{ "Event": { "published": true, "date": "2022-12-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-12-03", "timestamp": 1670112181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fa083c36-6545-4421-a36c-bd614ad97589", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b3a504-72e7-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1670057419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057419, "uuid": "1237b070-78a8-4daa-a9df-f44f812dbead", "comment": "Malware payload (njrat)", "value": "691a39afe11e7f9d49332ca30a272708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057419, "uuid": "8d4aeff9-7f23-42b1-bfe4-a54902c9b1e5", "comment": "Malware payload (njrat)", "value": "00693c43c36b65ecaae75389c0b822e574f8101b9cd28255e85c39c08b2f58ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057419, "uuid": "4fcb5ea6-9b28-4399-86ea-26f399a50628", "comment": "Malware payload (njrat)", "value": "c315bc96feae17e521e40b2f921ff8c7de29368d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057419, "uuid": "ec43df57-076b-4b2c-bf8d-95cff1e451cc", "comment": "Malware payload (njrat)", "value": "bcac13048acf8c4f1cfdb36d2b8a1247b844d283bcb11b476282031b0e264dd02155ab9e7f24861562841b8c529d8797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057419, "uuid": "7dbe20d3-a0e5-4776-b7c1-9c552b8d1f21", "value": "T1A4A5E88DB684E174D5FF8BF0A492B2890BB19017A906D30F99F154DD4BB3AC09A11EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057419, "uuid": "8e86e13c-5a5e-4e63-b20f-c6a3fe665e11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057419, "uuid": "842e1f98-fe5a-45dc-81ea-436fa41d2617", "value": "384:TZyMeHkYz/wpa9GP4Uy277YiKMMQglhOrl9D9O5UE5QzwBlpJNakkjh/TzF7pWnl:dekKR4gh2/YtwgAwvQO+2R+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670057419, "uuid": "64634411-d2ef-4a90-8306-ea58a01001fe", "value": 2141184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670057419, "uuid": "b47b8e20-67dc-42cd-8ee8-09617d37379f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057419, "uuid": "62844042-da47-4b9f-aa1a-177020236371", "value": "691a39afe11e7f9d49332ca30a272708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5381f5f4-731f-11ed-9266-42010a9c0072", "comment": "Malware payload (zgRAT)", "timestamp": 1670081390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081390, "uuid": "a465ada5-a753-45fe-bcbf-edc7c561154e", "comment": "Malware payload (zgRAT)", "value": "88fd0328401a429aa8c774d2710bf71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081390, "uuid": "9ffd5f6b-8567-42df-836a-1713947b88bf", "comment": "Malware payload (zgRAT)", "value": "00eadc5abc36e748b8ada98d3d868688911459012dec484e0221c5fad0ac40e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081390, "uuid": "49240302-a6c0-49c4-be8d-5046917ee5a1", "comment": "Malware payload (zgRAT)", "value": "bea6991eb7e32d4fd741119d2c18b2473587670a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081390, "uuid": "6e32b74e-0b73-4768-a0f4-4863345f0fb3", "comment": "Malware payload (zgRAT)", "value": "70b051961e759231b1bd6fca0a2e8a48dfa4c88fc717f81646e87740b5550ab45202fc2277f4d895b82efed3cb8f49c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081390, "uuid": "ca7e2ea4-bbb4-44bc-8309-6926a21ed05c", "value": "T10E154B60B1998915FF79C7FC36E1644A309A1DE0A8B96CE44C6176C20F382C4EAF79DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081390, "uuid": "e43f0687-ca7c-419f-945f-67c857f849fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081390, "uuid": "b1db1724-8dfc-4b9b-a210-f6691d7446ba", "value": "12288:5I0wOZQASkg586aWHffgdy5boq+Vz4ZvajpSYsyu7sFZmLtoaDw0sMM:ybB5O8fggS1FCagY3OIZmLtoUBst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670081390, "uuid": "ffae3d3e-5ae2-45ac-8d7e-264552d8f896", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670081390, "uuid": "b3840d26-e65a-43f0-b485-02ed4baf6b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081390, "uuid": "1d799d33-9e26-491f-8b52-a6f9ca84fdc7", "value": "SecuriteInfo.com.Win32.PWSX-gen.18045.14990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7679cfd-72b5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670036111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036111, "uuid": "af0e8ace-5d02-4c75-8775-a0608deec24b", "comment": "Malware payload (RedLineStealer)", "value": "60322c15cacc364a3f4506472043a052", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036111, "uuid": "a08582b5-eef8-431f-8dad-acbf47bf9ed2", "comment": "Malware payload (RedLineStealer)", "value": "0299a20980ddd7749556106358966e3b032fbfc68f2f2001e73f59c4c4a177bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036111, "uuid": "8f1a9733-42c3-422f-b6ce-c946a961980c", "comment": "Malware payload (RedLineStealer)", "value": "056757dafdcb0ffd4ff5cc26f89f8fec150cd42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036111, "uuid": "e62d0e8d-161b-4a6c-b670-f6066ffea60e", "comment": "Malware payload (RedLineStealer)", "value": "4863ff09a43452f4d750e8b96a121bf36dbaee0975145b8b26f2af6ed43c91cd488c4dbd477586e41b01907e7fe67d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036111, "uuid": "45f5ed65-8175-4962-9d07-fc0f8f9da0e3", "value": "T11174CF10F590F476C15305FC8816DBA8BA7EA8321665990F37682E2F9F332E196723D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036111, "uuid": "38a8971e-da8a-4808-a2f7-7f39e06d20cb", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036111, "uuid": "ef4978fc-58ed-4670-b71d-b164861bfe3b", "value": "6144:k4YTIndL1L82bscRqyz4iSL02uR8+9jH:k4gedh3bshivHR8+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670036111, "uuid": "bb759388-365b-4623-9c58-e95bdd213809", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670036111, "uuid": "5dcfc9c8-0a55-4f6f-99ff-aeaa5df3cf48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036111, "uuid": "5e08d257-4a4d-4f6b-b835-9e34232dc028", "value": "60322c15cacc364a3f4506472043a052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb66f2a-72ad-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670032682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032682, "uuid": "3a507326-42bf-4818-b35e-40e1fe55d699", "comment": "Malware payload (Smoke Loader)", "value": "2692406483e2a3e9d220e4e503a997b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032682, "uuid": "8e1e5e60-4aac-4471-a927-a9540986803d", "comment": "Malware payload (Smoke Loader)", "value": "02a0c8d7962366d34a87f84ff77bcf54b25fe2c67a9494ca42ade273dc484655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032682, "uuid": "c6e96a9e-bdba-4ed6-9ca0-6abc7d56cc1f", "comment": "Malware payload (Smoke Loader)", "value": "fc3a80e55f81dce3c8b3a5151023e8d70d0dbf99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032682, "uuid": "f698ac6f-ff71-4048-b1ed-f94d8234fe42", "comment": "Malware payload (Smoke Loader)", "value": "9826f64735855f8ab20fe681288adea686be3cd2cbfcb4e2523269913423eaf1894384f22a03b36be8b0314d256156d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032682, "uuid": "65c6975e-401d-450d-8818-679d65aa4687", "value": "T1E374CF01F5A1E836C14601F88916CBAEAB6EA8315F21C50F376C2E6E5E732D15B363D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032682, "uuid": "785792f4-0ae0-4f31-ab86-f969fc7f94fd", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032682, "uuid": "bfcd7e27-4b80-4e34-bd06-b1e4b6a89529", "value": "6144:6x5IStLC8eLccRurdOKSSQMHtLbNjuRrkjK:6fbtkLcCKtQMHfiRrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670032682, "uuid": "9d2fb152-eef9-4c50-9225-bae16031db4e", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670032682, "uuid": "4e5deef6-b3f7-4c4c-866b-560d966edfad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032682, "uuid": "73db3490-bd50-4005-b29c-61251a58f099", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de823548-72db-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670052417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052417, "uuid": "f2b5c2a1-c9eb-478b-9a00-c03b24e98208", "comment": "Malware payload (Amadey)", "value": "2697ea9314e3dff0ef3fa5bd242890e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052417, "uuid": "15f500d1-8bfc-4530-9fa7-40b87755ce59", "comment": "Malware payload (Amadey)", "value": "057e8a1e78dd5f7726c815cafd059b1b9af9e7b523d1f885c43d4189c8ddbe32", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052417, "uuid": "cef5dc3b-b727-45b8-9ee3-7476023182d4", "comment": "Malware payload (Amadey)", "value": "68f6334f6e124322f1aff646f29d71f9d89dd7de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052417, "uuid": "4c8460ea-be48-4c47-ab36-dead5bc6444e", "comment": "Malware payload (Amadey)", "value": "44a3fdd5de1639b3d0772252229f0b729d3ed0e49800746545c43982503064a6cdfdad96dacaab57392cbac2f31c1507", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052417, "uuid": "586687ab-25c6-42ab-9b41-77c317140330", "value": "T18784E100F591D836C69607FD8866DBA8AA6DAC329521D90F37643E1E5E333E096373D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052417, "uuid": "428710db-5eb5-4bf6-a8d2-1aadd57ad918", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052417, "uuid": "0ae2c916-e94d-410d-a2b4-cfdc2f28eac4", "value": "6144:4pEIRJLr8e2IcR0Uo5NXFyEkT+RCkunznBDNOiwYuRdHA3Yjp:4OwJf2IPZDUTKEzBAPR63I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052417, "uuid": "aefc2942-0118-4407-8a87-c5071ee21482", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052417, "uuid": "ce6efa8b-5b99-4fee-8d7e-0d5dc683490c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052417, "uuid": "23883822-d179-41cc-8170-a88499f7a8fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a7181a-72a5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670028946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028946, "uuid": "a334645e-5446-4282-be5a-1e06adc39696", "comment": "Malware payload (Smoke Loader)", "value": "05aebc8e50bc8f93e9012a06e9fef51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028946, "uuid": "f6636801-4618-4647-8d32-7f08091a1ea8", "comment": "Malware payload (Smoke Loader)", "value": "072c8aab1c1044a305f5147378db7d14156de44c34240ccc42a83e620361eeaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028946, "uuid": "7b657746-7896-46ca-bfd2-64ed0cf00197", "comment": "Malware payload (Smoke Loader)", "value": "77b424a616fc2a2acbb1d88a4f069a3707befaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028946, "uuid": "6d9ad781-42bc-4a77-99ba-6d1e0d7afc0f", "comment": "Malware payload (Smoke Loader)", "value": "78176ef9a77cb984a9a8069a1f21a70f02328b9890fafb99827c8d1707ccd59b93783eddf38a8d90d45dcb3c9566b224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028946, "uuid": "89ecf79f-6491-4890-b765-74084a9fab64", "value": "T1FE74CF20F590DB36C18205F98936DBA89E7DA8325A64990F37B82E5D5E333D056333D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028946, "uuid": "e0afd752-1079-4b6b-a3a4-3884272e9327", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028946, "uuid": "bcccaabf-13de-4e44-a9b2-5c253f9d59e6", "value": "6144:4OaIlKLg8G9QcR+LaJSyua3lbN+BuRyqYILjK:4jUKO9Qz+Vu8NhRXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670028946, "uuid": "df01ce42-255e-4c49-9c06-7ee309edf36e", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670028946, "uuid": "39690fe9-e84e-408a-a01d-474c078229fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028946, "uuid": "5cb9eaa8-3ceb-4f6c-b26b-af8aaa1f23c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b51d55a-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091764, "uuid": "d82bd0df-d601-46b7-9024-ee9bffb21489", "comment": "Malware payload (Mirai)", "value": "cb8ebe68b903d49352c40ee492264463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091764, "uuid": "a916dc6a-da0a-48db-81f5-9e5df52548cd", "comment": "Malware payload (Mirai)", "value": "0932760ca91589e8ed146a238d5e65517d510d3e01d20029c7b03bf3a2d9bf62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091764, "uuid": "27c69a5e-1ac8-4853-9abd-93dfbcf8a388", "comment": "Malware payload (Mirai)", "value": "e4e27b2291cb0f46dd0236c76dd96ca3567eda82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091764, "uuid": "10abdf57-3357-4fb9-beaf-e9650babd996", "comment": "Malware payload (Mirai)", "value": "32648f4ed5c3aa08531d70047f4913d5bbbae16f6c6bce0f4c7897ecd36f8a274e419e6c7b5988a195f618324a304ddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091764, "uuid": "4b50efdf-2eeb-4841-bca3-d8714fffd3bc", "value": "T19013F897F806DE7EF40BA6BA51934D097920BBD616930B2363B7FDE36C321D52812E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091764, "uuid": "8d6b057f-b171-4ef1-b01e-1b72b9f2044e", "value": "768:j3eqgmf+w4+5SuY8wKOskrhve9cEWDkGFaQLDTAw:jE+5rY8wKwrhvocEw1LPAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091764, "uuid": "9cfc11f7-37ef-4075-9c81-966c27496eff", "value": 45556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091764, "uuid": "da115c7e-831b-4213-a798-d483608bfcb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091764, "uuid": "b5a15f5e-857b-4a42-83eb-ae714249e656", "value": "cb8ebe68b903d49352c40ee492264463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a35b930-72ac-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670031928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031928, "uuid": "8d27576c-a000-4e12-90e9-807a9db49695", "comment": "Malware payload (GCleaner)", "value": "ed1e03c9e389611baeb7f4d439e967f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031928, "uuid": "c7be6a28-c555-4ca1-8120-2d00f7f75164", "comment": "Malware payload (GCleaner)", "value": "0b0f80dbe05a7260261779d642bcd34d70bd9335525045526e56f2631a2c93ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031928, "uuid": "823b6892-1503-4261-95f7-48d7a84b3c87", "comment": "Malware payload (GCleaner)", "value": "b47cf394c533a0ed3d94ca7a880849336346d5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031928, "uuid": "338cd83e-878b-4bcf-8494-81ee27d0cdee", "comment": "Malware payload (GCleaner)", "value": "18309421feb8f86aaacaf139a01be3fcafd948232b8fe380a5a2960b37708f6190bd33acdbfbade4e30c9923402b9b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031928, "uuid": "447d1b3b-5182-4dc0-94f8-da20d849cfcf", "value": "T137A53307EEE09631F092C6FA1E3FC2560E1B37362574A8D972642CDD272F6519C06F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031928, "uuid": "9ae66fc6-cfee-4a08-9f5e-d2a415be3396", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031928, "uuid": "f1dd438b-a5c4-40a6-afcc-d01c88f8eae4", "value": "49152:sJgqDuVHf57pQLn+cV3+mm+pBeu7WYLERB/QJdAG5cyv:sJa57pQLTpBUYYSdXcyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670031928, "uuid": "ee806256-5c27-44d8-be4d-973be2529270", "value": 2210514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670031928, "uuid": "408ee052-e012-4add-80a1-9028f4853f92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031928, "uuid": "22d98e61-814d-4491-af59-1f065385e766", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c2b85e-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083251, "uuid": "d90978e0-e086-425b-ac8a-cb84c2da780e", "comment": "Malware payload (Mirai)", "value": "66096b07150633934428887b98bc3201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083251, "uuid": "a978dd6e-bd91-49f9-8c8f-8a7a38a1c97e", "comment": "Malware payload (Mirai)", "value": "0bbc818fc9b6cad38f060705857b5e960933f3c5d2db7082d4d410565db32096", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083251, "uuid": "134a9dab-b32f-4b94-87bc-86d463dec140", "comment": "Malware payload (Mirai)", "value": "0450d7f500cc6fecda70e5e17fa449764305abe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083251, "uuid": "767cffb5-7a15-41ef-bf12-d92ba1951898", "comment": "Malware payload (Mirai)", "value": "87d899ebb97be9ba4f625fdec0e09e04b423581032e42a90cd70440e716378bc4802f9ec817026d9eeaa52ef6f1d5717", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083251, "uuid": "c157e92d-bf9f-40c6-a211-09ada55769c2", "value": "T11FD2E152F95399C2FB7BD9A13A64C9C07B678BAE1FB8ADD220ED57513009F524A00CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083251, "uuid": "772fcab5-922b-4276-b84e-f76edb214442", "value": "768:1RtVr1QC5J4H2TO1/kcDNotffW31hdhbThb91/GC4uVcqgw09v:111QweWfWwf+315TV/GC4u+qgw09v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083251, "uuid": "d7317c2e-d83f-4700-8815-a93524f78cc3", "value": 28328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083251, "uuid": "165e2b47-02b8-4acd-9a25-e6724bae23d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083251, "uuid": "ffba2546-58ee-4b28-862c-942ac29e17b9", "value": "66096b07150633934428887b98bc3201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7242e1e7-72cf-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670047081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047081, "uuid": "1b44c743-71f9-497c-aeb8-3b6290af72f2", "comment": "Malware payload (Smoke Loader)", "value": "7f2e1135f02fac6cce97da5801d133fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047081, "uuid": "44306d03-b34b-419c-97a1-e7a1143f7ce4", "comment": "Malware payload (Smoke Loader)", "value": "0ca4fed1ffae372088077dbae18b04d62c98d8831ad5ec431c922c536bf9fb4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047081, "uuid": "c0b434a7-2b5b-4263-a784-4383e2ccdc98", "comment": "Malware payload (Smoke Loader)", "value": "fffe756642060366611c4c76b7bcd62d0a7ed347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047081, "uuid": "fac47d63-d714-445f-8f7e-df66cf9f1e4e", "comment": "Malware payload (Smoke