-49ba-949c-9ca09d7ab27f", "value": "beamer.arm7-20220604-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e395a8-e3aa-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654308213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654308213, "uuid": "c3ad908f-e81b-4672-9f4e-828c8b5f9da3", "comment": "Malware payload (RedLineStealer)", "value": "adb6d5ced90e10ca3b293c59265beb15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654308213, "uuid": "45455df4-9a94-47b4-b5de-55f4d6feb88e", "comment": "Malware payload (RedLineStealer)", "value": "714ba1e4369f152990e8a9ec9b2e214a46f18185e8e5f6e6c1f480c277e5c077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654308213, "uuid": "fda6b307-9a3f-4c01-89f0-d211718b0761", "comment": "Malware payload (RedLineStealer)", "value": "ac4be1c62428a774d4c9aeeb3080dcf2ea646240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654308213, "uuid": "bc27a88e-c71f-424f-9c4d-31c83d24b96e", "comment": "Malware payload (RedLineStealer)", "value": "aaff3971ed386992bb2fb714f5b933184f65aea4dd7337a75cbd2d659b10fce6a2f4885d722400da1efd97303da978f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654308213, "uuid": "89d40035-3436-40b1-a5e0-4bd7701bdb39", "value": "T1DF449E45B7EC6D14CBAB8B71E4B524E0A6F19A12749BCB5F300819FD1F563B0EC061AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654308213, "uuid": "6b88646c-4d88-498e-abb2-c7df04a3d063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654308213, "uuid": "2d3848cc-6818-4092-a96d-df3e6730402c", "value": "6144:S35JbOkGnYRFZ13xVQGNFgYFoYg3JWgqh2ELl5Y:S3XOVE1DQGjg/DqkEB5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654308213, "uuid": "f5bd0493-e7c1-4fa2-9626-f68511884a00", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654308213, "uuid": "1fec5da9-8cb7-4114-8a9a-de77175d8c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654308213, "uuid": "db842722-72ab-44ae-92fc-0b516e270c72", "value": "adb6d5ced90e10ca3b293c59265beb15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85901c14-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352874, "uuid": "adbe4cff-1aed-41d5-8198-b3efed20cc03", "comment": "Malware payload (Gafgyt)", "value": "b0e994f3dd19ee7e5429f9a6f693e810", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352874, "uuid": "3bc33bf5-0fc7-4ac5-ba49-31c0c37792fc", "comment": "Malware payload (Gafgyt)", "value": "71fb99bd3551f7fd093473ffd693dfa574987152a3962b83b5200fe3f7521b8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352874, "uuid": "f4519f5e-41b6-4fc1-a129-160dde2deeea", "comment": "Malware payload (Gafgyt)", "value": "5498a84d6e22819800d4505b5989d9941d5374fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352874, "uuid": "e4841565-bb47-40a1-ae77-9c32d0d5b521", "comment": "Malware payload (Gafgyt)", "value": "7814b5c8f6eaf80200588ab4f2225d1717aa0ee4ac9d4f94d97a26adee84b39241d4b1381ea6a1da70187545b231d028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352874, "uuid": "ae298fbd-5d47-4924-b039-92e2cf294154", "value": "T167B3C86A7A21ABFEE06883310BF3AF20C7D525D626915387F15CD7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352874, "uuid": "9b6a72da-a5db-4e68-96e4-e38678bea716", "value": "1536:eTrPtrihiuTMiaW2WviIHDL34bg/R7pa/K6ewmzrW5hasIlkYVKdwwjF9GhCPR1L:Uov17pa/KHW5haZukKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352874, "uuid": "547a53d0-b52e-4f54-9d26-f705933299e1", "value": 116555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352874, "uuid": "1b76a977-358e-44c5-8357-e8fc82f03a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352874, "uuid": "3f73c5c0-01fa-4442-948c-bfb0da5bd0dd", "value": "b0e994f3dd19ee7e5429f9a6f693e810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417f80f5-e456-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654381965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654381965, "uuid": "56ce059a-6437-448d-b090-71310ee2ad4c", "comment": "Malware payload", "value": "0cf59a20fd91cac0ba05319d4284bf5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654381965, "uuid": "43a19c03-04e9-492d-9401-16a5c3873c21", "comment": "Malware payload", "value": "747d15591135310051e2332dec62c00228ea1b8ce8701cc5b020563f452ad645", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654381965, "uuid": "5ee65fd3-70ff-4358-9d23-1fb362eadb2c", "comment": "Malware payload", "value": "c14b87d80baa881a6b115af7bad30b1a3f3916a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654381965, "uuid": "ae05cb25-f608-49e3-a300-64677c098abe", "comment": "Malware payload", "value": "d98174020847c7bb925314895c70aa3ba8cb8a5af2b7624c5805867ad74d44ed23f48824dd4d2fac4480388474e0d30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654381965, "uuid": "4d59f5fb-fd35-4ec5-a56b-3d138857cf28", "value": "T19A84012133F58032F2F346746471A7646D3FBA573630824E2B54166AAF61BC09FB939B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654381965, "uuid": "b648e368-4555-4e5e-be6e-3cafc75cd7ce", "value": "b8e78bd73afb771519a38767f795e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654381965, "uuid": "5ee6ec7e-aa2c-40be-a64a-0d8c2d55c4bb", "value": "6144:dQwLB5IoOVqZWgF69JQ1mAO6gRVV2OJLBdgelYCp:SwVBNqqXFgRVV2eV+eyCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654381965, "uuid": "e15f37c8-dee4-410c-9a2f-9f4ccea9437b", "value": 372680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654381965, "uuid": "e3b544e5-6da2-43ed-8114-d40d5dd51e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654381965, "uuid": "a83aa799-8efc-4392-bce2-3bd4fce5818d", "value": "SecuriteInfo.com.Trojan.Heur.Hype.wCX@a4HytffK.12469.3071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5a1677-e443-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654373986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373986, "uuid": "18b026a6-9291-4d6c-8a6b-8af3c09ad75a", "comment": "Malware payload (Mirai)", "value": "38cc32bd33d9f3bb5f1c42edab06ecad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373986, "uuid": "8e250b80-96c4-41f3-9986-d27a6352be01", "comment": "Malware payload (Mirai)", "value": "774d059ad7fe95d15900601fe663a5302492cc8defb1af6b9b4f044bfa78f6c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373986, "uuid": "a714cecc-4cdd-4ec4-99e7-4240e23eccc3", "comment": "Malware payload (Mirai)", "value": "604b4e8488ce4361d7ec8c6a842711c7df5441df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373986, "uuid": "4c43f22e-b66c-4d1a-a769-3c36449cffef", "comment": "Malware payload (Mirai)", "value": "d4fe19b7d689244752412d145edd66bccd927b3b41ac139cb93235afd22c4ce3d407156dd7a09368af576fb677d94d4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373986, "uuid": "4c37f07f-f22a-4311-8b69-9053297cc348", "value": "T15B33940ABF614EF7EC6FCD3745A41B45348C641A22A97F76A934C828FA1B50F46E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373986, "uuid": "42d50464-a683-4dd5-919b-927a5d889920", "value": "768:NP843rEFrv1AvLkUq20zKbceQZe8YeWBFCZQJg6Xi26xn:NP843rEFLWgUJQlZZYtB4ZQJl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654373986, "uuid": "d946e529-8f4e-4ab0-b1e7-86b971533fb1", "value": 51176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654373986, "uuid": "336d986f-a552-404f-8b78-00c0ae45bd66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373986, "uuid": "ba75ee2a-6069-4471-ac50-445403994c0f", "value": "38cc32bd33d9f3bb5f1c42edab06ecad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4151ed1-e39e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654303238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303238, "uuid": "93492f9e-3f34-452e-8ba7-386822af94e2", "comment": "Malware payload (Mirai)", "value": "0dfde039eb73b36ca4be940362638c30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303238, "uuid": "55e68e5e-8467-4950-b0d4-539ae37f113a", "comment": "Malware payload (Mirai)", "value": "78e69e314c0cc74c87a716d20afab8416a9bd0e075120fbf2f34969fe2e49376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303238, "uuid": "ca2a6f3c-d58c-4247-a7b3-57bafccb5939", "comment": "Malware payload (Mirai)", "value": "95659bf2460ed9e78b82e79b1249e5f65516eeee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303238, "uuid": "6f5f06ef-9580-4cb4-9664-35d7898190f4", "comment": "Malware payload (Mirai)", "value": "b10c1c79ae055d98b713baaa7377df0011a00f0f6daa4a44c04151e88d51e84052f34a435bef235391640ff5dc3f93cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303238, "uuid": "c6e63bf8-1529-4a88-8de9-2eac78ec2f8e", "value": "T1E2C2F132DB5548F1C9B20C32C171404426539DA9E4EE71B7EF791232BFE8AA543F562E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303238, "uuid": "737da64f-2ea4-4dcd-98f0-66f3604fbcdc", "value": "768:RDWc9L3kSga/RCoxCF7K416HC3u1d3s/3Uc:RDWcB3FTGtK4YRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654303238, "uuid": "1de29196-0a49-4dd5-89ef-8dbca63e6d9c", "value": 28172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654303238, "uuid": "c647abb8-be23-4a32-9172-837f438c6d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303238, "uuid": "efb70ed3-4f8d-4cc0-aa5e-e2735bf01310", "value": "0dfde039eb73b36ca4be940362638c30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305b3f7-e415-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654353943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353943, "uuid": "76a31794-d5dd-4e40-b38c-13c5e739d73f", "comment": "Malware payload (RemcosRAT)", "value": "be0627e0aed470cb4b0dcb5adad225f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353943, "uuid": "12baef82-cd6e-4a40-bfa2-60f0519bc259", "comment": "Malware payload (RemcosRAT)", "value": "7c46360bc0f882b7d7a6603ce5f141914e645b4afb7f4951cc3e29d76908c518", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353943, "uuid": "be949308-20f2-414b-ac00-e3e35ff300a0", "comment": "Malware payload (RemcosRAT)", "value": "d993264d735fa614bdeda9a70c6d84ba23fab92c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353943, "uuid": "aac92951-6830-4e60-9cb6-17d24c65fb88", "comment": "Malware payload (RemcosRAT)", "value": "c68f26ef1f41835dc121c9c7e1dc2bb9a069a059e4e83463c864301276d5ac3e0fbcba398d41cc3f5111788d0ff6d3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353943, "uuid": "b03f26d2-5076-4933-96a2-a528d32984d8", "value": "T178156A66E380E9F7C33B5638D86765292926BD64E958184D3AEC6E1C2E342403C1FDF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353943, "uuid": "78e095cd-fd6e-4324-8af3-84324266a77a", "value": "3e48bf6577602f80c1272235d4172ce0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353943, "uuid": "a35ef13f-cc32-4a3f-8355-99b3952068c7", "value": "12288:zDzHKiH6ZK7o81KuTXiBRkjK7mcxyq/DU0dg99iaA5bX3+oTSQ:zfqbi/KuTSBRkjDiyq/YkN9H+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353943, "uuid": "f89d0d02-a76d-4b37-841f-367e516c6ecf", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353943, "uuid": "d9d64ddf-d984-4bad-a10f-71577c2c3e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353943, "uuid": "527f5855-6514-4b8e-af7e-9ec70dfc32e8", "value": "SecuriteInfo.com.W32.DelfInject.EJ.genEldorado.19949.14167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581aa07b-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361817, "uuid": "fe2b7b62-356e-4ec2-aeed-85ff67e70fa5", "comment": "Malware payload (Mirai)", "value": "7a23c59277b0f17d421f7cf507b17479", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361817, "uuid": "74f6525c-a727-4e81-b4ac-e5c65f291682", "comment": "Malware payload (Mirai)", "value": "803a06f72caf4bbc918f4612be6e050a27a136066ef725d8dfef018e3e0eee3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361817, "uuid": "f08aa606-8e93-4571-b528-100cf7fd8eb3", "comment": "Malware payload (Mirai)", "value": "576125e741a4fe387ee70e9d2b977044de8b9b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361817, "uuid": "4fce544b-a136-4d0e-b772-66b8f715b43e", "comment": "Malware payload (Mirai)", "value": "9d66b4ec596b2069facee4b406b2d5c8dd184b380eaa269be98d2a947661b8278dd375472d6fb12b646a6e185e249583", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361817, "uuid": "12e815d5-1dd6-438d-8941-8faa8ffba638", "value": "T12FB2C060E5545EAFDF7BE8F369DAB7D5B3970E061602CA32F196FF902101A35BB01890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361817, "uuid": "b2ef3f31-9d84-499e-8a5a-968a97d51d59", "value": "384:i6PgX5g1IsZuoBl8XUlqvdKRiHVdB0CBYRJ8hDE1rWEXSnfu3fc10jrK5M4uVcqg:iagPsh4XLveiR0CeaDE1rWjm3f+uD4uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361817, "uuid": "465c8117-8590-4fd6-b99a-b4588daa92a5", "value": 23488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361817, "uuid": "e17c9d21-6831-4023-8f29-9007a0e8ca10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361817, "uuid": "39384f04-9aaa-4c66-8e24-92c9c57b1932", "value": "7a23c59277b0f17d421f7cf507b17479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead38e8b-e3ae-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654310094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654310094, "uuid": "75990fb5-5602-4e0c-a049-3861008632ce", "comment": "Malware