Loader)", "value": "6754dff83f3f2c9e9c0d56985a0e1d48c0c1b6a12c4c5490d31e57d1c9985c98107ce07886d7ef3d8b57fcd194bbf423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047081, "uuid": "e14dd358-9b79-4afc-a903-1d3169101732", "value": "T1AD74D010F591C476C19200FD8D1EDBE89E6DA8329A64D54F33A86E2E1E333E166733D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047081, "uuid": "d5390aea-6261-42d6-b56f-f84a681482b3", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047081, "uuid": "34dd6ee4-aa8b-4b75-88cc-0279328f4293", "value": "6144:+K7rIreLe8R6vcRavIa8/d5GTEwXSJLuRAeZ2rjp:+sCeX6vZIDxlIRbZ2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670047081, "uuid": "67666a2a-1374-4ea1-8830-7ea05125f381", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670047081, "uuid": "b6e879a7-bf71-4182-b80e-dba8495286be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047081, "uuid": "0523f5a8-d3f2-4837-8c5f-fb95ef4011d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7068ceb3-72be-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670039777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039777, "uuid": "aad8aa6b-2217-4386-89db-6fec5fb7c732", "comment": "Malware payload (Amadey)", "value": "6413f32944f373f3d50ea8a700cabd6b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039777, "uuid": "08ecb5f1-c3c9-4c95-a8c4-af2bdb696f4c", "comment": "Malware payload (Amadey)", "value": "0fc057a03e797f7d564a5627103b30dcce9ab3041d13a0d74454907dd1a59ab2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039777, "uuid": "705ca1ce-d3f9-47de-8c4b-66c30d9fef90", "comment": "Malware payload (Amadey)", "value": "be0243fe2c6dfe462904eaf7531e179116772388", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039777, "uuid": "5305448a-f4b0-4326-b0de-39514acbebe0", "comment": "Malware payload (Amadey)", "value": "5918ae55673782d1a73a21362ad9833a389930c0327857657246329fe395e9a5cee643cf7cda096c3b4f3b0fbd519989", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039777, "uuid": "22c9f65d-fa2d-4322-9cb8-ca38db4b1433", "value": "T19084E101F1A1D832C58244FD9825DBAC9B7F68326665D5CF33A42EBE1E732D092763C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039777, "uuid": "e65924a9-253e-4253-a9fc-da902867dbfe", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039777, "uuid": "cb7709c0-8042-4fd1-bba4-06b7491c8ff5", "value": "6144:F4jIDdLJ8ur8cREM+Csq6qPCO0EA8W/KuRxvZj8:FIad1r8PJ7pqqOXP4Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670039777, "uuid": "af30bf13-8997-4806-badc-13f0503b7ffc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670039777, "uuid": "61b6d2b3-f970-47a9-a5ac-0414bec1b9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039777, "uuid": "297747d5-e641-4159-85c5-54ae5612b7d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ae92ab-72cc-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1670045683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045683, "uuid": "230c1a5a-35f1-4624-a081-40bd6ac2e9ce", "comment": "Malware payload (QuasarRAT)", "value": "6bd31d02674a8de7f52ce57811f98675", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045683, "uuid": "46bfd904-ccf5-451d-b04e-2711175d3bcd", "comment": "Malware payload (QuasarRAT)", "value": "0fd5478ebee0f93e857f417d335005e70c2fb1ea391530c9405bf1f68dd4e5ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045683, "uuid": "64b0866b-d101-447e-ba7b-2869db02838f", "comment": "Malware payload (QuasarRAT)", "value": "31c803e0f2772588e4d0e37b952f06b990284e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045683, "uuid": "667d77ee-f6b9-46d3-8369-b7cea05e0e7b", "comment": "Malware payload (QuasarRAT)", "value": "286436a2ebb2c8cfe2817a940767b476654b6a884440d97436b8286468d8444ce9297e82722fb4e6ae39e00a35c1a20a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045683, "uuid": "9f2a96ab-7ead-4143-9f7a-5b39f5682331", "value": "T150749E1373A4D63BE2FF173BE632062547B0D553B607E38B5A5856B86C123869E903B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045683, "uuid": "2f7324bd-1bd6-44a5-b4c3-661253ecbeac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045683, "uuid": "a0dc0d14-a282-4c65-b621-e9b1e5416566", "value": "6144:Ui6bPXhLApfpcwBuGeH2bU8QeDL/YDh/I+:nmhApJBuH98bfgDhg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670045683, "uuid": "f164c94b-da5c-4092-96e6-1f4a1a790355", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670045683, "uuid": "a019f925-176c-4838-9fc1-fad94e63961d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045683, "uuid": "16f8c410-c6a4-4d55-af0b-331e4711ff2d", "value": "6bd31d02674a8de7f52ce57811f98675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7ccea9-733e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670094585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094585, "uuid": "34618b56-b916-4a56-a4ce-31ef709112de", "comment": "Malware payload", "value": "ce9900e14a97293121190bfe5c0beb8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094585, "uuid": "feb9b699-7962-4213-8d56-95f70ed85b61", "comment": "Malware payload", "value": "1212ac208df0962b7d1347b0dadbbd54e83b9dd4d30c45f760544f27e9c0f7b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094585, "uuid": "5334b916-6ead-4482-b027-00d6081742cf", "comment": "Malware payload", "value": "3c898f7fcb8d629b319e2ffe82857257fe1f21d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094585, "uuid": "779c0a9b-a50f-4a0b-aa92-db2e13848b9e", "comment": "Malware payload", "value": "0d7b5ebf2d7c2e269eb5b4c3373a4e2dcd156b733d5b29d86ccc414189430119c2334a4e2dd42dba68c78b5facd3c0e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094585, "uuid": "035184b5-5df7-4a54-a17e-a1c9bf32a550", "value": "T184752209A7E15872DD66067094B84BB11238F831A7AECB4773C10B2DED713F16E6678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094585, "uuid": "2e1f488f-539b-44ed-b1ba-f57d98fde730", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094585, "uuid": "a1999be3-2416-428c-abd5-618b04dcffc3", "value": "49152:jN7UKV/itZgVKsYlkbEkX+zFdEMcAs6dn:J7UKVAgVnbJg7nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670094585, "uuid": "498ba2b5-f9ee-47f8-a030-8f81b4b2d744", "value": 1591264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670094585, "uuid": "4f615e45-7261-4a05-9096-0b9fc4d5c188", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094585, "uuid": "109d9a77-48ad-4445-975a-4f043620773f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923b7278-72f0-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670061308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061308, "uuid": "b6eaa9d4-85f8-4569-8df3-74b2e3be5f1e", "comment": "Malware payload (Amadey)", "value": "c71be19fb7be6c7952d290ecbd17840b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061308, "uuid": "c68477f7-db3e-442e-9389-e8c6ab90f41d", "comment": "Malware payload (Amadey)", "value": "1265fa173d61d90d96ed51e19f51455c4f26d142a57f65a96393cb866ace52f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061308, "uuid": "4d1b2e72-f610-41fd-85ab-708cbb1a573d", "comment": "Malware payload (Amadey)", "value": "fc8c1b27a5b36b8e845134c3259e3f124c30ea96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061308, "uuid": "5036b08d-81f4-4ffa-9026-e5f0dc800e20", "comment": "Malware payload (Amadey)", "value": "ef69c58c999b1a21b3150ca61bd1f80dcfc1eb6e09986aab4eaa124ac9aadc8906a922e5a329132b30de40316a64e836", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061308, "uuid": "34506ec3-64a3-4d5e-8edb-8a9d4ddcd13c", "value": "T1B484E0703AB0D872C5930577E026DFA1AF7FF4215DA198C727552AEE5E303D28A26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061308, "uuid": "5949606e-f30c-4b26-abed-a8c707bf3644", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061308, "uuid": "86e755db-5da8-4ebf-9691-3ea10e197b32", "value": "6144:zrfflAeetngAXjBDu7wec4nRdwQoIhQtfSAtko+oznMW2RqnQ/RVQYo:zrHlAeSXyBc4UROESA6YMW3Q/kYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670061308, "uuid": "d7f3d63a-cb9a-444a-85b2-95b74105ed27", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670061308, "uuid": "f934d604-fe18-481c-8818-2f18d73ed7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061308, "uuid": "2d23cdcf-cdfc-4dba-8078-3d71af100727", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad4ac89-72f8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670064786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064786, "uuid": "30799a64-19c5-4436-9a25-db7b10619a2a", "comment": "Malware payload (Smoke Loader)", "value": "067a8d32af27b3b8abbfbc8dc1925594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064786, "uuid": "25039649-7da5-48fd-b046-78f379af7c05", "comment": "Malware payload (Smoke Loader)", "value": "14227e8e788259eacce541a1094fb6c6575a24fcdf727c5e8e91874c00eb0fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064786, "uuid": "be1ea383-6af9-4ddc-a824-a685bda5d5cf", "comment": "Malware payload (Smoke Loader)", "value": "8f31ecd333eeb053d1004b9f6c8b6f254339b465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064786, "uuid": "932706e2-a8a3-4847-b7b6-9285418efafd", "comment": "Malware payload (Smoke