payload (RedLineStealer)", "value": "0080e3eec11f9fb5129e8597f2290fc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654310094, "uuid": "03e2e5bb-d58c-408f-b5db-b0f7334703e9", "comment": "Malware payload (RedLineStealer)", "value": "843a82d901ad671ab4f033657c08954a8349aff9c0f59eed8869c1a12b82f90f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654310094, "uuid": "fbe19d98-7df1-472e-86fa-7d8b6bd823e1", "comment": "Malware payload (RedLineStealer)", "value": "8685459f6caefaae31f10cb1209c1af587595931", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654310094, "uuid": "cb905a9b-6108-47c8-8b90-831af5a1e259", "comment": "Malware payload (RedLineStealer)", "value": "300c62b9aa672f63ee33a242cf9378c47ac470f5a8b3f17434625eb11a326dbbad660e3bdf1bf2520b28d7bf3053b296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654310094, "uuid": "7b321119-5514-4bc3-8df5-4d085e82001a", "value": "T19694BF00BBD0C435F1F712F4597993A8B92E7EB1AB2850CB52D56AEE5634AE1EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654310094, "uuid": "e3526ca5-1fed-443b-8583-08afa16df541", "value": "dc4a7f3cd4507c474f64143d22a6168e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654310094, "uuid": "c96b45e0-0a68-4560-851f-f2fdff08c510", "value": "12288:d+lH13koWS4a5Jo/ulN74NlHD1rXujNaN4Jr:d8H733o7j1+C4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654310094, "uuid": "c19fa052-39a7-497d-b140-ed15b0b9a692", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654310094, "uuid": "f0d99a96-5a19-43fc-ae4d-7f2bb0bec2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654310094, "uuid": "c1fe349b-4628-45c0-8320-8bc460d90d51", "value": "0080e3eec11f9fb5129e8597f2290fc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81cd714-e41b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654356851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356851, "uuid": "241b2266-9b0e-49a5-ba26-7156b437177d", "comment": "Malware payload", "value": "b0307b370509f36ff080e69e0f365525", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356851, "uuid": "c87a7b75-186b-47af-8151-a9756184cf7d", "comment": "Malware payload", "value": "85894dd0d9ad444bed01ef82ee9dc0fa82d3c8b126a40732d47a4a89c4ebf1b3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356851, "uuid": "ca599f86-1736-425b-98eb-6b9578d621e1", "comment": "Malware payload", "value": "c3ab8a51289285a469f589d77fd5924b0375ae21", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654356851, "uuid": "86815937-1990-4182-b896-25d6663fa9e8", "comment": "Malware payload", "value": "edf610ed03aab08e0de827389a100a1d60bdfb8ff6789b6bbe8caa1e6210b8f4297c4b9e32e828bffdeba4809329bf6c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356851, "uuid": "2376ad44-5c07-424c-b061-75d74931b0ba", "value": "T112D6F097F39DED9FC4F68331893A112231574D60674393A76928B27828B39D84F4EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356851, "uuid": "5f5ad31b-5fc5-4fad-9a50-4caf4f6aca9e", "value": "393216:hx/MLu/AzkCBXU9whoJfs6rKjwH+Vj3IdX+E:MLuCkgE9RuJn0dXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654356851, "uuid": "110cc8a8-18a0-481e-baf1-630759984f59", "value": 13319546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654356851, "uuid": "911526c3-1e3f-4e5a-85f4-b92ce448835b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654356851, "uuid": "5b97a510-c535-4935-aab3-3744b90cb8ad", "value": "Custom Themed Keyboard_3.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4447811c-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654331719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331719, "uuid": "ec341cd1-badc-4b32-8952-99d98a4dc5a1", "comment": "Malware payload (RedLineStealer)", "value": "2efc8a17aae92ea8fb4c03f88974c4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331719, "uuid": "773242bc-b861-4000-bc58-00941392482d", "comment": "Malware payload (RedLineStealer)", "value": "861055b6ecd478742dc0031158ce105ea59272d4710aec011e697270224a28b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331719, "uuid": "d143f397-98ae-44ab-ac8c-7bc15985e71a", "comment": "Malware payload (RedLineStealer)", "value": "7f88e0d35c805b83563949da7a78421504fc5845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331719, "uuid": "c59f5f0e-d7e5-4917-8e37-5b118c3a4888", "comment": "Malware payload (RedLineStealer)", "value": "6ef70078ae266ce9b9c78373b9c94ffe2a6bbe34ab9475c794ac7b290de6e125be29a06a3a312be08322d25a3ae2e0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331719, "uuid": "6c00cab6-24f5-4680-9b59-e79db55e4a0e", "value": "T158B5F8139A8B0E75DDC23BB461CB633B9734EE30CA269B7BF708C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331719, "uuid": "4cf43ccf-2fb0-4521-a02f-566f0046fb03", "value": "4abe00f9bb2c9be2a818a94bb7c50882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331719, "uuid": "13241792-d29a-4bf8-83c6-8f9c3b6a024b", "value": "24576:s4ZkZ2RNoul3+/BEm2nfA0okQU21QKQarglpHx2EAM9GU/uQ5p3h3SK:s4ZkZ2RNoul3+/dWtnegnbAM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331719, "uuid": "5d31dbf4-43af-4cad-ad7b-55b8a824b1ec", "value": 2376906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331719, "uuid": "f5042809-026e-41d3-93fa-458e5319177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331719, "uuid": "29147050-47f6-4cbd-bd66-e3eb13aab09b", "value": "FortHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6605f8-e450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654379408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379408, "uuid": "08d498ce-144b-44ea-afa0-4bd3ccae2331", "comment": "Malware payload (Mirai)", "value": "a6a08f32f9af7aa9ab3174980697cc17", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379408, "uuid": "3e1ffc0d-9719-4a1b-bde7-ad48d8ef6b8c", "comment": "Malware payload (Mirai)", "value": "865e37351e7d97c4efd7b937e4bb3c94d60f8739b658f34fbcb2e33eed827918", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379408, "uuid": "14929558-9577-414a-97d2-289b831e0897", "comment": "Malware payload (Mirai)", "value": "106d1447faa7377bc23580f054ded74059ec5806", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379408, "uuid": "81f63520-aa86-43fb-9896-ec89a497987c", "comment": "Malware payload (Mirai)", "value": "70ca606f3a1ef7d92a18cf031c83db079011591d839a78c688341a83ddd215f46bd7af7ecb5389b6c634d0c2d80eb28d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379408, "uuid": "153fd19f-56d0-46a0-973b-c395c7e8b389", "value": "T183A2CF3816858AB4D2B0CA3D4E26C6E36B525A7DA7F3315538A4C17CE09951982F8FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379408, "uuid": "52c68d63-13b3-4fdf-9e36-e297c9b8a5f0", "value": "384:unNN0Q5YSk1ilFfAwmh4xoqIG2NTfsJKOoXMIuhJNTDRlGDJLfi4IDhymdGUop5y:Huk1mFYwmh4x3NlNH6hfi4ss3UozG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654379408, "uuid": "f1d08872-5f57-4511-a488-6fa09450b63e", "value": 22008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654379408, "uuid": "76fbdc17-46cd-4572-b583-8b48ea3047b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379408, "uuid": "c344db6a-3361-4f16-b2af-0cb50622a348", "value": "isis.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ff4488-e444-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374400, "uuid": "c374ba0e-c1c5-41d2-8aee-ea9361f4bf72", "comment": "Malware payload (Mirai)", "value": "de603447f8e1ff827f645565b338af65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374400, "uuid": "b1c1bbd1-1624-4f47-a11b-2cfd687535a6", "comment": "Malware payload (Mirai)", "value": "874ed619508afa470b6b2c23669c70729ef6265d161e455b113f7a8d73c11eea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374400, "uuid": "913a9ed2-bfea-4d92-9c1d-1d8e0221bd30", "comment": "Malware payload (Mirai)", "value": "07047cad3933b01b82e68d3b87a8a96e2230a7a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374400, "uuid": "aafb0543-1194-4fd6-b50f-10f615bf3348", "comment": "Malware payload (Mirai)", "value": "8293ca875d7d8f160881c29fb3e1492688580f9fa3eb8c5bcb61f06a90898a53241308dd5925d0d7d8b150640f8ccc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374400, "uuid": "ad4d4972-7d0c-4a34-9446-0539e6c2984d", "value": "T173032934B7751E17C4D8A47D26FA4368B2B5464A28E8C71B3D730F8EFF10A506613AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374400, "uuid": "94ffaf50-ea17-4b28-93db-a26791f7cad6", "value": "384:YFEwLIMIp81rm8kCjhpcJGLwJml9vyeK9/BuJgt9wWW/8IKGFU+pBdbl0G0:mLIMIp81rmVCN9aJl6/8dGO+J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374400, "uuid": "9d6c56ee-a8fc-4fd3-a351-22fd31c8baae", "value": 38952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374400, "uuid": "461cac50-f490-42a9-8b6f-1271af146442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374400, "uuid": "d8df8366-8df9-4874-a7d6-5dccce91287a", "value": "de603447f8e1ff827f645565b338af65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4547ae-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361826, "uuid": "fc2854fa-8ab9-4657-bd08-22b92b7b5079", "comment": "Malware payload (Mirai)", "value": "2a6d3e974e295bf590ec622f038cde61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361826, "uuid": "e7b6a3ad-3c41-4d2d-bab7-bf6c2cd8abcb", "comment": "Malware payload (Mirai)", "value": "89fed3d9a7d5d2bfff9f192ef6639c05b4cbc5f6dc9b415eb493b3363f29ad66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361826, "uuid": "1b1d5179-4d20-4e10-bc9a-f85c662e99fc", "comment": "Malware payload (Mirai)", "value": "fa0be31d1db757ede13c2394c465cc361b7d380e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361826, "uuid": "a9b2dd09-5233-43ff-a05d-a2faf766d9e2", "comment": "Malware payload (Mirai)", "value": "6da5f6f70b2e0fd8e1f0038f40c27cf3074a4a294c44762a498cb6df552d4acae15bbcf072df13a9e8ca6cea9a75507b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361826, "uuid": "757824eb-4478-4de0-ba9e-fb1c25fecdaa", "value": "T152D2F1B143609BE2C6B89EB1A9FD454B2A0D973580DBF4F2111006CC75A29CB76BC3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361826, "uuid": "864b9e42-da09-488c-b268-87baac382dc0", "value": "768:uW2K93ZmoaRZp0Wkwnjfc/qNkiteBJWWyuUrw9q3UELd4:uvKpZwLwiqqVp5LG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361826, "uuid": "c8c2b52a-269f-45eb-b3fb-c40f17b4b945", "value": 28992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361826, "uuid": "a065a531-31ad-4961-98ee-cfc294a69d69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361826, "uuid": "e902a81e-c163-49a8-8443-e12b2d906ff8", "value": "2a6d3e974e295bf590ec622f038cde61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691571d0-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352826, "uuid": "1c8ed04c-b47b-4a9e-b7b7-70f1ad184661", "comment": "Malware payload (Gafgyt)", "value": "c08d9763ecbd5fc7a4b357663c828bcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352826, "uuid": "2e2ad745-e2e4-4dbe-8017-3b5a8ae58c61", "comment": "Malware payload (Gafgyt)", "value": "8bfdaae31cb5be5cccce0a5bb450d4231888b3ecdd6c110b0b2c764e8065da77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352826, "uuid": "8f115f5f-a678-4c35-bf00-ee53c82cdd11", "comment": "Malware payload (Gafgyt)", "value": "0f4bc554d332dcf744ca882df2b4e78d217d37da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352826, "uuid": "064266ea-406f-42a6-a541-71e01167e026", "comment": "Malware payload (Gafgyt)", "value": "e132473e511283096594df1d3ebdec0eb2a83c65b3ce9996e2b8c7cc79b5812dee0238269276c392a2593d8ed38d6b9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352826, "uuid": "43f54616-3f3c-400c-9c39-df79deb9a270", "value": "T1D4932907B71D4F43C1DB59F029BB2BF14769BAE512A36181B91BAED04733A782023F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352826, "uuid": "09ec0c5b-88e0-4f01-b1a4-11b2c0648777", "value": "1536:f3YGOKuyF6GibcBXnrGfAeIGsi2Gqx2/lb5h5hcZtOFO6V6qDjjofSee:fILKVXo3IGsir/l5hcTOFO6V6qDvofSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352826, "uuid": "efead516-e863-426c-8d3f-9a146510d74a", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352826, "uuid": "b69a8577-07f8-4519-80d6-7fdbc558cff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352826, "uuid": "e8392cc1-7333-41b7-837b-b2f3f10944df", "value": "c08d9763ecbd5fc7a4b357663c828bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7228730-e3c3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654319134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654319134, "uuid": "d715919e-fe4f-4415-aee8-d115c3754e73", "comment": "Malware payload", "value": "8c0bf90f58a947db880bfdd57716be8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654319134, "uuid": "ca9c76d3-ccd1-4e52-8768-50dcbd01f599", "comment": "Malware payload", "value": "8f5a09f08a9249cba03ab8d1fa7c23d42599e6084995a6ed86e85ad2539244ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654319134, "uuid": "3ad95d6e-13af-45aa-9727-5aec962a9243", "comment": "Malware payload", "value": "d3e05f676b5339e1293aa2bf284cff09d5ccc311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654319134, "uuid": "31cded53-a126-4e2d-8138-3f6aa6e92d6e", "comment": "Malware