Loader)", "value": "a12236559601c925b21bd63bb4887edda2fa0cd25818c4ecbaaf3e3686e3ec7235da59e2a8a21f4801658776bedfd3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064786, "uuid": "9ef518ed-84e9-474e-8b59-8519b44da826", "value": "T1EE74E03276B1C832C54304358466EBB4AA3FBD325DB499C733663A6E5E703D18A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064786, "uuid": "eab0f7cd-cf5c-4980-a5f7-ac19c4da51a3", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064786, "uuid": "7fcb1b76-4722-4ae3-9417-4754d3e51ab2", "value": "6144:pVSpbnAeew7zBzDPqnMW2RqnZ4LUbPYo:pVCnAef/pDUMW3q4zYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064786, "uuid": "a6cd88dc-1fb7-403a-8d85-2d9cf91c654a", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064786, "uuid": "4356f32d-9437-4740-98ed-968ec0ec1542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064786, "uuid": "3bcfa95f-dc98-45ca-a44f-a27e07c06fa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c6480b-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670043925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043925, "uuid": "91fa4b79-5c64-432a-9255-c87eca0b82d3", "comment": "Malware payload (Smoke Loader)", "value": "a76764e587d9f7034eb6146f3af5b74e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043925, "uuid": "a2c855ef-6936-447c-851a-cbfe97774271", "comment": "Malware payload (Smoke Loader)", "value": "1422e8248d71b68df240090e5bbbeee8854a7801cd79be5df59b8a3c24eadc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043925, "uuid": "4363a01c-7100-4941-87bd-183241795bd2", "comment": "Malware payload (Smoke Loader)", "value": "2c94eaeb9f5826ef6662ebe7f0d63669f249dbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043925, "uuid": "c0937ea5-169d-4c28-9140-abe69a91809c", "comment": "Malware payload (Smoke Loader)", "value": "f3dd6b2015cfb9e8ebf0b2673b40d50bae59b91e717fce4342fd467318636eee2e21c6d84e3be131fd79ab0a82db1a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043925, "uuid": "1158ce96-5b7f-4e08-ba42-35da97ae5d2b", "value": "T18674D000F591C876C18205FE4926DBACDA7E6431A965C50FF3A86E6E5E333D196E23C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043925, "uuid": "ff1daee1-d07b-4755-bef0-ffcfd8067c67", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043925, "uuid": "e5094ffc-d407-427c-ac46-222ac17ee649", "value": "6144:kletIEGLR8bLAtcRGOziMYapVkluJ4RT+KhuRpv2Jawafj8:kG1Gg0tpOziMOI6RT+KcRaawar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670043925, "uuid": "bdc965d9-02ec-43b6-8cea-244660ccb52e", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670043925, "uuid": "184fbeba-5b71-4219-8e55-7e9d008943d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043925, "uuid": "fdb8efb9-5edc-4ee5-ba1f-c597902186d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca2eccc-7342-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670096410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096410, "uuid": "87c022f3-615c-4cdc-a36a-3d32da5bceda", "comment": "Malware payload", "value": "266531bc43d8aa514ef4ac6bbf06fbce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096410, "uuid": "3abee22b-f8d6-4e10-bfa3-d695473b71a9", "comment": "Malware payload", "value": "1570f6daac9b4567a4c1f68da417ac43adbeadedc94a2ec92d8f6341f08bb85d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096410, "uuid": "71b65250-bcf6-40d4-ac3b-0e3c88e01f37", "comment": "Malware payload", "value": "f398542a6db9d63ffaa6b221792b561b045533c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096410, "uuid": "beae0924-ddb2-4059-a694-ca63c9ce3e39", "comment": "Malware payload", "value": "50b20eb09036b496adecbfce9741f93d6efa5d2b9f858a98f738d512dfe2b13933c1413754f0a5a4a1e4de225f7aa729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096410, "uuid": "29a7220e-b6c0-48e0-a68e-d59b6e86968d", "value": "T17C057B1139C28076C2B32C71076496B6556FB0B37B21CAEF5F94363A1F60EE05A3A56F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096410, "uuid": "f920fb29-8b84-4710-a3c9-ce3ee8d090b9", "value": "b889316d3a8b1477c173216ddf567051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096410, "uuid": "0aee8212-0e24-43b7-8d12-236312e10920", "value": "24576:rm5bRpdKx7w7eGXo3G4bZlZDckCo8xvQkf7Rh:m7eGXo2CDckz4vpf7Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670096410, "uuid": "84945646-444f-4534-a2ee-3f687e9d1d38", "value": 821264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670096410, "uuid": "e9dd265e-c5e0-4c42-b677-6bcd33fa2f8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096410, "uuid": "1b480f76-9710-4a1a-8bea-c58138e1b09a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f3849a-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051866, "uuid": "8cedfa8d-6466-4dab-a26f-099a6fee6c02", "comment": "Malware payload (Mirai)", "value": "4ea450bb89ceba08c5a9eee20ff54567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051866, "uuid": "6999db74-afa3-428c-b012-ea8d72499a90", "comment": "Malware payload (Mirai)", "value": "15fd6b5c840390589df5dd364e9aee0d379ad960d05bc4b02a838ecd0d07e6ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051866, "uuid": "c2f945c0-f5c3-4327-9b27-b46dadead43c", "comment": "Malware payload (Mirai)", "value": "28704f8dcc058c74abb65577f4aaf683939abd30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051866, "uuid": "32a4b9a9-28a9-4466-a84d-cab4a6cdc261", "comment": "Malware payload (Mirai)", "value": "21fc145793d58715db3ce4e46285a6600c36d1d26ac62d1555ac6fc858fa15b6372c7d4d74e5688559e6a6fbb63b99aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051866, "uuid": "d1c1bc12-b032-4522-8010-771d3c5198f0", "value": "T1B0B30837B7160A23C0C6547212E70731BEB5D3DB38EA5283B9A06DBC6F2A9843516FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051866, "uuid": "173a073a-e612-4654-b469-2c6d8ba6922c", "value": "1536:Fu/zxHGcLjNM5g7ti+Nt2lbc+phaw6Yq4luKzt4QFJOXj6wfeVTe:URjN8/+NWphawdq4luKzaQFJOXGwfqTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051866, "uuid": "318b936f-6a8c-4567-bb9a-02de076e2c90", "value": 107863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051866, "uuid": "7c6cc1da-31ba-4c39-a3c4-9d5e2666472f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051866, "uuid": "d9668a4c-3465-4721-93d6-cdc0959ab244", "value": "4ea450bb89ceba08c5a9eee20ff54567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad31ffe-72b4-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670035580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035580, "uuid": "306e3f6d-3fcd-484c-a5c1-c77632201cb5", "comment": "Malware payload (GCleaner)", "value": "ce410faeb4f1c34dc5d504f8d2f4ce9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035580, "uuid": "eea3f854-a6fd-4d90-8bc8-801e3744d1a7", "comment": "Malware payload (GCleaner)", "value": "17239f931b490c6bd71a20a36bfd45059827b1d375b7bba2f2d1bb0b5ec3a73b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035580, "uuid": "823374a6-99b9-4d1b-b5c1-a0ed8a069178", "comment": "Malware payload (GCleaner)", "value": "ed9fe427eed89d85b2eed73f5bbebaa15657d251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035580, "uuid": "56bf438f-f844-4d89-bd92-b985d60adcf1", "comment": "Malware payload (GCleaner)", "value": "073bbb9dd9866c11324c5f094bb7643bad0f82002a04061eeabddb55b947b5cbc651fe97ca07be4802c88c304d37e546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035580, "uuid": "c95ea635-5b23-47e6-911c-904dab76edc1", "value": "T12EA5333BAA924870E98147393A47831508BA7F6DEE448B9B31CF56DF4E72FC2C455938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035580, "uuid": "f7805b2b-0a75-47f2-b03c-6b68782a8806", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035580, "uuid": "d20bc470-7f91-4482-bb87-2cbb1403484d", "value": "49152:MkNU7Mg2Fn1hoAvoqAWWS+nYcRTHwAG5cy4:MkG7ynxoqjWtpQXcy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670035580, "uuid": "a002d00a-0b00-4504-b858-5bff6651edb5", "value": 2179367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670035580, "uuid": "c90dbec6-f686-43f3-ad85-d4e79ca26c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035580, "uuid": "fa65eaa2-7548-4c0d-930d-7401ae04f1e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32e74d8-72e4-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670056290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056290, "uuid": "6289ef7e-b56f-43f0-a9a2-641f5b1efeaf", "comment": "Malware payload (GCleaner)", "value": "3ae91d1a6caca01bdbf4b883ee3a0c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056290, "uuid": "2edb3f32-eed3-448d-b8c9-8e9344ebd8c2", "comment": "Malware payload (GCleaner)", "value": "17503c3f5da6219030d5cc66cc5c3f521f437171b0c2b820f1e0c4713bfb2b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056290, "uuid": "e7ab06a0-c3fc-499d-a357-460cc9edcfb1", "comment": "Malware payload (GCleaner)", "value": "dc75e912b328660399c2ff4585f24cd769b1d711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056290, "uuid": "3af64624-d03c-4d40-b27f-e021f437fdb1", "comment": "Malware payload (GCleaner)", "value": "e272595f5c9337bd00f5730bb6cf6334317655a8e7b48a42451f2e329d30e1d378cd8641527eb042b83e483552376e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056290, "uuid": "079b7109-13b7-440b-8040-67971ba4103f", "value": "T1F8063350AA254038E229AFB50E9DFA650DBF7F907AE4474E37AD0E197DFB1940058F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056290, "uuid": "0bc762a7-f0fa-44c6-a9a1-345b4c90c05c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056290, "uuid": "f119d81a-11de-4605-aba9-2c4fdf3d4560", "value": "98304:IiYdXAmy1rOo+r/qFUxEtr4PT4qbREwJpfJaYG/iXcy0:bYdXALr/GRGATjdXfbG6Xcy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056290, "uuid": "8f72965f-d151-46bc-8815-04486924be1f", "value": 3778213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056290, "uuid": "41384562-b12c-4e78-b1df-1071853d432c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056290, "uuid": "e51779f4-3b6d-40bf-9edf-09ef407f27d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b75c24b-732d-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670087443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087443, "uuid": "d31ad450-75c4-4cd4-9f4e-41bf11a21d2f", "comment": "Malware payload (Amadey)", "value": "752bba559141a2904f40d06c259fbcb7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087443, "uuid": "4e7e4abd-2ded-4f2f-a623-b1cf95c74089", "comment": "Malware payload (Amadey)", "value": "176a5ecfb2b460d5328fe95aa74e140ac17e72e00c21e688030c0899270324ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087443, "uuid": "b1771af5-de14-4bb8-aef1-086fb306db7b", "comment": "Malware payload (Amadey)", "value": "bed9f6a96e7bf3c5a74bb6a1d8898ded4341e84e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087443, "uuid": "ebea74e8-994f-4216-92e0-cca3918baf99", "comment": "Malware payload (Amadey)", "value": "a977b3a37882755eb49f4744295be296370fadd85c2434ce93b68354d838f13a5c2c29c01d040ff6f5078b05eb77cbc6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087443, "uuid": "c56d3d23-f432-4f06-8310-378ab4ecf7ed", "value": "T1A184E03575BCD832C59309388466DBA09A7FB9235DA099CB3759276FAF303D19B22307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087443, "uuid": "bfd24bae-fe33-4353-ae96-824e5d6b5ced", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087443, "uuid": "f9d03711-7e86-4ddc-97b1-ae8f4c5cbbf0", "value": "6144:8usFAPe6fOfCHJCohUUgxwJX2ONnMW2RqnTUY:8uMAPtNCueyJZMW3AY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670087443, "uuid": "8cdc3a9f-6c12-4e32-8469-3f00e59efd18", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670087443, "uuid": "5ba18e38-a676-4ed1-a032-1afdc0b60fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087443, "uuid": "8b7a39ea-c789-4815-a9ab-4955bec4fb8f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c319089-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670051796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051796, "uuid": "7f5e8d07-bf68-4266-b3c9-5f3480521895", "comment": "Malware payload (GCleaner)", "value": "9bd2600c98fb33c7f4624f6d9ec07d77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051796, "uuid": "c459fe9c-b638-4004-9a6c-87269410bbb3", "comment": "Malware payload (GCleaner)", "value": "17731d0f6e1d4bbc96ef8068e661b86ddb87156ab5c108160f0e22ac7f3f3d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051796, "uuid": "91d7ff66-1d23-48a0-997e-a467b5ba5b93", "comment": "Malware payload (GCleaner)", "value": "5db3d4ddb47b0d6be5564dd6b842e96d9e6dc5ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051796, "uuid": "6a0c51a2-d0a7-45b3-a027-15c868b74c54", "comment": "Malware payload (GCleaner)", "value": "2f37b5bcf9c814fa43b4bac315c4cef29e6a0331e8c12a161c1acb100a0a58162d90b447ef3451e4983f31392c0385a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051796, "uuid": "5ae566fe-8a10-4569-a217-f16d83bd0a36", "value": "T16A063303F7F01CF3E5D49B764E525A528D363A3A3C28854A19E8EE953B705C47E0EB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051796, "uuid": "bbb2c4d4-3e43-4363-b9c0-cf35700687b9", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051796, "uuid": "36f79abe-5530-4735-b2f9-a0b4fc2b184b", "value": "98304:sCK9k2EEA8olNE6btUQmv+z8EptRSgdEAoh2arx7y+6Xcyq:W92EARlyst98EpbDOZfQ+6Xcyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051796, "uuid": "329a2419-03bc-459d-b70e-3a46c73cb165", "value": 3774732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051796, "uuid": "15d0d6d6-3adf-4ed7-a2fd-f7e46edb28e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051796, "uuid": "9f2ea604-4fd3-40a7-9983-a985cb0be706", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47138562-72e2-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670055169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055169, "uuid": "69730bd5-4f00-43da-8ff1-bb371affccd5", "comment": "Malware payload (Smoke Loader)", "value": "1d0528e6f1058b198551b1cd7bf5d28f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055169, "uuid": "ae378ae9-e684-4f17-9ede-61e133089e2e", "comment": "Malware payload (Smoke Loader)", "value": "178c8bded80a5d73ee253905e40ca0572072aa16403e59aeaac19d0aed4dd7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055169, "uuid": "a8adc7cd-82b7-4818-980c-4cc5e2f8b3c1", "comment": "Malware payload (Smoke Loader)", "value": "87e13dc318be819e04e59b5740a0a89d082ddf0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055169, "uuid": "62f4d7e8-3a22-4f50-9def-ea1b7d2ae0ed", "comment": "Malware payload (Smoke Loader)", "value": "9a1c5c3c76c62c97e3d7a9cc4b7027aa66033009732a843939123942640140a48713148697baeecd92179a0979a8af58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055169, "uuid": "49c5ffde-a5fd-48f0-8d6f-cde097fe307e", "value": "T14D74D03436B1D472C197093D846AEAA1AA7FB432DDA0C9C72369277E5F303D1867734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055169, "uuid": "9da5d1d5-4be3-46d4-9101-001f832d1073", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055169, "uuid": "75f928fe-bcf5-476c-b62a-068f95b9d27e", "value": "6144:h6zgBYbaHYhZxJZ3tnvdBwNUeKqVRnMW2RqnoqUExYi:h6AYbaHe9v+9MW3odExY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670055169, "uuid": "a67b24f9-75c7-40ac-a0a9-3863865b0c3b", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670055169, "uuid": "6f296654-ea6a-44fa-afa2-6fceb087e8eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055169, "uuid": "8a44ed6e-2244-4071-b75d-d106748784d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3165fc8-7321-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670082382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082382, "uuid": "7d86fda7-ca16-476b-ad96-3d3d0b2261ca", "comment": "Malware payload (Smoke Loader)", "value": "09674aa4a2839ab8c8c5fa11e1978ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082382, "uuid": "620cd132-70f2-4ca4-89a5-5e1d7d18c845", "comment": "Malware payload (Smoke Loader)", "value": "17990e5ecafde8ac0332b0bc3a0c651aded98143e2b6d0a5132e683f6ef2768f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082382, "uuid": "7f4dfee2-1167-4974-8890-1c2da96d7d2d", "comment": "Malware payload (Smoke Loader)", "value": "407b5f9bf911a26064cedd61a9ee68ca5e8c477e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082382, "uuid": "7d1055d4-4427-4d1b-9159-f7ce2ca30ad3", "comment": "Malware payload (Smoke Loader)", "value": "7ce193e4e6a749b701595c716ebedfebd2e1936bf4544c3c41dd8548648d3bb8ea210a4bd1a8a30a78489c1349aabcf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082382, "uuid": "50ba1659-4c49-4bfe-9586-8b0ba15a4875", "value": "T1F874D03135B0D831C55305748426EBA4AA3FFC325CA599C737A96B6E9F303D28A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082382, "uuid": "08a70c90-8386-4696-8667-b246d9133279", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082382, "uuid": "85019124-6c88-4ec6-96c6-f1420d2ec477", "value": "6144:ZthSkATKoOjZlS6Ql4UsdBQl+9S1nMW2RqneetwlY:ZtIkAT4qJlmQkSRMW3NwlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082382, "uuid": "a03dab68-89ae-4fff-a713-b72765aab834", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082382, "uuid": "60f24849-f326-41ce-b072-23e44e793c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082382, "uuid": "e20cf3fd-541d-4b53-827b-7cb4700e6a2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb73d53c-72fd-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1670067068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067068, "uuid": "1af6ad32-186f-4a1a-8a00-0d61873af8e9", "comment": "Malware payload (RemcosRAT)", "value": "b9777bf51a4ba4e4e56a54420a6424d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067068, "uuid": "63f10be8-0c5f-42c9-b9fc-940a12968167", "comment": "Malware payload (RemcosRAT)", "value": "1810c71bdeb8e7ee7905ed34a5aa793a7036f6c099125c514ab7cd98d2823639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067068, "uuid": "acb8f92c-963f-4749-b28a-8d47c1ed7266", "comment": "Malware payload (RemcosRAT)", "value": "b40382576076e9434462df18c89f48452d63a2e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067068, "uuid": "714ba2ae-b2b4-433e-98c6-eba1052fdfbc", "comment": "Malware payload (RemcosRAT)", "value": "0c534e3e4e8293a57e201a1b8b70ce3adced07aac52cd8762f96efa46ebbc3688a5b684c72720a73fca9506852606f29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067068, "uuid": "5d28ec48-8ac9-466c-b896-5be818b56dab", "value": "T1DD220A01D3C84132C6B582B62CBB93468B31D39B5987CFAD789C460E7F6344583533E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067068, "uuid": "0528bab4-dd5d-483f-a582-782737fc8674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067068, "uuid": "d02e46c5-1780-4a48-bce0-dcaa0b2b76f1", "value": "192:jpcVHO17G6bsFUPpUcmyD8S48stYcFmVc03KY:tcI1b+oyiD8S4ptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670067068, "uuid": "ccfde32c-4c83-4ccb-aa50-49f02fff994d", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670067068, "uuid": "19db8aef-c3ca-40de-ae7e-c4947a77a08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067068, "uuid": "9865d433-c917-4254-ad3d-e84a5e85b98c", "value": "SecuriteInfo.com.Win32.DropperX-gen.26931.13262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2ed0bf-72f2-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670062342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062342, "uuid": "1bb89b5b-da38-4fa5-8a7e-a018b9697d24", "comment": "Malware payload (RedLineStealer)", "value": "b0a20a2f6a79f9773374de2933842093", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062342, "uuid": "e0c07fd9-f98f-456a-9027-41cab8712dd1", "comment": "Malware payload (RedLineStealer)", "value": "198fb046e30bf3991f698eb296859c4c5b1249ccb2f268cc4107dc472ad66d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062342, "uuid": "13976bfe-adbc-4951-9bcb-28ba8a515f50", "comment": "Malware payload (RedLineStealer)", "value": "21a95d3952dceb1bc16292a7dac158bca3197346", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062342, "uuid": "fde81158-3959-48cb-9734-ea51442c9e7f", "comment": "Malware payload (RedLineStealer)", "value": "25bebe7aedafafcb7f817fb1862b1a0191b87e900b6033ba1de0315d755160270ba645a32f3842ee1faacecd4e80f713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062342, "uuid": "a37e3985-fabd-4242-9eb8-55c63f71d614", "value": "T11CA4E139F694D432C592C1FD4821CBED5A3BA9314964D90F23A41E2F1EF73D0A6663CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062342, "uuid": "31762a55-c7c6-4301-acdd-5662652d99c8", "value": "adf05e4ae4084c6bf3a2c6a5da309837", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062342, "uuid": "2b46ac57-6183-4074-b7a6-3cb79a9264ba", "value": "6144:sTdmIxLcApQzpPBfePvfR4lkiyKw/LLwEnzST11bqUhD07oUDyhOYuRjMgU:ssmZQzKPv9dHDLwzXWUh4/DyARQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670062342, "uuid": "b70a80f9-7ad5-4936-810b-a4521ca26833", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670062342, "uuid": "317ff41d-2bed-44f9-ba74-cb443dc52205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062342, "uuid": "9a15a5d0-b8f4-4958-bb0f-f1d8641c33f6", "value": "b0a20a2f6a79f9773374de2933842093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d41ae8b-7339-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1670092519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092519, "uuid": "f692b619-f17c-4427-bf61-d2e4295d6b66", "comment": "Malware payload (QuasarRAT)", "value": "4560f14a33be8d42f2353cbe04a767df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092519, "uuid": "50536f76-8054-48f1-a728-e764f2e48d66", "comment": "Malware payload (QuasarRAT)", "value": "1aaf91f4a94f5cb96e94eb98c46c028c4994484ab06956d8cb0d37bcb9fdc106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092519, "uuid": "de91c10d-1400-4e7c-b943-591e01f3be9a", "comment": "Malware payload (QuasarRAT)", "value": "9cf76bef38e97eecd168990bf7c993af95b1e31c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092519, "uuid": "983f5f1f-6e7c-40b1-b850-dabe51f44f03", "comment": "Malware payload (QuasarRAT)", "value": "e2263ef29ab00effe31e1332ffe0ec70b9bec27e3a404e68afbba3176af696cad8e91a144e8bbb54870a3b1ddbf5cf32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092519, "uuid": "e13db0ab-a26c-4874-8952-31a979215e1a", "value": "T194B46B4023F8862BE17F5779E971042097F9F42BB2A7EB5F5540A2F92E667028E40773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092519, "uuid": "c93457ca-3f34-45a8-8946-c55057a6071c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092519, "uuid": "a411a905-cce4-4381-94cf-f0657fbb6edc", "value": "6144:pTEgdc0Y5XAGbgiIN2RSBbuS87XGCsWOkeSsoLmJcE6Nb8F9Q5OglOHocTR31:pTEgdfYVbgyaCoaBCqyK5iIcd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670092519, "uuid": "fe0a18b7-f326-4a25-80b3-e5faaa3481f3", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670092519, "uuid": "42118132-659b-4b2d-a118-196d318ed9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092519, "uuid": "aa7f7734-9433-466c-9a1c-167e9e048b2e", "value": "1AAF91F4A94F5CB96E94EB98C46C028C4994484AB0695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1317de69-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload (NanoCore)", "timestamp": 1670043915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043915, "uuid": "6292873d-2110-4055-be90-4c00f3416294", "comment": "Malware payload (NanoCore)", "value": "62b7c0ecb47b68b05081628459e105cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043915, "uuid": "52d875bf-0956-4118-83e0-ebbc668fa3d3", "comment": "Malware payload (NanoCore)", "value": "1abcc38e288d1e4c36001ae4ee4373d0dfaf32d4feb0710a25ad3c281b6eeaf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043915, "uuid": "6c551658-caaa-42ce-a165-5c3576fa29eb", "comment": "Malware payload (NanoCore)", "value": "9283a86f76ec327345ff66d2ff624fa8c17d5381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043915, "uuid": "8596769c-61a9-4ae8-8c78-53d1a2361ee1", "comment": "Malware payload (NanoCore)", "value": "0a2920486c7eb7f2090ccd6e9d1e93b5d25d4d07f35cf049f2671fb12d1ec73cd666d41294f7c252533ab9e7b97de17a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043915, "uuid": "dfcbe957-3f0f-4603-9607-552cc0d56dbf", "value": "T191151202F6CA8972D1B30A719D25BB99AA7C7E601F24DB5F73E4291DC7311902225FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043915, "uuid": "572eb4cc-ade6-4305-ac26-0d75aecb0cad", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043915, "uuid": "5f3e1ad2-769c-44be-99c3-9642cadab294", "value": "24576:LAOcZXMul6lFaXuuwHi4QYlfC3+speeCjV/YYPhrHGc:NHDj+IC3RhYHGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670043915, "uuid": "a4819b47-2622-4e90-afc6-0d5e4fb9888e", "value": 958636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670043915, "uuid": "f6ab2795-a02c-4be3-871d-fe4c51fdd099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043915, "uuid": "7003f5be-1fa4-4d48-9caa-ef6dd6161850", "value": "62b7c0ecb47b68b05081628459e105cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b3c2c2-733e-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670094919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094919, "uuid": "370190e0-e5ac-4311-add3-ed0528f46a28", "comment": "Malware payload (RedLineStealer)", "value": "035e9862f696bc688e3fa1e8a3b3ef5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094919, "uuid": "182517cb-0a86-48db-be90-2cff44c9e1fe", "comment": "Malware payload (RedLineStealer)", "value": "1b06b05b3d03c253f9bfa45fd2d02a982a0dcc4290a531ef0786b9d6092b041c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094919, "uuid": "8cc42d5c-cf24-4ffb-92ce-2c7e4329b62c", "comment": "Malware payload (RedLineStealer)", "value": "a6b67ea560443f641033ac293f766c8ac1cb9431", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094919, "uuid": "566f27ea-cb75-4221-9b9d-bf766ccb226f", "comment": "Malware payload (RedLineStealer)", "value": "9ecd0921288fb53bacefc3a98e573f759b23d9b770922bfad736119bb805ef63602dbef3af7316d71a09e6059846019f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094919, "uuid": "4f9c7ac9-6b55-4f41-bba9-2d5ed3d8a144", "value": "T1D876233373360244E4D5C83AEA77BDD0F0F61AAD4B41DC7891D6ABC5271A4E1E2A3A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094919, "uuid": "c8af9fce-a191-4aab-b6e0-7cd5e2c98a6d", "value": "653dea0e3b1e3126f101864257c9b819", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094919, "uuid": "0f4d1835-3794-4031-adc9-15a622b66a72", "value": "196608:ZkJEtBCqe74LOT1lv1HooVah4ncTDjT3Tm2Q:Z/iqe7p1lv1HMasjT3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670094919, "uuid": "92b2f627-2f4c-49b6-ac41-c3aaae9421ec", "value": 7629312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670094919, "uuid": "adb1c5bd-d7d6-431d-9a78-27aed171b8bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094919, "uuid": "1b213175-7f81-45b3-87e0-b6e2fb489264", "value": "035e9862f696bc688e3fa1e8a3b3ef5e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3aa959a-7364-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1670111159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111159, "uuid": "50408f05-c463-455b-9140-267b94dfb7a6", "comment": "Malware payload", "value": "ecfaa9552eae7dbe2d7a72ad600ecc77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111159, "uuid": "53f83d58-f550-4901-9f0c-e18249851e0a", "comment": "Malware payload", "value": "1b253c0e2be2b1a60983c8ae3af32ecd4f9f1d40575f405f9ca8e4c121970789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111159, "uuid": "30440ff1-43cb-401d-bbda-b2a40d64008c", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111159, "uuid": "fbb83c4e-a4d0-42bb-b773-5d411f97bd95", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670111159, "uuid": "4d47b510-9e88-4281-b286-b7ab4ec934b2", "value": 3617498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670111159, "uuid": "8f408b7b-de98-4ef5-8622-05cf107a2162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670111159, "uuid": "605ba864-c6c0-4aa0-8900-fcee1088f824", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6c8bfd-72f7-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670064443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064443, "uuid": "0ea67769-26fc-4359-a786-6838a2c80ffd", "comment": "Malware payload (GCleaner)", "value": "013c078da0b7681ecc796856946b64f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064443, "uuid": "a4e1a818-389a-47d0-8ebc-1edb7e605c5b", "comment": "Malware payload (GCleaner)", "value": "1b56e1151128555179824c4f7c95d0db43cdcc8f9919853aca8472d86439c7ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064443, "uuid": "0104182d-995e-468e-befa-decbbb602cab", "comment": "Malware payload (GCleaner)", "value": "140f35666aaad5bc7840bc6fa4355f8f819beb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064443, "uuid": "201f261d-e75c-4e70-b17f-9927b540ec04", "comment": "Malware payload (GCleaner)", "value": "5aa1a6d268a7616ac6a013446080789312d2c64386f807f24568785f9129ed047d33bbc3f13a14a11cb925944635b439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064443, "uuid": "19bca2a8-81f4-4b1e-a2b6-358d991a58ef", "value": "T112F53313A5BA8DBAD5429AB08DBFC0D01F337BC4694CEDDAE19ACE9C79874481C94F14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064443, "uuid": "2f678906-bdcd-4a5d-b94e-9683bd17f5a0", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064443, "uuid": "2b3e61d5-df20-4c32-afc6-1d34fae32168", "value": "98304:s0JHoulLzunCQYVVRL4TR5IUjj9kxDGJrXcye:ltFfuCnVrL4T/I9D8Xcye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064443, "uuid": "c5419691-3bfe-400f-af6b-792197bdec2e", "value": 3575252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064443, "uuid": "a15bfb84-5dd5-4353-9e24-eea841ae50a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064443, "uuid": "faf9a66f-e916-408f-a0fa-a509993d4ed4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b8266-7317-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670078136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078136, "uuid": "23d31232-0054-4811-b9f7-d77fdfdc6614", "comment": "Malware payload (Amadey)", "value": "819540cbe9045d2f904ec6e34c796ef7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078136, "uuid": "df0380df-8766-46c9-ab13-9beab62ab596", "comment": "Malware payload (Amadey)", "value": "1e3ed8f15fba33eb441a07abbe9ed13262454c30a826ed6a074e300ec74b3a02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078136, "uuid": "68f4c85a-370c-42c0-9c93-6a2f1997e4da", "comment": "Malware payload (Amadey)", "value": "2383a45f49df859dd72b3fcfa9b6ea23ed363a8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078136, "uuid": "3a7e72fe-8eb6-4045-8883-b3dc41312e3e", "comment": "Malware payload (Amadey)", "value": "6dfff7a48f674ac97851f98b82cfe4fc958210384f73d086b1823a1a5374ded28f6d44564209700a980f1972e4b3ac64", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078136, "uuid": "15c37e8f-c94b-4682-8580-7a40f414082e", "value": "T11E84E03132B0FD72C69355718436DB909ABBB8326DA196C73369266E9E703C1B763307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078136, "uuid": "1356fba0-3a21-4549-8175-97194187e1ac", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078136, "uuid": "65fe72e2-d904-42cb-9d05-828bb5c014fe", "value": "6144:F97IOA3K/uQTj7DeV5r913HNAnMW2RqnbEJ+Y:F90OA3GTvKzr9pcMW3hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078136, "uuid": "30f74a4d-9e6b-4ea3-8a4f-d29f8611eeb7", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078136, "uuid": "d1ec9094-946a-457c-a7ae-7430ab16754a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078136, "uuid": "7c9555de-8af4-4915-9f81-880994ca86ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c876259-7360-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670109376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109376, "uuid": "6713d03d-bbc4-40ae-8b2f-286fd7aa5ef3", "comment": "Malware payload", "value": "6ff0800fc7a3a244f03fdbc9c60e36df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109376, "uuid": "38a122b6-4428-4132-b34c-e95f73c06570", "comment": "Malware payload", "value": "1f0588ba5ba5818bf3f637f9d8397f829caa022fdc4eba73bb99b21a7b4cb110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109376, "uuid": "296b9d66-f424-429a-80aa-64df23d77686", "comment": "Malware payload", "value": "b24005b3c7690c038d2b0dda1bdde90c26f7dde8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109376, "uuid": "4df4eb5c-c36e-4d06-bfce-e065fe41a096", "comment": "Malware payload", "value": "dc4526a71b5fe4f11a05305412e13d75877dc79a519131d0a953f4257893daf38cb99e9846a31d72bb74c03e5e9f6f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109376, "uuid": "a2863577-23ac-440d-8052-fbae760dbed0", "value": "T15DF533718875537CF4626BFC0C23A3948D773001547CA5AD71EAD8EAEFB816E18D1AB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109376, "uuid": "36a03c95-199b-4c78-997b-d98c6fe151d4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109376, "uuid": "fa104a4b-386e-4887-9b9e-9e09be99fe94", "value": "98304:4fDBNB1iiWDfaWH9aBBXb/Edkd+y5a7gUCqnj2MvrXXcyk:QDLB1gDyWH9ctbTEYa7gURjvvrXXcyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109376, "uuid": "02202801-59f8-4e0e-ac58-bdd700fd9345", "value": 3579075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109376, "uuid": "96aab8e1-df62-4ba3-9c18-92b3c6a70346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109376, "uuid": "4b7b6cca-8913-4b6a-87b0-9f05da151eef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb9e521-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091820, "uuid": "ad8e708b-99be-403e-a969-5c0fcf742524", "comment": "Malware payload (Mirai)", "value": "8985a0c576b049b53f6fcd4327677467", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091820, "uuid": "02ade98b-5b6a-4372-b744-a70020d821b1", "comment": "Malware payload (Mirai)", "value": "1ff671cb34437749e2b0caee484925ec9da6632af0300adc7654ee3cb7b31aaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091820, "uuid": "a4430814-020d-4855-a089-971759017fb3", "comment": "Malware payload (Mirai)", "value": "bdbe0f7270cadec44f705db011f74b2812d6a433", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091820, "uuid": "fd35bf3a-d597-4ef0-aa99-c8241ea9f87e", "comment": "Malware payload (Mirai)", "value": "3e997425093ee9cd77652e0e0ece88738c0add0940c9071f52cd1c7ade0ac8d17a8a3c542c90f0b8e9670e79507194a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091820, "uuid": "8444b6d7-6d79-40d9-aefe-aca920cd1237", "value": "T13443A515BF614F73DC9BDC7306E91F01388CA95B16B57B267930E858B60B28B19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091820, "uuid": "24dc3117-32ab-461e-9fbd-74ba528e9497", "value": "768:sz3RbvDUjF0rIJYVkeF55YeGce+QdwVZlhuXidU3myyawbZ010U5MC:sz3Rb7MueWAncFQd2Zlhkmzb+10WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091820, "uuid": "4c728ce9-60ba-45f0-ad14-f0207a348770", "value": 57316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091820, "uuid": "fc918c07-4cde-4783-9c4c-75a4c83f6baa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091820, "uuid": "b055aa4c-368e-4472-95fb-0d56ed1d8bc2", "value": "8985a0c576b049b53f6fcd4327677467", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca1758c-729f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670026376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670026376, "uuid": "f99a6468-d666-4c53-95d4-0ecd08f4a663", "comment": "Malware payload (Smoke Loader)", "value": "418195053dc88ec720b31aabc62ca4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670026376, "uuid": "1c550732-ae15-4c4c-ac6e-607b1c46edc4", "comment": "Malware payload (Smoke Loader)", "value": "208c3bb92aa58a47e24911ec9eb97940d9a552044356bb3b3744411da56ee3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670026376, "uuid": "b35d02a8-e84e-473a-b821-c07df0baefeb", "comment": "Malware payload (Smoke Loader)", "value": "eed2970d68985d7bae9c9c813965aed7aea8aa3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670026376, "uuid": "c0e908da-ac0b-41a8-b503-5ae6992ffb94", "comment": "Malware payload (Smoke Loader)", "value": "0f3531095840810b063f3acdbe7d3345478b2632c20d1a215debe5bf0472a4533f7898db295cccbc2466fe8905238b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670026376, "uuid": "3debc090-1b37-41f9-bc0b-99f140a5a9c9", "value": "T16B74D015F6A1CC36C68201F88915DBAC9A6DE8325960C98F37A4EE7E5F332D153273C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670026376, "uuid": "619cc881-724f-4a0a-ab1a-0071604523b5", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670026376, "uuid": "a1027aea-f1e2-410d-9f1f-52b44b66cc6f", "value": "6144:am+IrSLu8e5UcR7QGhy7dYGFVq/CJqn7TuRausjH:anCSI5UMQGwYGusRauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670026376, "uuid": "41f88952-3ebc-4f69-9d75-741b866319b1", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670026376, "uuid": "80b0da09-143e-4e69-bb4b-7844bed241a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670026376, "uuid": "fef9fd40-937b-4fe9-aa74-d71ce6406afd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff069879-7349-11ed-9266-42010a9c0072", "comment": "Malware payload (Pony)", "timestamp": 1670099716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099716, "uuid": "05e8801f-ceaf-4a47-a181-292049ae90a8", "comment": "Malware payload (Pony)", "value": "046952a767b21ebe4c750e29a067cc71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099716, "uuid": "59fa1672-410f-4232-9c5c-ac71676dbdb1", "comment": "Malware payload (Pony)", "value": "231fa5e477b2133c25bc3d3eeb8928957f7de72d7b9a46f2b5845e449a39d1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099716, "uuid": "ffa2afdd-e642-4424-a791-aecfe3726f2e", "comment": "Malware payload (Pony)", "value": "4db90105c79ef980cb539af6f89e8c7f6878e15e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099716, "uuid": "25feefc9-6afd-4232-aeac-7c6db82780d1", "comment": "Malware payload (Pony)", "value": "d8eb6b5e2eb4ba4de6217f1600ee3694ea3143294159d7e50582d642dc225f06d952e75b7d54c4d9d84627d320dc9228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099716, "uuid": "c643ddff-0d4f-4113-b104-1d7b308df34b", "value": "T1D0A30903F881A0F1C1A12B717BC117A1E7FD9E797C3A8D5AFF4C498569B268B7B12052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099716, "uuid": "1de500e8-92f4-42ff-9272-21a886b34a42", "value": "fbab3e022f0aa68f4af07dff0d4cfb9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099716, "uuid": "d52ea84d-1843-405f-8f5c-30cb6b92a34a", "value": "1536:TqB8j9QqTMSyWiWLrhwrkdXvKJV44Ri8k2UkOjXihqTvwEKXkzZF:mB+pLrYkZvKJtO2NEKYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099716, "uuid": "1f2fe21f-d06e-4086-b5ec-848099112dfc", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099716, "uuid": "5a2ab5b4-d236-4134-85a6-b9556cbdb7d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099716, "uuid": "775e14a9-0a79-47db-b540-f93d26906ac7", "value": "046952a767b21ebe4c750e29a067cc71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0297f92e-72a8-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670030144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030144, "uuid": "5e164d5d-bd24-42f0-9451-1a6fc497b9e4", "comment": "Malware payload (GCleaner)", "value": "20e7eeaee2ed08e23c4b7c305ac075a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030144, "uuid": "ac6f213f-af2a-4a83-aff4-9c36e1075c60", "comment": "Malware payload (GCleaner)", "value": "23b73313e0d9fbc13803225da9a7f7d00bf46330f2b6c347d798715ea9bc654b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030144, "uuid": "ba875e10-69ff-4c70-a7d5-734116c536b6", "comment": "Malware payload (GCleaner)", "value": "83086bfb2ed5fbb4d571326574c9aebe7001c33d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030144, "uuid": "a9c2726f-b02a-4885-ae3e-f6d6e2deef61", "comment": "Malware payload (GCleaner)", "value": "b639fd1ac263a1b078aa577f7b09af6e8059b012cfc813bb5021b3e46aa550d5f8a1e25b944ab8039259061ff3ea9301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030144, "uuid": "225f8927-d109-4f71-8f9b-7f3ca5e0036f", "value": "T1ADB53353E65F83BAD080D6F8EECD455108B7BE162D21EB1C3DDDCFEE1AB29896815900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030144, "uuid": "f9cd5b2b-5bcd-464d-8398-bb2324aa8f85", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030144, "uuid": "4a874370-d79a-4acc-b130-20ba2495b954", "value": "49152:0PzSD2HCDBGfA4H43paSsevzpz0DU57Y6Gsf9xrtZn40XAG5cy/:0PzSDiYGUpaSsKzpn0RizrtW0XXcy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670030144, "uuid": "08387702-d160-4c36-87b4-cdbbe0f42413", "value": 2324031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670030144, "uuid": "9fb2e69c-8fed-4652-b08d-d8fc76b5f9be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030144, "uuid": "8b400fe1-d2fe-45bc-aa7b-b64d819e3af7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2072bf8f-72f7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670064124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064124, "uuid": "3fffe8f0-b24d-49b9-b479-3f58520dbcb5", "comment": "Malware payload", "value": "f4740b290794d92cecde434b5e4fa6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064124, "uuid": "06efdb24-41a4-4278-bee0-42165adb233e", "comment": "Malware payload", "value": "2422e3606773e75d47f599ce9a54a268a72fe4c2e682c1909efbfbfb18bf1124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064124, "uuid": "aaa1302c-5276-48c8-8bf5-2db1e323f202", "comment": "Malware payload", "value": "940f0cad1e0c8aa5f2ef0221b3da06a813e9d4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064124, "uuid": "bb45063a-bc7b-4420-8790-63c246291ca7", "comment": "Malware payload", "value": "8e4c40ff41599da22e1ff57a5fca2187dfc9ef187441cb8d163537a11a42d2dbbaf687a607af8c96b5dea67a8c3f2411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064124, "uuid": "74b48872-c22b-405d-899d-383c3470be25", "value": "T15032E806B9B2DCB3D5B70BF444A48A85DE5B76B957F1C1150E3C815ADFA72800B3732A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064124, "uuid": "cf2c7f52-afb9-401b-be99-93e9b35ff967", "value": "192:uKxHRp/Km0n9nnnnnnnnnnLuck7RxJ0zB:3HRdFMuc0OzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064124, "uuid": "0daacc3d-9f24-4876-a27a-f1577020c3b5", "value": 11944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064124, "uuid": "19c53314-f870-4eb1-b09b-15b36f81a3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064124, "uuid": "f9cc372c-3cfa-4b35-a01a-8f283592dc30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855d2f9b-72c7-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670043677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043677, "uuid": "cd535f92-2c3f-4b41-9b29-5f877728b873", "comment": "Malware payload (Amadey)", "value": "e0a46052cb0de54eb7fa4cf76e77ae7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043677, "uuid": "6f82fcb5-0995-4232-a6b7-b0e6cb0c6b99", "comment": "Malware payload (Amadey)", "value": "247e4c43ca8d254cf3129577e2c42dbfbb7df2d61b0ce263fb7637e9b91681e5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043677, "uuid": "b0e010eb-55fe-48e5-9e4b-b3845f77f49b", "comment": "Malware payload (Amadey)", "value": "bc69447e33bcdf5afbd7db9a4f732de70ae392ec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043677, "uuid": "2a2d2079-0b57-4f1f-8969-7b4aa3508b9b", "comment": "Malware payload (Amadey)", "value": "aa6e5dbeb5ea9d411965492de294f42b2d4c71fd7489889e707113b71e0b8e47e8e85da62bb385e94eb239c27256952c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043677, "uuid": "8ebb4a7d-a125-493a-8cdd-03cee03d7610", "value": "T13084D001F591C836C58205FD8925EBA8AE3DE9315A61C94F33A46E6E5F333E196323C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043677, "uuid": "e1eafdb8-8607-4d52-8875-020e1215aca1", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043677, "uuid": "28d7cd96-e6d2-4435-b0f7-ab67b84ffcf6", "value": "6144:iayI8TL48ilkcRdmaViOBIFBC9Z6gEDL1tJruRIAj8:ibNT6lkymasf076gEDLvJaRIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670043677, "uuid": "837b195e-5257-4003-a835-7cd00e1ec87e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670043677, "uuid": "b71b95c3-07db-457f-be7d-add4f0b1af7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043677, "uuid": "6eb10980-38be-45ed-836a-6f647bf6c386", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26706a40-72e0-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1670054256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054256, "uuid": "792f6ee8-10eb-4e72-a6e2-98df2d40034f", "comment": "Malware payload (AsyncRAT)", "value": "220e9238b05cb802d63f7d79d11b2a32", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054256, "uuid": "4bc7031d-7b5e-435a-a3c7-bff5af24559c", "comment": "Malware payload (AsyncRAT)", "value": "248d8893d926c765d168bd48211650094dbcf8a8988c448f3b271c41bec8ca9d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054256, "uuid": "a9ab3286-1c74-43d0-9d4c-99368db88380", "comment": "Malware payload (AsyncRAT)", "value": "77324ddee92b5ee1c2d50680ea15dd6e28ef402b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054256, "uuid": "