payload", "value": "789d07ab8bcb1d617a38290afb32d0660bd3d62a90b322879ff1370aea51c8882cf8ac6319c2e977830bbae4b970b794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654319134, "uuid": "1705cacd-9ea6-4755-8441-5a2e5de52014", "value": "T105C58567EBF05689D4C440B3A2238122DC585C7D29BA105A2EC17DBAB5FDD803A5BDFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654319134, "uuid": "16f10d3a-a478-4a85-a597-2ee9c5806e7a", "value": "5a5f539d8210c14c1fee06063beb6a99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654319134, "uuid": "8710e7d1-2829-4487-a8ad-8507830e92d6", "value": "24576:4qfAcdCrrx3XK+JIzGW/KHGmcfeFn2r54te:4qfAcaHHG8He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654319134, "uuid": "cb203323-659c-4303-8a7b-e1a784eba600", "value": 2600448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654319134, "uuid": "e93ffe39-ec13-4cc3-b039-d633f9a9bfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654319134, "uuid": "f3b0946f-458e-4e3c-9c6a-da248d4bcaf6", "value": "8c0bf90f58a947db880bfdd57716be8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdbd937-e40b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654349933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349933, "uuid": "2fdf2ca5-1c5a-43ec-9520-b10fc339577a", "comment": "Malware payload (Heodo)", "value": "cdcf6496c7fe444faf5f361e39368809", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349933, "uuid": "32423d15-9e72-44d0-ac66-14c4e6b0ae43", "comment": "Malware payload (Heodo)", "value": "8fa2a668217d80bf65625b11f7dcf5a14e141d5de9bc05963e21c332cf199afd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349933, "uuid": "0e92934c-c780-40c0-8b72-a3364340096c", "comment": "Malware payload (Heodo)", "value": "2df371c78e59b309fa3501351e52ad535e15c03f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654349933, "uuid": "8bc0c1c3-63fe-49c6-9c0a-9218fb9ddcfc", "comment": "Malware payload (Heodo)", "value": "84bf9b87327137c5f77c4a53bd616992e07be0e29c80e700ebd57560e918d95893dd7f5bcd19f967c2bd92f81d593600", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349933, "uuid": "9ad8c9b2-5e04-4b5f-ac59-0b99299554d7", "value": "T188C47D0772F1B5B8C205C034464EE532A736B9CD1522ED5F26E1D6302FEA9A22F7E65C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349933, "uuid": "865e9c1e-214b-4368-9ab3-47ccd7ca4919", "value": "1c5c45f819ffed1f8a226b23fc12dfaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349933, "uuid": "aae22824-065a-4f88-b9fe-52e030d9e553", "value": "12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZE9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2UyyrmE9MoIA3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654349933, "uuid": "22848287-10a9-449e-b5c7-5662e56a67df", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654349933, "uuid": "9178bbfa-e5bf-4364-ae5b-5357f88729d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654349933, "uuid": "0c8b1f84-9d7d-4cd2-a8cf-a2638151a246", "value": "aPsPViQ5gP17jqYAEcr.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51f1741-e402-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1654346189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654346189, "uuid": "06c09c25-42fb-4079-a9c3-914b6aa6b36f", "comment": "Malware payload (Amadey)", "value": "a9d7c2aea7e336548feee78abf8a4ca6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654346189, "uuid": "1485c4bf-493d-46c3-a034-960ce33ff275", "comment": "Malware payload (Amadey)", "value": "927e564388f0341a0f00afcab7c1fa19b27174781b9e299e45737e6a94151fbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654346189, "uuid": "3b550394-b0c5-469c-9e69-25b875dc5d5f", "comment": "Malware payload (Amadey)", "value": "7ab403058bd5fa8784312d69db32b5b392af0998", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654346189, "uuid": "f67664d9-b732-4148-a9b0-f9ce22ee3ff3", "comment": "Malware payload (Amadey)", "value": "6478423e9a7100932c54a1fdc6bf91aa7938e7093a0e26148d6cb4a9fd77da28f3b2adbbf01225bff43c68ec0d2f97a4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654346189, "uuid": "c5278c2c-38f7-46ed-bb29-a80f9c26d50d", "value": "T1DE649D10BBA0C435F6B712F4897983ADB53E79F19B2851CB62D416EE1A356E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654346189, "uuid": "93ed3bf2-e504-4ddc-b53a-ba3b85f90cd3", "value": "7075aebbefb0c25763ed3020e2eb3f06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654346189, "uuid": "c22e642a-7f1d-4dc7-9bd9-7db07f611fbe", "value": "6144:v7najp17OiItO0FkXPzgSgzHeoHO2BwrFiG34MdS+pVaI3iI:vDajNoOqu7gpzm2Be4MdKIyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654346189, "uuid": "b235679b-61d1-4c42-b88e-2d0d7109ba6d", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654346189, "uuid": "b4045f67-ec15-42ff-8d15-ca1cabebd9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654346189, "uuid": "3d171a29-a045-4c6a-a482-1bbec28a1909", "value": "a9d7c2aea7e336548feee78abf8a4ca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f27fa8-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654331723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331723, "uuid": "c80141dd-c324-42fe-bbbc-e7fbd10163de", "comment": "Malware payload (RedLineStealer)", "value": "5a2c9893d687184b0c1ae2b009feb184", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331723, "uuid": "7545c08e-1266-4914-82ec-5ec3373dc3d9", "comment": "Malware payload (RedLineStealer)", "value": "99e526e91f6207bbf66cde726e19b74dcccf8370465fd75f2c44fb69716186a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331723, "uuid": "1049883e-3239-474c-9826-f6fd2c48883a", "comment": "Malware payload (RedLineStealer)", "value": "030c2eef16c7e35aa6bb70a78b3aed49e68777fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331723, "uuid": "18a89e0d-6028-4009-b821-3d9864281a5c", "comment": "Malware payload (RedLineStealer)", "value": "9499fe271e0329acb53cd218cc291031e2940b20b36944f93297572dc8678d893be8750cadb39d38bfbff221ea0be7d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331723, "uuid": "fc251d89-3623-4a9c-abdb-bf87ae115870", "value": "T1CA549D00F0C2C132D97224734DD79638387ABE3107155AFBA7F91BAE7E742C166B691A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331723, "uuid": "5f9dbf70-9145-4886-9503-6e02296373d9", "value": "763cdaefcf7886ce360ad2931861cb7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331723, "uuid": "95ab15d4-5910-4645-ae0a-22c443ed2d77", "value": "6144:imIXIipMjNdG8MzPAObyP7Hw27T2y6Ofn5:i5XIipMaN87Dv2yZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331723, "uuid": "1fcb4c26-146b-45f3-b8c8-acff12e22c4a", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331723, "uuid": "c7c9b5f5-0377-4c55-a460-e5522ab22e4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331723, "uuid": "7c0dc0b8-7869-428d-be44-1b1c20726fda", "value": "HoicoExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac841211-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352939, "uuid": "95fffd2e-82f5-4bda-a8a0-79d3278aba81", "comment": "Malware payload (Gafgyt)", "value": "2656edcdff0df1ad3c4c41f94836bbb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352939, "uuid": "dc8e5c80-c72c-4f43-b5f2-52f6c84ed7e3", "comment": "Malware payload (Gafgyt)", "value": "9bc2d1808c9d2e11badad6bf3adf79a42a486fd8ed754e925c8491d05b7cc35c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352939, "uuid": "49f6b305-0010-49c6-b7d1-82a9a9d90e39", "comment": "Malware payload (Gafgyt)", "value": "7f767d9a2d7ed207a8df14b3fa14443fd2490db2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352939, "uuid": "993ff382-bd54-45ea-9983-831d973e5949", "comment": "Malware payload (Gafgyt)", "value": "b9d83e8b9e3ee7461e0bb6a2ac1e7cbb75f719ba468fd5a7aaeaca328c3636aab30ed01560ac097033f324703776254e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352939, "uuid": "e0919247-b470-4d4d-afbc-3ab90599c8b9", "value": "T162B3E817BB11CEB3C85FDD730AAA4A01108DA99756D57B6BB3B4DA58E74784F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352939, "uuid": "9ad4936a-f112-493f-93f9-387907f3bd4d", "value": "3072:NKtrQfw4VMUaBMN5hGGiKdwwjF9GhsR1Ae:wtUVMUEMN5hGbKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352939, "uuid": "3234d6f9-8bde-45cf-8a6c-4b9d90c2b72a", "value": 116699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352939, "uuid": "9d6357d6-944d-4d3c-bcc0-3840f17a5eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352939, "uuid": "1f9a2ea2-8e16-4d15-b40f-d383cd84ea6f", "value": "2656edcdff0df1ad3c4c41f94836bbb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b399f08c-e43a-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654370131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654370131, "uuid": "4e83f336-29d6-4794-ab72-5a2e2385b66a", "comment": "Malware payload (RedLineStealer)", "value": "58a250aeb22f0040185210402d4243b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654370131, "uuid": "02773f6b-71e3-4b91-8b14-fe0999eb6af3", "comment": "Malware payload (RedLineStealer)", "value": "9c78846071126d7f29a8b82b699903031d7d2cd837df91584fd1ee7eb7b8c93b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654370131, "uuid": "f67644dd-57a9-4cd3-b844-2d8c8206428b", "comment": "Malware payload (RedLineStealer)", "value": "cb74b3dba0e3ef8073f03810a0232da641b8a587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654370131, "uuid": "4e1cf1e6-e2fd-4ead-a29d-82b0492a4e82", "comment": "Malware payload (RedLineStealer)", "value": "1556df32ec0a43bcc7b8ffa4556f59fceb90ff01aa21b16f6a5ef9aecc3523d9462b90c7ae08fe45f0d661369d18a3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654370131, "uuid": "404bd42c-69fc-405d-8bee-47a0f9e0c1ca", "value": "T144757CA423B42F8EC1EFCA3DF0284550B6B8E85B5335A28697722DF91D177C64F40EA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654370131, "uuid": "39f118d6-2ead-441a-80d1-199471e0fa4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654370131, "uuid": "6643585b-8c83-4bf8-ab9e-2a1186f0e08c", "value": "24576:73Az+jwa8Jnkqbr5yT073RmbaLpYEywZiPiM9jzoCaYN:73AzoiLBBBO0pnyZPhgCaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654370131, "uuid": "469b442f-b44f-4ba5-b6cc-1d4bc28a9519", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654370131, "uuid": "12385701-4e6d-40b6-9897-8b8bfab011b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654370131, "uuid": "932d5ddf-684c-4255-b834-6e824c695d94", "value": "9C78846071126D7F29A8B82B699903031D7D2CD837DF9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2451ac99-e3a4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654305466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305466, "uuid": "814980a6-431c-4c24-bf13-aea5da2b0288", "comment": "Malware payload (Mirai)", "value": "4f397309d0c93568c2ec8eb2328a21a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305466, "uuid": "c55d0d4a-a325-4c6e-ae88-886ff6916f38", "comment": "Malware payload (Mirai)", "value": "9f58866ae5b2d31908886f094cc459969a2cde26a71930361168778ca50fc97d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305466, "uuid": "53089cb7-bc66-4d8a-8ac6-4a91876f8ec3", "comment": "Malware payload (Mirai)", "value": "bc9f59284fb26b9ad28671d1fde65a7395447ea7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305466, "uuid": "81882fa7-52d5-44d3-9507-4da0275dd8c0", "comment": "Malware payload (Mirai)", "value": "1c5ad99a9f27cbfec116b341483a78546580964113e9e6db58fa95c0b0ea00f01764adaa0a54da6e97aaf0f9fe583ee8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305466, "uuid": "3296615e-1018-40a7-94b1-9a3abe5303c3", "value": "T141631991BC91461AD1D423BABB6E92CD3322B3F8D2EB3227CD141B50B6C591F4D73A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305466, "uuid": "f347eb04-71ce-44fc-9174-5b19e1fb0b0c", "value": "1536:AopFil9Bv1vEw5ae35A27fcRgJweYnMwidwAGIjXGrUFh:zpUl951Zr70OJ9twiCAjFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654305466, "uuid": "feb068e0-58eb-4482-ac97-f3c33c3e747e", "value": 67048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654305466, "uuid": "46b66547-6b9a-4997-93af-0d7c0853f652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305466, "uuid": "cf565d03-4fad-47ad-aef9-f20f06057e59", "value": "4f397309d0c93568c2ec8eb2328a21a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf864d8-e3dd-11ec-93bb-42010a9c0043", "comment": "Malware payload (CoinMiner)", "timestamp": 1654330307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654330307, "uuid": "355b2e16-75a7-4555-8cb6-736c5e38ab43", "comment": "Malware payload (CoinMiner)", "value": "9b980a4c2e582057a8f78f67b9fd0e7e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654330307, "uuid": "e108b3b6-564d-4660-b85f-1fe8a6f3126b", "comment": "Malware payload (CoinMiner)", "value": "a24c2f0775f834d56102bc71dcab3681573128c66cd33d82967a49fe9fe16b13", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654330307, "uuid": "4348c48a-cee9-4efa-9e3e-17dc05ec62c5", "comment": "Malware payload (CoinMiner)", "value": "c17dafabeefa2fbfea6c240dc78a2aad1a54875e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654330307, "uuid": "9a6593bd-af0a-41a4-8d68-b12b8b25f61f", "comment": "Malware payload (CoinMiner)", "value": "5226f0fafb342df54644c4f96a550cde0cdc77ad1e29d1888a00f185ae302a29e3278c4d6dd57ff004e5cc87422e8691", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654330307, "uuid": "35bc33cd-503d-410e-96c2-52a814f3e6f8", "value": "T11094449D726072DFC857D472DEA82DA8EA6174BB931F4203902715ADEE4D89BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654330307, "uuid": "46c852d9-a1e7-4dc4-8105-9542567e2cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654330307, "uuid": "8224642e-3f03-412d-967f-2abc2dceb4f7", "value": "12288:DSTWTGSkgSsPPU2XiLVLMa1T8bl37BQmO9VnTscIV6XGWKwopB8DnmISa+E+MUo5:XTQgzP8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654330307, "uuid": "0608d1c2-409d-4485-8f4c-f581ba8be755", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654330307, "uuid": "fbbf52b5-6ece-4e93-bcc2-10eda17955d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654330307, "uuid": "8751bfd3-d514-4618-bc6f-b8760653b829", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc0f156-e450-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654379407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379407, "uuid": "8c033bd2-87f6-4e70-83ac-20803d48a0f6", "comment": "Malware payload (Mirai)", "value": "a548d05f15a9842b34617adf6202a59b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379407, "uuid": "b5011388-6261-4471-a243-415abe7b4d25", "comment": "Malware payload (Mirai)", "value": "a5d18e581f866e711cab4e33ea696b8e6c7af89d393d673adf07b18c41b8cfba", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379407, "uuid": "e005245f-ddd5-4728-a04f-f23d002db55d", "comment": "Malware payload (Mirai)", "value": "3ea6838742488eb3a9fc63eb103995240322acfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379407, "uuid": "d3fb8079-53ff-4e70-ba00-5fe3f7c0c98e", "comment": "Malware payload (Mirai)", "value": "b4783e31968437b435d15379e4076be85cf2b458c7773239aa0b5961d15580ce7d4d4458304bfca955524f3335672dc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379407, "uuid": "1b3df5d1-b72a-4702-af39-39deb04d22ab", "value": "T120330265D75A98B2CDD018F7526A4907AF100BF8EDF040226DED5C88AF39AC35DFD096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379407, "uuid": "21040c4e-82ed-45cb-b6b6-e49f8153432d", "value": "1536:L/qfiI7k+qHui8x8d5ljLXuLmD85/8q+F:jqqIk+x05ljjuLn5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654379407, "uuid": "76133faa-4bde-4b97-95fb-415c9ec95d34", "value": 52956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654379407, "uuid": "374f0637-121b-45aa-8143-dcde1a836fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379407, "uuid": "f65286ea-b2f2-4f6f-953f-cc49e86810e9", "value": "isis.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1904612-e44e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654378798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378798, "uuid": "f4331c37-fafa-4658-84bb-742ac2bd855c", "comment": "Malware payload", "value": "e63910f8ed6f76f6a38c54f0bd907692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378798, "uuid": "71f0c939-24fb-484c-9c7d-aaae6479d518", "comment": "Malware payload", "value": "a82a9113b739395948f36574b52ffe432c60778fbf2773796641198cd4ce505f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378798, "uuid": "aa1160fc-0311-461b-977d-5763d21ac500", "comment": "Malware payload", "value": "3bbe8f1fbc9cc011abc2a3fd0170e6fddce3d9af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378798, "uuid": "1674187e-cc05-40cf-8a56-1676c9546805", "comment": "Malware payload", "value": "7335c2aa0f3537ed8372d486c5e610f77ee5ee2a554a2426b231c8c5e38238fc1c38f7fa2b9597672c74e4d6a31657c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378798, "uuid": "5cce1751-6b35-4409-a7d8-36358c73cbb4", "value": "T1A2E4AD9C765076DFC86BC836CEA82CA4EA60647B970BD203E05716AD9E0D997CF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378798, "uuid": "1b337607-6796-4c68-b20d-c727bf4af932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378798, "uuid": "0e976db2-9000-4a12-81b6-0351743cfb1f", "value": "12288:VlXU2iNQAaABk3lM+jKdJL+lDBAR4H7zKOw7gHKkFdDgMwq0Gdauwk:VZU1x6M+mPL+peR4bzKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654378798, "uuid": "99517116-c4a2-4502-bcf9-3ccc15b435f8", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654378798, "uuid": "e2cce203-ebc0-4473-9b3b-753d684a5891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378798, "uuid": "4321a4cf-6ef6-4fcf-98a1-a011a99511ee", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce16b5c1-e3f1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654338822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338822, "uuid": "df840931-1b51-46dd-b16e-c01d9c677e54", "comment": "Malware payload", "value": "644c7aef2c2ea3f1452716913802633f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338822, "uuid": "9517bf49-9570-414f-96c8-9af9924a43b8", "comment": "Malware payload", "value": "b0574b4371a36d7733ad7efa44417b839717cb9b65a43598a2e5889ab8e8ce97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338822, "uuid": "c3f796a7-8d79-40af-a641-c842a1b8b0b9", "comment": "Malware payload", "value": "009448a4de0e20d5cd5058862437f72af78e50fe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654338822, "uuid": "e2767ce1-8dcd-48eb-a86c-f0d26ed6d07a", "comment": "Malware payload", "value": "59fd24fdceb21a3cd656c684389f5944ac227859171a5afa345721fc6087dea100eae9af09bded77b63d312021e8cf47", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338822, "uuid": "0324d549-c2d5-4ba7-a008-39958d3f5e00", "value": "T1663392447281C56BC5495A368CDAE3DB2B30FCA1EE818B0B32C5772F3D3A795D912B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338822, "uuid": "b089ea22-3cf5-4fa5-82e0-cbedd59e173f", "value": "768:EfiUb3hzF0v9mi7pw3iwOu9AUJCPryD8IzFKGF:Ehb3hziU3iwOu9hCjytFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654338822, "uuid": "db5a5c3c-fcc1-4bd6-885c-fac814d98d69", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654338822, "uuid": "4c8eb6c7-30bf-42e5-9bd0-9653d1cff0c8", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654338822, "uuid": "0823f085-38ee-4d84-8f08-5bf905f5b73a", "value": "SecuriteInfo.com.Heur.19560.24384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc52269-e3d5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654326531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654326531, "uuid": "8550b79b-1951-41bd-b063-0baad11c88b9", "comment": "Malware payload", "value": "366f4696d4f2da4b0c170419d862ef5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654326531, "uuid": "4f7c27d9-8669-48e6-9577-4a4af3d09b4f", "comment": "Malware payload", "value": "b4f4be5b4b73abf5c57e7b140f268f0ee7b7e18eda23d68d060a160e565669f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654326531, "uuid": "48737da2-843e-45e6-a548-2341450f27e3", "comment": "Malware payload", "value": "e3bb00b575aff7550c303c24a1ae23fbbf0418ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654326531, "uuid": "0a4262b3-57c0-40a2-9663-5367aa20be73", "comment": "Malware payload", "value": "0666ec0702fe5b7f2cdf9065382b3541cf022dc1de5dcf36fa096dcce21173943fc990d563438ea7a38f380264289081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654326531, "uuid": "12b5839d-d4ad-403d-95c0-14ebda3a7407", "value": "T162D46BAFD748D59AE0A18CFA1854DA51182DBC30332286C3B6D7535324F4EE26E77DE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654326531, "uuid": "28d98b65-1631-49d7-8e00-ca95357f2136", "value": "dbdc830fe758e16cfdb103c5a10d33fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654326531, "uuid": "46aa1794-212d-40c1-8562-1453172c51e8", "value": "12288:jixZQqXtUSpwgevh9EBTEev0EnMrH+CPcTXph9PAqJfsVWe:KXCvxPEBTHv0jrH+TpAqJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654326531, "uuid": "2ebd4011-9142-435d-aeb6-6cb2ef404a15", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654326531, "uuid": "bf8ca1da-fb46-42ec-9c6c-f378eed31455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654326531, "uuid": "c867b889-d44d-4639-a675-e67242fa0111", "value": "366f4696d4f2da4b0c170419d862ef5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8edc04-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352968, "uuid": "ba31f6f2-f9a1-408f-8626-505636bcb425", "comment": "Malware payload (Gafgyt)", "value": "b854bf9735dc3b34f24af27f712aea8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352968, "uuid": "a3db054d-356f-4729-847f-9d3810b47e70", "comment": "Malware payload (Gafgyt)", "value": "b5aedb2600b33e4813291b7d930de0e39e7dc10e69e06b205161b3d030189a21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352968, "uuid": "481ca3ec-523a-4393-bd38-d86914195a75", "comment": "Malware payload (Gafgyt)", "value": "bad05927fcb6a0f8cf70eb70f9b6951bae03301f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352968, "uuid": "d381eb78-8863-4b77-b01a-d4ce279eca38", "comment": "Malware payload (Gafgyt)", "value": "00e855e9b78cc0bb2ba5ecb036959f49619900facb824b20fac75323082a2a4cd3c90f05c31e8ad894c903f42c65f050", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352968, "uuid": "dd65ac76-fd51-4568-8247-6278621ca1bd", "value": "T11EA32B06F8118757C1D327B6F78F43493B3167B597DB3302AA357EB02BC279A192AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352968, "uuid": "5b2c3aca-b93c-408d-8395-2c3b8f6d7f16", "value": "3072:HOna5hZIxu5hJIvK8+Wj0+rQ0Knm4XATe:una58xu5hevKgj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352968, "uuid": "7daca464-aa73-45c2-9958-8897861138b2", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352968, "uuid": "f92aa319-6f6e-4530-b70e-dfabbfa116fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352968, "uuid": "06d0425d-0b17-4ab8-9763-6b437a881e40", "value": "b854bf9735dc3b34f24af27f712aea8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad16585c-e3a4-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654305695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305695, "uuid": "0079071b-2da1-477f-b68e-0087366b4944", "comment": "Malware payload", "value": "1688e7161d53f5b14f2a204fecedccdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305695, "uuid": "28339302-c29f-49e2-87b9-777754c7be00", "comment": "Malware payload", "value": "b731797b1fa5f3d360e8f2a233c8ccc2868f4fb188f69737fbeeca971a58f6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305695, "uuid": "4b5ba59b-9e92-48b7-be9c-d9aee7ecc8c9", "comment": "Malware payload", "value": "fc09dbf5d00bc963f97fce9b837dada09b70df68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654305695, "uuid": "e4d58233-1951-450f-b220-7b9a59018e6e", "comment": "Malware payload", "value": "09a619ac42c90ca3d6ac2d9b2bf054b2ee95a9ae3475a2f5d976f45c8506cc0eedab54bef26bc7575e0949ca392ae7d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305695, "uuid": "48a1c41f-fb02-406b-9e8c-113179a09593", "value": "T1F3A6330EB38B94DAD9EFC134C8524841E2A77C13C702869E5E34D9F9AD22F5DBE24B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305695, "uuid": "9fa0c124-b722-4e74-8e3a-5c302bd61f91", "value": "e879dad058fc3bf4e5241d9338e04574", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305695, "uuid": "47f092d3-91fa-42af-9f79-869e9c5112f9", "value": "196608:DGV3jAV/jcar4tPxRB5B/uLm7BB+jrc3fHr7FyMNB+F8GIh:X/jx4r/GeUcPL7i+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654305695, "uuid": "e095536e-1461-41ed-a7e5-03b6e8ab9a63", "value": 9901056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654305695, "uuid": "4f49cd5d-45eb-453e-bf0f-7e2ed6da79a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654305695, "uuid": "fbd15b96-eebf-4c27-93ac-0c5b9fe19adc", "value": "GetFans.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e323732-e461-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654386604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386604, "uuid": "7d6c8bab-e405-4f63-906e-1b3183d31d68", "comment": "Malware payload", "value": "d783b602f81983bb208340c43750a1e1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386604, "uuid": "befc48c0-0827-4378-a758-0220770763b8", "comment": "Malware payload", "value": "b76303320f150c909fc5dae0189915657fede3c9b20e17937c67fb4aad62068b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386604, "uuid": "7ff96e54-1ed0-42ff-b9a1-122928b7ff09", "comment": "Malware payload", "value": "1fc54b120f74170e1ef34c027bbaef802fc5cff3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654386604, "uuid": "003e1cd0-f4cb-40b9-83f6-53662a703726", "comment": "Malware payload", "value": "45331ea27a235bf826af02608ef407f445ab334c3a1f363adae3de0b4ed6b1d137a8a10c345ea5ebe00b3d5ab635a6db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386604, "uuid": "905dba03-7398-4e6f-8604-a9b3b1ee217f", "value": "T19563288CB703CFF9FC03057212BA97316A73D925A499DA81DB1D5731AD9B720AA1B24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386604, "uuid": "e77d9f37-515f-43b2-a3e6-d88f7996fd97", "value": "1536:Emt6oprm1RljGycZYL8JvqY/FYWrSNM3t8pt:EVhJpwJwYdHmm9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654386604, "uuid": "a23528a3-d41e-468d-8483-c08671f77b30", "value": 71820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654386604, "uuid": "483b2fc0-b37a-4d8e-8a2e-cdd1a016cbac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654386604, "uuid": "2c88296b-bf38-4a6c-9528-9aef1890ce99", "value": "beamer.x86-20220604-2350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38643ca-e43c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654371043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654371043, "uuid": "a358e30a-fb40-4691-98c8-518c709cca62", "comment": "Malware payload", "value": "7a5201fbe3906aa4eb1893c7a7317229", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654371043, "uuid": "521b5444-9983-4c4c-b39b-b71606123efa", "comment": "Malware payload", "value": "ba3cc1b44e807230e05e23024542f023b3a76d8a38e78b11e48277fa0f3b4e76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654371043, "uuid": "80821264-18a8-4ebd-8bc4-23d07bf9939b", "comment": "Malware payload", "value": "e4a80f0e303c99caf77eb1d87fe65e0a005854be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654371043, "uuid": "8e5fc2da-eff8-4a58-8785-d56bc59c7e95", "comment": "Malware payload", "value": "91f176ae55e7d495bbd19ff3afbd5de4c641ba7b7570350c4cea6d654080476a74391706f9b046cadfa5ad6a56fb48ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654371043, "uuid": "c49da8f4-aa24-425d-8ca2-8093f9c6a597", "value": "T186034097B6D6AD1BC9590B7604B342607727ED158F73820F2389F7261FB39904F036AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654371043, "uuid": "81875076-8a0a-41a7-b399-b61120e5d080", "value": "768:Ur+bxEtjPOtioVjDGUU1qfDlaGGx+cL2QnitYC/U:zbxEtjPOtioVjDGUU1qfDlaGGx+cL2Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654371043, "uuid": "a4ddba35-bafd-4745-be05-0eea788aba97", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654371043, "uuid": "75585381-84f2-4585-8a31-5817b9c7ca95", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654371043, "uuid": "f2504fc3-bdd4-48e4-ade9-5ef75b150efa", "value": "SecuriteInfo.com.Heur.6968.9502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04305afb-e39f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654303265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303265, "uuid": "9d2bcbab-de9b-46c7-b554-2e7ba495a95b", "comment": "Malware payload (Mirai)", "value": "e49c685efe6227025f8c93e996a29fba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303265, "uuid": "f7f8fad8-9dd7-46ee-a866-a784e7dc619b", "comment": "Malware payload (Mirai)", "value": "bbb9ced784d4216c043fc734f3eb1d17bc71c9c5a8b5f13de3afe1e1e177eb88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303265, "uuid": "084033ac-fd6e-49ea-86dc-b7529c7c68c2", "comment": "Malware payload (Mirai)", "value": "f43854243e59402ffc2bbe194ea7a46c737e3336", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654303265, "uuid": "5f3cedc3-be60-43e7-9c05-8a522b3ca004", "comment": "Malware payload (Mirai)", "value": "19239f7734d22238bfdd18a3a31f5dd93e3113fb613cca5787cec7af2eae07b00bbb3a764d583ad9318b5d1bf3f01a0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303265, "uuid": "cf9979b3-9e48-4929-8dae-981a80240aca", "value": "T14BB3D809BF601FBBECABDD374AA9170528CD650A21A83F75B974D418F64B24F09E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303265, "uuid": "ca569c22-c43c-49a3-9c53-bd07d51d8b9c", "value": "1536:57SYOTaTRsTbOq8yQjt0EWnySN6iIDWoZ9ZQw0iEMhx1B:BSY0aTRsTt7Qjg6iIqo3/xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654303265, "uuid": "ff00020d-4f60-43de-908b-925504c0699d", "value": 117720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654303265, "uuid": "8f2bd4ca-cb62-4da4-95a9-4419ae311a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654303265, "uuid": "28db3599-70e1-42a4-a07f-3a4f5bc3cdcf", "value": "e49c685efe6227025f8c93e996a29fba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccf9542-e426-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654361422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361422, "uuid": "cf52b46d-f320-48b8-ab9b-4eb618bfea57", "comment": "Malware payload (RedLineStealer)", "value": "a8e2c301625481fc3a096037190305cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361422, "uuid": "aade97c5-671b-43e8-b4fb-725a52551a1b", "comment": "Malware payload (RedLineStealer)", "value": "bd4472ff64aa75011274c6e5e1c4401d9abeec5acd673e06ee5c293ea7c5829b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361422, "uuid": "59870484-a330-47b9-b2b8-cff7a476b9ca", "comment": "Malware payload (RedLineStealer)", "value": "1d4b6d56017962730a2a8b80a6d9bf2d08ed4478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361422, "uuid": "306e7ac3-caf7-4957-8f6e-ee67e1341188", "comment": "Malware payload (RedLineStealer)", "value": "da0ff3e313f593c768a2580c1f12bc8375e8d8151505ee8f92033aacbe899ef75e7dc6042fe778ff9d144fa489914206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361422, "uuid": "bea1afb6-aea8-4f14-b730-fb66bdf66e18", "value": "T1C0B5F9036A8B4E75DDC23BB461CB633A9734FE30CA269F7FE609C53599532C4681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361422, "uuid": "a4d5ef07-5ed0-41af-ac77-826b5bf93370", "value": "0629c55152d38b4029f7de8a08e08d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361422, "uuid": "821b67b8-6c1a-4c84-9f43-80066f44a81a", "value": "24576:+PObB9TO1JawWLUG1uvSLqA37XGr0jns8MkzCuQ5p3h3Yz:1z+hbv+Lu0jqkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361422, "uuid": "daa7923b-d119-4143-8a08-594bed53fff8", "value": 2276978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361422, "uuid": "71a0b949-8865-49e1-8944-25c3986bb581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361422, "uuid": "037dc407-a191-4a87-965d-5f7a3ddb4627", "value": "a8e2c301625481fc3a096037190305cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee02f12-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352836, "uuid": "9a6f025a-fa20-493c-b8fa-469011c93711", "comment": "Malware payload (Mirai)", "value": "baf53ad9428c772f17f2d8745a453da5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352836, "uuid": "e01e8c0f-f453-43c5-b4bc-eb030bd2bd57", "comment": "Malware payload (Mirai)", "value": "bff4170f7729507d62d80e4680d90d2f1d4df4787bc180740babc9fd57432924", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352836, "uuid": "e808015e-4703-4876-8716-16edfbcefa00", "comment": "Malware payload (Mirai)", "value": "797b010093b5afb6e080fb11f4af6d6daeb38959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352836, "uuid": "9ffdb2b7-5a8d-4b6d-8795-94236302a4f1", "comment": "Malware payload (Mirai)", "value": "6bb845da1f01d95bd52c0e0e81b97753c3130f7a5c67cea5ec3b043a8493633eb2cb1a7b313a29ee85745530d62b7470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352836, "uuid": "cc57889d-1833-48e3-8aaf-295b1df59caf", "value": "T162C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352836, "uuid": "a7b2e4d8-1733-4fb0-ae6d-c3187c2efdb6", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8EphyDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8ELyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352836, "uuid": "1581a3bc-5bda-4234-ac88-a150ccaed32a", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352836, "uuid": "872498b4-476a-439a-bbcf-63f41dacb721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352836, "uuid": "5fe25515-cf94-437d-882a-7dba7c21d553", "value": "baf53ad9428c772f17f2d8745a453da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c865366e-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352986, "uuid": "151a8ab7-625d-4194-881a-ac510f8267d2", "comment": "Malware payload (Mirai)", "value": "64a4c77e2d2b99a29a3164f8fcedbbb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352986, "uuid": "f0436c3d-afd6-4691-bea7-92db9eb108a7", "comment": "Malware payload (Mirai)", "value": "bfff80fe10010e24e513369b0189fa6edabc23832574b1223a7badc269323a38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352986, "uuid": "befc98ab-1fb1-48db-b023-3d3bbce36fc5", "comment": "Malware payload (Mirai)", "value": "e8128d535f8266e16492e82fe4f5a59cc2258ec8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352986, "uuid": "d06a38b2-abfb-4310-8744-ce9772835d26", "comment": "Malware payload (Mirai)", "value": "5e1ee9d9ba6e0bffcc02191c1ba63ef3aed6aa27621ad9a468b05a48152d1e375a1403c9785707f5639133d97ab742b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352986, "uuid": "7de23b35-5d8e-49a7-bd3b-c4824ab17169", "value": "T1F3833B01E643C6B3CC8307B2029BAE661931BDAA5E2ADF49F31D7DF4AB128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352986, "uuid": "749e8e1b-b21f-4c75-9187-23544356e8fd", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8L2GDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YKGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352986, "uuid": "1aa3ab11-a306-4ec4-bab9-1ffa399c67df", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352986, "uuid": "f1a99728-fcac-43cf-9049-8564f12d8b45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352986, "uuid": "9823595f-9f38-4c1b-af07-a8c1fa4b81d0", "value": "64a4c77e2d2b99a29a3164f8fcedbbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140ce122-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654353113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353113, "uuid": "9141bd46-344b-4d7e-a7c9-378fc28ba89c", "comment": "Malware payload (Mirai)", "value": "8951a8b9e18a2f1f21237d7ece7db462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353113, "uuid": "5e802d3c-875e-4fa2-be43-7ab9ae3afffb", "comment": "Malware payload (Mirai)", "value": "c89a3fd95e35801a46c413b360d14f82d1c79267f4f60aea80da076729cccaa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353113, "uuid": "a79a0b3d-cacd-4f1b-b9a5-24fdc88ac443", "comment": "Malware payload (Mirai)", "value": "8f8b8853b3c1116f413bbc64117f575f2e328529", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353113, "uuid": "71b694d1-3f0c-4db2-8ae9-a728eb91f828", "comment": "Malware payload (Mirai)", "value": "a03875f951441c4e34f9e5e8776e11fd3ea217f1be2703fc7d53e65511dab424d74f3ac8af28f5242024f209eafff797", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353113, "uuid": "82d9ad3d-1b55-42c2-8f82-4f0adbffb033", "value": "T1DEC33B06F5518753C1C3177AB78F560A77232BB893DB3312A6247FB42BC279A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353113, "uuid": "048ddbf7-1934-489e-a53b-fc8d51199657", "value": "3072:LdUzuatSAhWN7Hp+fH605hpnKR4S3dmyDQUJ1UX4Tn:ZUzua4eWk605hpnKRxmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353113, "uuid": "d33f5350-812c-4b3a-84bb-592d3c3d72f1", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353113, "uuid": "4c0dafd2-9444-4031-93e8-dceba878a4a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353113, "uuid": "4b7fb40b-61a2-4f66-87d1-7569b130c872", "value": "8951a8b9e18a2f1f21237d7ece7db462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39079df-e426-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361514, "uuid": "185e3a40-3d38-4567-8ee8-10341ed07745", "comment": "Malware payload (Mirai)", "value": "8682ad86998bae464f491b4aba7d15b8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361514, "uuid": "f15f2549-6087-4c08-a254-cd01e896796c", "comment": "Malware payload (Mirai)", "value": "cdd69b8b075c68fb8936ee04d04adf21a8dc3cec6bd6aaa9721195f3845ec864", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361514, "uuid": "17b6afd2-be06-4500-b731-1bef7a20e58d", "comment": "Malware payload (Mirai)", "value": "13018fbe9ec039fe2baf91afb9c245a5a238c5ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361514, "uuid": "0a701a0d-50c7-42b6-b392-5a2d37955ec8", "comment": "Malware payload (Mirai)", "value": "c70165dad449ead48d61d30f7a375a59bda42f11da2d2cfc634803fda6c2517665727598f826ee9e523875167b7467b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361514, "uuid": "d0c27725-cebb-48ac-8bd8-c4fc24b18e7b", "value": "T16EB2D071D8DDFA7083709831D26A4C4B53851BF6E8F7365A170202B47ACAAA1F67C58B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361514, "uuid": "58bc0878-167c-4e79-bb82-203e8ff96572", "value": "384:2bZciv+WjgXQf2GWu75YZV6K5dFllRRi50ZUbsn/F0xxEGNYLbOAahymdGUop5hU:2bZcjWjgXQf2108Vnlle6Z7/F0xikQOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361514, "uuid": "27ddaf83-335b-45f3-b243-3c93b4930e12", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361514, "uuid": "41f92c9e-6c26-430b-9c41-0820f2cd6231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361514, "uuid": "d9bb07e5-47f9-48c6-8723-8e9a6011f64e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14f56a9-e441-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654373134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373134, "uuid": "76deb4da-d623-4460-9fbf-8f0211910076", "comment": "Malware payload (RedLineStealer)", "value": "a3e5a9e4f1efd0fd419a92d0cb4a21d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373134, "uuid": "413c0060-9f05-4ab0-8e5c-ce029635b408", "comment": "Malware payload (RedLineStealer)", "value": "d5c6241542064d3d7826d8edfffbd98b026d715e6ffbecc20034fcfb02dd24b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373134, "uuid": "72851e32-337b-4058-a34b-571a89f6ae7e", "comment": "Malware payload (RedLineStealer)", "value": "6946530d28eae623d0c5e758e15a18cce924fc29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654373134, "uuid": "0fa7a96b-235f-4170-890e-806b3cd75f76", "comment": "Malware payload (RedLineStealer)", "value": "9f5a092e6bcb90eefaa84b42f5263003fdd788cf8757431eac2678bbd755fc57e35cf9a56c6da95667c821917207bc31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373134, "uuid": "1e65b23f-6b33-4cd0-8106-14c13ba18309", "value": "T1DFA32BA477DC4628E5FF4F7468B010D283F4F0627412D76B5AC4A0DA1F62F85EA61BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373134, "uuid": "0ad63e47-2d12-446b-b7b1-dc90b0466d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373134, "uuid": "25652302-487a-4a0b-9fae-a61de8d66baf", "value": "1536:GI+zC1sK0XDlbY6cg39zTX/jbWti6TU6aU3rSvRpcbuMZz7QWh0wuei61LBDdB:AC1sK0X5U6ce+ta6aU3rcuxcWhhDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654373134, "uuid": "2e7b6c13-1b6d-411b-a3a8-bc31e388f929", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654373134, "uuid": "3ec03592-9a1d-4e97-98b9-8d08e793ad73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654373134, "uuid": "bdbbd902-2e36-4f19-b38c-9bad0af4c379", "value": "a3e5a9e4f1efd0fd419a92d0cb4a21d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a84d9bc-e444-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374384, "uuid": "77a5c7fb-74cc-462b-bb47-c3257d4bea6e", "comment": "Malware payload (Mirai)", "value": "ae5b6353558893e6b6b8b0ee6b2b330a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374384, "uuid": "03334235-ced0-4de0-a260-866842adaaa6", "comment": "Malware payload (Mirai)", "value": "da3ec0d6c8527a7ed71a9ca9bea9cc6722e1950c4133a546432780c560d91506", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374384, "uuid": "03f62044-1f86-4bd3-8793-d572ec34c123", "comment": "Malware payload (Mirai)", "value": "7d85505256acf946e7696643eb61e2cb5a4252e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374384, "uuid": "1aca457a-238e-423b-93cf-91b7b45f51ca", "comment": "Malware payload (Mirai)", "value": "27faeec60b74fbed63a10c8c9d34f946b341032e68e231eb1a6eb90221f0ab46e9a1a404e406973ce1ec72f9b6ec8be5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374384, "uuid": "28fde555-3f15-464f-b0d9-864016f34d91", "value": "T1C923A34A3E258FECF76D863887B79D21A758339216E2CA44D15CED005F6034DA41FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374384, "uuid": "77102603-3713-4314-84bd-30e1b0a949d2", "value": "768:xBZE/mNbNbNpAmWPX335x+q4mfZRX9izdrWXwhHaGaAL0amaZtaPtaGawaN6gk3p:e+l1za3XxRXkzdJHae/4sUoZQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374384, "uuid": "8aa8eba5-255e-492d-b887-4e97feff35d4", "value": 47880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374384, "uuid": "b52dac62-29e3-49af-8ed7-fac0d3c0c1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374384, "uuid": "63317445-2749-4f03-bb38-867eb3d824c0", "value": "ae5b6353558893e6b6b8b0ee6b2b330a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498e4474-e3ba-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654314977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654314977, "uuid": "00373637-732d-41b4-8dba-0e521fd19a29", "comment": "Malware payload", "value": "b38b1740fcba2c78cae1d564f07b3e9a", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654314977, "uuid": "8ac68093-9a03-4ab4-9023-5df5027f731c", "comment": "Malware payload", "value": "dd5d4da062f7b6363d3f165e76392b84ff455def8eeca2980b92f9295c364171", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654314977, "uuid": "20b9c9c0-76d3-4c75-90ab-087f92e45f77", "comment": "Malware payload", "value": "000e73aa8118504f3efd2e18d417cd4cbe1f8df0", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654314977, "uuid": "463c45b7-a2b3-45dc-b90d-126e5b5d98eb", "comment": "Malware payload", "value": "aba24ca2d3b07b8b22713e53abc50acce12053157a449a7e80e5682ecdfff1c2428574cfb620ee1bacb4e329f95fe5d6", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "PowerShellMeterpreterReverseTCPx64", "colour": "#BADD0C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654314977, "uuid": "c681d0ca-177d-49bc-a5e6-3328ee7b083e", "value": "T1CC61AF932151B8EA414287BF3D4D6BFA807FC224964A6045F78C4F99F9DDE233A8D6C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654314977, "uuid": "46deb3ed-3062-4db4-9882-d0a532f6d04b", "value": "96:tGTKSG/fuSHWFNgQfh5L0H9mAiBrVM2m7:ufGEFwH9mAiBrVm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654314977, "uuid": "cc2495a7-5b20-48a9-92aa-5e9ea2ed3e42", "value": 3235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654314977, "uuid": "a3ad0623-62cd-42ac-94ee-d72687b3465b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654314977, "uuid": "f5f31457-59f9-4eb2-a35b-d3e9332eec90", "value": "A0i7JNrW.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5251671c-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352788, "uuid": "ecd21afd-9633-478d-a70d-04726a997c83", "comment": "Malware payload (Gafgyt)", "value": "e416742453bfc5b6664d0307455bc3a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352788, "uuid": "e379c50a-7d2e-4706-9c38-cdc81af16789", "comment": "Malware payload (Gafgyt)", "value": "de08649a8cc42e0b7211902ed9637007179cf2398a51c83e55ba13fb53415361", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352788, "uuid": "c1512472-9e3d-4b96-87ea-85357d213eee", "comment": "Malware payload (Gafgyt)", "value": "b1b6f0b2e7d0f2f56f22c4e6342cf7d83f50ec7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352788, "uuid": "f505117f-5753-45a4-b966-4e588bb005d4", "comment": "Malware payload (Gafgyt)", "value": "9ad1e769732c413f1ca862810a59262833e436d428a2f7c0954d953bc6755cd6850de957f648b810e8b0b68242d56d30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352788, "uuid": "1bc35793-4421-473b-81e6-bf4dc6782cec", "value": "T1E2A32A37B7230A23C0CA547212E70731BBB5D3D928FA5247BAA16DEC6F166803562FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352788, "uuid": "361a457e-a7e1-4257-8972-dec8936a8dad", "value": "1536:iaW+VaNM5ZRDtQytHwdphaJH2A4KzO6F6OXj6ufeRTe:paN8ey2phaJH2pKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352788, "uuid": "61a83d60-38fd-4cbb-990d-d4d44038b840", "value": 102450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352788, "uuid": "59ae8590-49e1-4ac3-9fca-cf646612e50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352788, "uuid": "4367b671-7068-4730-81e2-9b3dfd753a7c", "value": "e416742453bfc5b6664d0307455bc3a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79e3d2e-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654353011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353011, "uuid": "db7cfae1-101c-4ecb-be81-1686a120fa49", "comment": "Malware payload (Mirai)", "value": "2d9bd99207bd8662e443176314d7f8fd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353011, "uuid": "c0f0856d-f5e2-4ea2-880b-51486fa84860", "comment": "Malware payload (Mirai)", "value": "e19fdfd3858bc05a0187cce8d034e33f240d35cc33bcdced22b3ea24accecfe8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353011, "uuid": "5bdbd7f0-10a6-44d2-a052-6d57afcde1ee", "comment": "Malware payload (Mirai)", "value": "a1ce1730f42b300cbaf806cb7da9dbb10aaf1298", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353011, "uuid": "b0634af2-e23b-4661-9ad2-f67dd98665ba", "comment": "Malware payload (Mirai)", "value": "a2d974bc1ce0e54c6e7eaf38cc7db9e22f59f214e207bfb208dc57bb9ae3be53ae5f03ba045af90ac8b5b4997e6cea4d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353011, "uuid": "3299a0cb-17cb-4f8d-b348-a6a3c5e4b682", "value": "T11D935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353011, "uuid": "be9ad772-1953-4389-ba42-f8dfc6d595ef", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK35yPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKpifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353011, "uuid": "e9a81ac9-b37d-40da-a57d-5df75154f536", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353011, "uuid": "917ee7a4-6c92-434e-a494-0493ed8a7cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353011, "uuid": "d17829e4-93ad-42b9-90c6-46f914d08094", "value": "2d9bd99207bd8662e443176314d7f8fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4db370-e414-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654353561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353561, "uuid": "76ed21ee-b48c-4888-a7e5-84200372a39f", "comment": "Malware payload", "value": "bfe289c6f91ffcda97c207f3c1c525a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353561, "uuid": "019a2e4f-44d6-486f-9241-cd2fa00fa601", "comment": "Malware payload", "value": "e2663d1ce192e322ff34230d8e81665c7763b2c6790e354f72b7de36dfde23c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353561, "uuid": "9d215e03-0ff1-475c-be43-8112ee0966c7", "comment": "Malware payload", "value": "d3e602d45f15666f96b599ae6b9caddc8b2cb4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353561, "uuid": "0c014f0e-b7bd-491e-bd5c-996d55db0ee0", "comment": "Malware payload", "value": "acf6683815a11d6fb1a56e5a37f47b09817b947acf5a2d780be45fc855fca0179e732ffea30e67050a76523d3fb8026c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353561, "uuid": "162e273a-b3a2-42e4-8b39-768700b1f093", "value": "T1CFA5BE12FB82C4B2E4830576516B9B7F8D3AAA205329C9D3D7D11D758C212D2AB3F3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353561, "uuid": "3ed71d1a-add6-4fc8-9c59-c87e7249f82d", "value": "ea8efe958d7a465d533da661db2a26b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353561, "uuid": "f965e6a7-b332-4790-b357-b5ab514ea489", "value": "49152:U5LfFr4Oln+55TDyQUJk/faVbvCPJ0h+1aG5YbtRqRs:U5LHln+j2NO/fax20h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353561, "uuid": "78b6e620-603d-47b2-8801-73af9766e38d", "value": 2237952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353561, "uuid": "5db8f925-0ac1-4233-9952-cadb873f8dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353561, "uuid": "3b201e22-c163-4d5b-8618-0e2d16a0d43d", "value": "ransomito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd741ea4-e45c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654384777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654384777, "uuid": "33700c4b-6934-4506-af8f-172f45b8920e", "comment": "Malware payload", "value": "9c9c429caeb4d335b51f0d877f8b3791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654384777, "uuid": "b717357e-6666-444c-8c74-2868df047e1b", "comment": "Malware payload", "value": "e48b44bd0ff3ebf702183859ebf288224eef5a584453a3615809d095e13ed745", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654384777, "uuid": "06832828-e626-4a80-aafa-7d648701183f", "comment": "Malware payload", "value": "8739cd57feab8a2abb094bc536e7690d9b2a27a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654384777, "uuid": "13de922a-3b90-4dcf-98ad-7b1ef98cf59c", "comment": "Malware payload", "value": "e8dbda70fdf297b134ba012b9e2efc972d54b5e4ed73b8a75140b217f0a6820fac2b46567ed99e9a34b5d208983a3d29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654384777, "uuid": "a51441ba-c6ab-4536-a05a-411bc56a79bb", "value": "T14B43964E6E318FEDF66CC63007B34A21A39D63D622E1D6C5E29CC5042F7024DA55FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654384777, "uuid": "a4ed416d-1af6-469d-b77f-3d443a1809fb", "value": "768:1IbdhHzUjZcSQjqugA6vY9cYFOyIktaehjqARX6Ie:GRFzUjqSDuov4traeYAEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654384777, "uuid": "3e06cc20-5591-4037-b802-4074f04e4d15", "value": 56592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654384777, "uuid": "5bba2d11-65de-4301-af2f-a308570b9719", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654384777, "uuid": "d2bab9df-9025-430b-bb14-78facc18e8b9", "value": "9c9c429caeb4d335b51f0d877f8b3791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa1a3ad-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654353043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353043, "uuid": "54b786a7-d685-4f07-9a53-762c9f181298", "comment": "Malware payload (Gafgyt)", "value": "0d6f93cf1c5dbfa45067ec25e23c532f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353043, "uuid": "8048abe6-d25e-426f-bd0c-bc7878d94577", "comment": "Malware payload (Gafgyt)", "value": "e75fa9c8d4d9ce8ff8c8603d242c9e7bc2b665105de0eb565a77fa6de0b4d5be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353043, "uuid": "790c982a-6ea6-4288-b9a7-823dc77ce86e", "comment": "Malware payload (Gafgyt)", "value": "cbc928af09bf4015f1175dcf573e3b40f02f7174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353043, "uuid": "c8488bb8-4891-4290-a441-b2405fa0db27", "comment": "Malware payload (Gafgyt)", "value": "d37da536a83154fc2301b7ff442af4137f56bf250d3688342a3533995111df7d35162e7613523f94a3e48df652c6c66b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353043, "uuid": "63f1c150-3ecc-45e2-96dd-7641e798ebe3", "value": "T1E5933C06F8415713C1C327B6F7CF47593B3666B957EB3302B6346EB02BC27991A29A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353043, "uuid": "74703236-e0ed-4859-a6b5-2da45334b4e5", "value": "1536:Z/3mn/f9VoXljp3GQxLU13xtOUyI5h0FKVo0NPMPj1jvVqQEqn/lJXCPe:Yn39eEQ8395h0FKVoK6jvVqQEqn9JXCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353043, "uuid": "cf0e2799-aa62-44b2-b85a-5ff068692a9d", "value": 96636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353043, "uuid": "4d2cfc91-8eb6-48de-8948-bd4a1dd4567d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353043, "uuid": "2e865c5c-e01f-4094-afbd-76ae905f0305", "value": "0d6f93cf1c5dbfa45067ec25e23c532f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ec12e5-e3dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1654329489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654329489, "uuid": "5cb7784c-e547-4174-9a82-65704f2d7777", "comment": "Malware payload (Amadey)", "value": "9066cb945a95ee185f54444dc1242484", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654329489, "uuid": "749b4ab6-c2a6-431f-9c15-9c3b638731f6", "comment": "Malware payload (Amadey)", "value": "e96c0c2d1af3d10b7235a4e9f86f4a5de41a494f875839d58c5582bffe35ad0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654329489, "uuid": "d6357158-68e1-4c08-871c-2483fdcd377b", "comment": "Malware payload (Amadey)", "value": "0ebb2104d3e5cccea7b24885cb5dfb0e732a8bc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654329489, "uuid": "72bde839-33c0-4026-b5b0-6c15c275faef", "comment": "Malware payload (Amadey)", "value": "28c7c869392fac18da5d51940eb6370d642ec46861c027bc9d426fae32130decf84be350fa6b38975cf3c6e9e25d7362", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654329489, "uuid": "9c13f869-4f7f-493f-bae0-eaf6e2f2002c", "value": "T105C36C73F1D08872D0B10E7CAD5AE6D8662EFE202D251657B6E94F4C6D3B2C2295D2C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654329489, "uuid": "91c1857a-71b3-474d-b780-b995b176e546", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654329489, "uuid": "c7664a03-0323-4546-b50c-21d2ee9a719d", "value": "3072:Yx7p5EJTJW+Rg/TwY1o9CeQepHOSNGwbQ6kUzlCN9V08a9:Yx781DRg/eCeZfIUzlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654329489, "uuid": "ff5d8954-2d96-4ec3-8307-2b235da890d3", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654329489, "uuid": "ed698255-80ea-48a5-8ffc-2fdd1ae70930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654329489, "uuid": "06727471-7a85-47e2-bc8b-2786aec9ec53", "value": "9066cb945a95ee185f54444dc1242484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58cbf8a-e450-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654379556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379556, "uuid": "415f0726-becb-4653-add3-b0ba4eab9c7c", "comment": "Malware payload", "value": "c89f84f50aca323d4d6b4f16aea03177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379556, "uuid": "bbd9598f-1863-4c73-a913-b7963a2df513", "comment": "Malware payload", "value": "eb9584ad3104f69ad4e2276257912f42340268c45613300675f715781ec16233", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379556, "uuid": "dcfa2fca-f28e-4dea-988e-47879ebe3c0c", "comment": "Malware payload", "value": "af16429d8cbeb865db8e301dfad5c4eab156e451", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654379556, "uuid": "25b0feef-dd19-4c26-89b4-1827d0581f5b", "comment": "Malware payload", "value": "40859bf849eb3519d5ccc3e59f5994b64c52babf64175666ce3f6027fcf7e3b6fa1005eff53ea2bb9551d48882ebb234", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379556, "uuid": "8c65ff0b-23a8-4877-94aa-ee2616c0cd82", "value": "T139B2A4C0CED3C126C88415FBCA7F11A08B7E8946E7236D1EDE88271865E250CD9C67F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379556, "uuid": "52d8c483-f754-4fa4-a36d-46d93c46850f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379556, "uuid": "6573e60c-3165-4290-a40e-e187afdfa8b4", "value": "384:eycewClCbS+Tc45URqjNeSvAWcI1pGIB09WV/2W:OXbb7WokoaIB0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654379556, "uuid": "d1c7a38f-a7d2-4fcc-a40c-9272404b6464", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654379556, "uuid": "a4db517c-fc76-4ac2-b622-9fb1d7a758a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654379556, "uuid": "161a35fc-694b-4fb1-85b0-075d20fcf1c2", "value": "RTGS copy 04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53096b9d-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654331744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331744, "uuid": "3b7ff160-8daf-4c0c-9cef-75ce4ae870d7", "comment": "Malware payload (njrat)", "value": "d0428f35306a26a7b5c0504302e3f3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331744, "uuid": "72a91d49-f88b-40c4-8bad-b06c6f5b48cf", "comment": "Malware payload (njrat)", "value": "ebc0ddb3a6b0dba07defaa837069ce4e340789325bb96534763126468b2624c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331744, "uuid": "8ef7a9e2-abce-4644-987f-8ba3b3637a18", "comment": "Malware payload (njrat)", "value": "e1900c84ec7cc2762f3d4fedfb4f426895f6f90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331744, "uuid": "d05eaab7-806b-49da-9ee0-0a9539076cf2", "comment": "Malware payload (njrat)", "value": "4382242d9e87df1cc7b5c7057fcdf2935919e573d0b9d06a9eeb2f5463c5d9856b5205e1168005d8e5e8494cfc394cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331744, "uuid": "1e27e217-3c61-4d68-9c82-a90628f4427d", "value": "T172B21A4E3FA98856C4AC17748AA5965003B4D1870423EE2FCDC450CBAFB36DA5D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331744, "uuid": "02ea9534-b260-4d4f-aeae-67a3ceb8d131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331744, "uuid": "f2b2f390-4638-4f48-bd5e-133e9adaa515", "value": "384:PweXCQIreJig/8Z7SS1fEBYng6tgL2IBPZVmRvR6JZlbw8hqIusZzZz3:wLq411ZRpcnuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331744, "uuid": "7259c6a7-c399-47d4-9251-eb400d00d7c4", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331744, "uuid": "ee29c492-b928-4c23-b835-245fd9f62493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331744, "uuid": "cebdb9eb-a417-4aee-9923-fd33b2708b67", "value": "EBC0DDB3A6B0DBA07DEFAA837069CE4E340789325BB96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dd92f3-e427-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361922, "uuid": "434343ea-2c90-4a5c-b499-ecd265dd4d76", "comment": "Malware payload (Mirai)", "value": "e95d006c33a440fa22e5b791a31662f9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361922, "uuid": "72b2d423-a0d4-43f6-b697-18dd780da685", "comment": "Malware payload (Mirai)", "value": "ec30479ca56951dc38a517c31bf2f24fe9357c1dc20d34c207e9a5c25e76702b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361922, "uuid": "a4c0ab4b-6240-4975-a0bc-7f0d271ad735", "comment": "Malware payload (Mirai)", "value": "acf8f35a54300e4ac3dc48ce72d2ef490f517a07", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361922, "uuid": "e8570845-9c0e-4b8c-8898-88aa4a8e8cd8", "comment": "Malware payload (Mirai)", "value": "759812cc40983a0c7e3d7f09f70ddf99b5896ff5d3175ed2f3d6e0f08fe23110c4ee1e39812ba1c8c8bf85e47a611345", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361922, "uuid": "8fa798ff-91cb-41ed-8185-279c7e2bb663", "value": "T101C2E180ABF65D0FF3BF4A78202495DDC4A64AEE6B6F0A731D11EA841D6072E5E00CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361922, "uuid": "095a88e4-db2c-40fa-853c-aa51b369b78d", "value": "768:nIogNUPcKfwfzoxAGXMDQ4Ay7Dy/Vy1cY9NSML:nZok7AOQAy7DC6AML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361922, "uuid": "a5f5bdea-e77f-4524-b1d3-17e9da0a2c80", "value": 25968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361922, "uuid": "3f2747e3-d3ed-4ef4-ac6a-bea06979f2ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361922, "uuid": "04eebf6a-f720-4cf6-88f2-77ea2458744b", "value": "e95d006c33a440fa22e5b791a31662f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95657fcf-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352900, "uuid": "68a898e0-0131-4d16-afc4-1b6bdd4c6155", "comment": "Malware payload (Mirai)", "value": "a7c545326dec2312d6dc4e56af60d034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352900, "uuid": "d6150242-02ab-412e-86be-73e56cde52a4", "comment": "Malware payload (Mirai)", "value": "ecc8cfe62aa25d304232120707c66ab079757dc6714a2de7c9564f05959ec420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352900, "uuid": "07929074-4ada-4bac-a79b-808c6dd65fd4", "comment": "Malware payload (Mirai)", "value": "99b48f7ce6e330f6a6ddc3124a8a8b3565bde21b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352900, "uuid": "1a3ae6b4-0f67-496f-9ab6-99b572e686dc", "comment": "Malware payload (Mirai)", "value": "41644dd9f58cc092bccfaf7f92d80de8a52a4e2f6e7a8649ee4621ec183f62277577b64bb33140e9cfe4e11e432195ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352900, "uuid": "5942ab5c-130e-43b7-8337-1f5d3fe324e8", "value": "T1BCC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352900, "uuid": "330aa5cd-1176-4c21-bab2-770d282357a9", "value": "3072:WkYPgPggnAb0JWaY/VfEEDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8EEDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352900, "uuid": "24200adf-3ef2-40b1-8f08-166e7c6c4a10", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352900, "uuid": "43fa704d-2fac-4716-99cf-0400f4a5e0f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352900, "uuid": "098c5d10-7eb8-4d7b-b508-d6224f4a5ee5", "value": "a7c545326dec2312d6dc4e56af60d034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1c124d-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1654331705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331705, "uuid": "d5cbb527-9216-4342-87b9-0f40fa379ba6", "comment": "Malware payload (ArkeiStealer)", "value": "4886e9e6113b0bbf05ec641989f324cb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331705, "uuid": "fbbe4379-7c9c-49a7-a460-3a9cb6a35c86", "comment": "Malware payload (ArkeiStealer)", "value": "ed1f2d8c625a0490cadb176127bded6ef65605e17ceba2b2501aa89a9f0be72d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331705, "uuid": "82c41a99-2f6e-40c8-aca6-1ca2e2b6bea5", "comment": "Malware payload (ArkeiStealer)", "value": "44fd271a9df64f61acaafaa0b110af695620745c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331705, "uuid": "a1cce830-fc62-4eb6-a6ff-bb9f217af84e", "comment": "Malware payload (ArkeiStealer)", "value": "62ce4739271c11d833c1856c82f0c44c2102ce6e57fca8c6ce6709f759a687f37320311fa9a98259b1a469386d25e4c5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331705, "uuid": "31365f33-6e15-4909-b6f4-e2bd92478d0f", "value": "T1AEC52A139A8B0E75D9C23BB4A1CB633B9734EE30CA269B7FF708C53559532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331705, "uuid": "b54ebe85-55a3-4ddd-bd3f-89aa981b51cf", "value": "1c09d997bba3225142a0281004608efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331705, "uuid": "8529fee0-ba54-41f4-a9a0-b9c56ead972e", "value": "49152:CoBu5Rsv257bOTgKRxG/6V50K7gNJvz6s2Lglc:CoBu5Rsv257bOTgKRxH50ekCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331705, "uuid": "6d7baca4-3d4c-4969-840b-da25f550788d", "value": 2546277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331705, "uuid": "4a915a68-ebde-4460-99b4-b324fe06d8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331705, "uuid": "9ab0de52-2382-4620-a8cf-b639ef5ca0bc", "value": "AutoInst\u0430ll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3562ef39-e3d0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654324393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654324393, "uuid": "fcd2ab7b-6603-45a0-b802-47bc9caa7e72", "comment": "Malware payload", "value": "1007f7fb05be2af75fcaf0f2186a2a6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654324393, "uuid": "6461cf4f-9003-4e03-a1cd-61c97e7afca1", "comment": "Malware payload", "value": "eddbb966e3d12c85ac39e8c14468bc8e347743f1b27124ab8ebd46882bb20f0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654324393, "uuid": "7f7f721a-507e-4848-ba91-ca29a68be933", "comment": "Malware payload", "value": "a6768b35122ad67aedc5b72606e698f373886c09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654324393, "uuid": "be234671-afd9-4c98-b4af-b1e9879e783c", "comment": "Malware payload", "value": "49cbd85b9fbf8ba6b4e0842282bfdd4bb1a264024cca0d4e408c9bbf65549ac8d7f3c0b58cb832c57eb7b13de7df1242", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654324393, "uuid": "bbe1773e-ad77-4fc7-9da0-5f21a3bac6b2", "value": "T1012429613912C071D560A1B619F5BFF6C19DAD15ABB049DF2B801F7BD6222F33920E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654324393, "uuid": "66910336-99b5-40f9-ad90-f501af6f5ff5", "value": "dd9df9b9e52b22adb197dae219c6a26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654324393, "uuid": "18741cd4-0c44-4d25-892a-e2ad2840775d", "value": "6144:I5C1a4NiuYo4DR3AY8Gl/SZBW+uNM+haq:IMXniQPSSLW+uNM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654324393, "uuid": "0d074c88-8d0c-4ca7-88d3-17c2210cb508", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654324393, "uuid": "c56f9a4d-761b-4305-84f8-7c5d9627069c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654324393, "uuid": "add6c82f-6408-4d0a-805d-2c4af425269a", "value": "1007f7fb05be2af75fcaf0f2186a2a6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a17977-e413-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654353146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353146, "uuid": "76c777fd-482f-40fd-bb30-86e006e26935", "comment": "Malware payload (Mirai)", "value": "f99c96d7792d48f8b76094df0f707c09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353146, "uuid": "8e7d76ed-5a17-4708-b9a7-1bde0de309dd", "comment": "Malware payload (Mirai)", "value": "eee7a14474abd67ce011e04276b41d849983e787db1dd6cec100fcf1b1cff945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353146, "uuid": "357a2d0c-42c3-435e-b4ff-b8cfb3c43bfb", "comment": "Malware payload (Mirai)", "value": "34bd2cf0a87fb94f2b39a92018f5461385218f13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654353146, "uuid": "a438e649-5f25-4fc7-ab78-abc9a4ee1f8c", "comment": "Malware payload (Mirai)", "value": "eb99a337f044ac8fc34d6e04954d9ef68d251940ff5fab4978dd3e892cea71e7bec1f925b9f791c238d21a32b536e2f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353146, "uuid": "a55d5f29-8e73-4247-b083-f22b8dfc45c2", "value": "T198E2E177A1489B34E6700839ED2513D6F30FF67C791EA446D6805AAAF5C6282F7BC213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353146, "uuid": "a68326e1-b87b-4bd2-9ce6-98296467b4bd", "value": "768:i0m5fVPgML7WGK0b01afPQ5BkcP0fq3UIok:45fVPdiG+157k2rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654353146, "uuid": "6cd9a321-ff97-4cb9-a3a0-95a90ad0014b", "value": 32208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654353146, "uuid": "c07e4f26-ee8f-4ba5-aa23-b9ab435d8f36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654353146, "uuid": "b1fd2fc5-1517-4f14-a5b9-79264cf537a7", "value": "f99c96d7792d48f8b76094df0f707c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4807202b-e44e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654378540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378540, "uuid": "e5bb323e-5441-464f-90dc-617172b6ed24", "comment": "Malware payload", "value": "b471e7b33fba79958bf738359b0085b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378540, "uuid": "db0cd62d-b1fb-477d-9bc0-ed03f9dc052c", "comment": "Malware payload", "value": "f1bceebf2e9ae9d352a7b1151abaa9f0efce6e9e41684b376dc6ef6f868b2ddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378540, "uuid": "5a97ef59-06ad-4d23-b055-96ba11206182", "comment": "Malware payload", "value": "e1cc32048321e9486fd2b28ebe7eb35352b43099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654378540, "uuid": "07f20ca3-3f2c-4e59-8c99-892274897451", "comment": "Malware payload", "value": "353bbd454fa7b12c62df5537e125aa11e9c2ae85bb763199cdb6ee379ef7bf697d98eeb74f1c313964262e24d4d4aad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378540, "uuid": "bea605b1-4e9b-49fc-9a7b-c733b4594a48", "value": "T18784012177F48473E1F39B3078B481621ABFBE422771819F6768922A9F207D0DAB5353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378540, "uuid": "8ed4e270-304b-44ad-9172-848ffca4001e", "value": "b8e78bd73afb771519a38767f795e9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378540, "uuid": "4ceb94a3-b52b-4992-b88d-0fafc64439ae", "value": "6144:NNELXDaaqh7aN0eH/ELkN23QwogFsKmd+4Wx8DWOv2R/:70DNfIMNxH88CIs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654378540, "uuid": "395f3563-aec8-4167-98a1-247c4384712d", "value": 373192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654378540, "uuid": "57e57942-9e87-412a-9ded-84451426591e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654378540, "uuid": "4282cce1-d29d-45c5-a9bd-34f4104566cc", "value": "SecuriteInfo.com.Trojan.Heur.Hype.wCX@ae0x35hK.2522.27352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d975f91-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654352914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352914, "uuid": "b510427f-b1b2-4080-932e-74028fb7fdb2", "comment": "Malware payload (Mirai)", "value": "8e576a71a03c22cc2693854fe8893c4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352914, "uuid": "12631642-1f28-4dc2-b716-987ef579139e", "comment": "Malware payload (Mirai)", "value": "f621ab132530945887e35d332963c292e5f4bf3c9c7d8196055e65f6f6fed943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352914, "uuid": "5550efaf-6e17-4dc4-9371-8995386c0687", "comment": "Malware payload (Mirai)", "value": "047401a13ff0a3a1664a85bd5e5c58c645dfe2d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352914, "uuid": "de235f79-2899-4f15-96e1-8c3f13075912", "comment": "Malware payload (Mirai)", "value": "248c98ca4c35b6cf5aea94c5495f5b40943ae3853afc21d01e943518ae2be5668c378d69990ee952354c7638c216bb94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352914, "uuid": "cd955b0d-d8e3-4617-a480-7a8763678c10", "value": "T17BF33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352914, "uuid": "9e43cc24-e63b-4e11-8f54-732aef039f9d", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RaqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISanAqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352914, "uuid": "ce0d5f9b-529a-4258-b249-22a8955ccc21", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352914, "uuid": "196dfc8a-f3f7-4d8a-9060-3da2d5fb0b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352914, "uuid": "0be1aa67-2016-43f0-a6f1-430d43c89157", "value": "8e576a71a03c22cc2693854fe8893c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4a333-e444-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654374393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374393, "uuid": "b7e2c59a-2447-41ba-a824-abb22605b6cd", "comment": "Malware payload (Mirai)", "value": "a4d251e8a9eb7c7778b24a9ae339ea57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374393, "uuid": "edaed24a-5c40-435f-9234-2f018073b56b", "comment": "Malware payload (Mirai)", "value": "f6431f754d0621c875b7210ff83dead54465a0d5140093993aa7d79fc884cf39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374393, "uuid": "bca3dcdf-e68e-4d8d-9478-481d0ebc5304", "comment": "Malware payload (Mirai)", "value": "24d99494a2a22184ed198a46603abc8bed4d509b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654374393, "uuid": "89e4c541-73cb-4d5f-ae41-865a674651d5", "comment": "Malware payload (Mirai)", "value": "e8548491ef4ced410f4a0b7c142d59a85c1ea534821b043707e1f4f4705c67d6481060698fc2a0b0d8e8a393bb5a6fcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374393, "uuid": "ad87f60a-e715-492f-a936-d8ae910ac328", "value": "T159D28C928A3E2D48E3594A74F1349F3D5723F919A7871EE6452382399007DDCFA2E3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374393, "uuid": "d41e25ff-162f-4589-ad94-1ab0c0fe7570", "value": "384:diUcIH/anlXQe3C7hGQhGwhRcHSNrrOpe4yr4M/y1cMK63WX+7W7dzA/foHeoTxu:QUcIfahQP7h3hXht11NzOoTxI7zLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654374393, "uuid": "936e3db3-a687-4ce8-829c-1ab682b815ea", "value": 30272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654374393, "uuid": "dfb66760-ac58-4f8b-95dc-49be50ce031c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654374393, "uuid": "19fc55da-23a6-4b7a-93c4-072b039e1033", "value": "a4d251e8a9eb7c7778b24a9ae339ea57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6e4c97-e426-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654361479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361479, "uuid": "c19d127d-4fcd-481b-ad63-fe32fea16c10", "comment": "Malware payload (Mirai)", "value": "73e9e5793bfa59c4be0b0203e787fd6e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361479, "uuid": "3aa49698-608f-43da-b7d0-c29bcdbbbf6b", "comment": "Malware payload (Mirai)", "value": "fd9d81680f3da5416a4f3a9a1a94af0b21b37ebb654871906e1cf22477e74b72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361479, "uuid": "e25566ee-7c18-4755-a30d-cc5e5a0e70d0", "comment": "Malware payload (Mirai)", "value": "258534db81061b7e3030382b5ba1b2ee6ea66a4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654361479, "uuid": "b55a46b2-8b56-4796-97ab-8aa64547ebfa", "comment": "Malware payload (Mirai)", "value": "aa1fe856c560073d3e11877de896d67a1f98d3c7daa233a6325db0021edca9a1a4d3ff2a11862f45ac857a7e5e50ecf2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361479, "uuid": "e91b9383-df48-4dbc-92da-ef3a16a8ccb5", "value": "T1BFB2E1BEF1654D68F290D03325F8C85AA486E38E96999AC9D291DC5728273193133FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361479, "uuid": "71ec86e4-3391-4e0e-bdde-f396b6740a4d", "value": "384:MbXcnZ4Dj8/hG15V6qtYI/0FvusRAy7Q1c61ZAEizUeb20v3y1:N4j8/hGvV6o0kyz7sypFK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654361479, "uuid": "5a081595-8258-4ace-adeb-9e5ed37db6ee", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654361479, "uuid": "eafc9c7d-51ff-49b5-a026-a6b51b95ace0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654361479, "uuid": "47bd15f0-8113-46e9-b3bf-c58fbc9a819b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768006c6-e412-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654352849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352849, "uuid": "f4459f50-0ddc-4b04-bf9e-c3324f37e4e5", "comment": "Malware payload (Gafgyt)", "value": "2e5f6f96dfa0a609e8991b9035dedbf8", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352849, "uuid": "205d6351-64c3-4f29-9e9a-eb8e5147cf4a", "comment": "Malware payload (Gafgyt)", "value": "fda92bfcc4f374736f1b3574d20102ba71658ad278f1c0147e94ec6dd0795fd6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352849, "uuid": "137a59c7-e7ea-4424-8ed5-8ae8afce3480", "comment": "Malware payload (Gafgyt)", "value": "71c814cb59bae3daf5f14a6b84347ed65726b599", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654352849, "uuid": "9f787070-67e9-4569-b639-d6afdcae959e", "comment": "Malware payload (Gafgyt)", "value": "e7ba1fde0fdb7971e85921ded9646f876c4fddc903f6b045df1da359e7269de7d27b9bd67ded274f97cbd697c10cef2b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352849, "uuid": "b23f60e0-50d0-4f78-be80-8b7c9e673890", "value": "T116934A13A653C6BAC0834BF417DB9A318923B5BD0B623206B3D4BCE67F169A61D5DF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352849, "uuid": "cc3736e8-c6cb-4be5-83b3-be7e92826893", "value": "1536:y7b7nwvyNC4+cfKIoNkX5uNjI3JphauH4U8umqOg6I9um2Xj5YZb0e:0uy2cffzJuNj8JphaE45pg99um2XFYZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654352849, "uuid": "4576e0b6-77fc-4128-8a2a-1b89aadcd30a", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654352849, "uuid": "66544d65-f40d-48c3-ab8d-466131988ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654352849, "uuid": "37fb327c-d94c-4b19-9eb1-07be92ec2e94", "value": "2e5f6f96dfa0a609e8991b9035dedbf8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ffd887-e3e1-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654331729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331729, "uuid": "4f7b6434-268e-4edd-be01-f5c41322bbee", "comment": "Malware payload (RedLineStealer)", "value": "2802091c1fdf1b5365a5fc6bdded72b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331729, "uuid": "1281409c-1bf4-48fb-a672-84abb1f366ea", "comment": "Malware payload (RedLineStealer)", "value": "fdd01894000e39d6d239cbc8b549afb38ed35c8ad3877a252bbdc8335198cbb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331729, "uuid": "fbaf179f-2cb1-496c-b39d-a8fa1c2a42f6", "comment": "Malware payload (RedLineStealer)", "value": "037890c2bcdeafd2650b925db7dd477c37bfbe71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654331729, "uuid": "abe7f959-e3c5-4f31-935f-308173be5cff", "comment": "Malware payload (RedLineStealer)", "value": "c5fee910c8a332d078b7031eab61d1049836a1a5dcfda6b94d5f39fd45af536ac4b6339d9eabefebdc3c8f01ca8b15da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331729, "uuid": "7708e86f-78cb-4036-8632-38d75cf4fd94", "value": "T158548C05F2B28037E832147359E881755E3EF8690F2559EBA7DD0F6E8F241F06931AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331729, "uuid": "4e641c20-e87b-4f4f-abfe-83550590a60b", "value": "763cdaefcf7886ce360ad2931861cb7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331729, "uuid": "ba00fcf2-9788-486b-9498-e5b85824ccaa", "value": "6144:TmIBUHiMHNdG6MzDAOGCozJxLJmhoW5xfn:T5BUHiMswCuJ5JmhoW5pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654331729, "uuid": "88d23601-6761-4c00-94f3-54ef89a3e93f", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654331729, "uuid": "8883e5d1-bff0-44fd-a557-9f03cc8ec311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654331729, "uuid": "b9988597-8ef8-4c9e-bb4d-854471a3e7bd", "value": "Kiddions Modest Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }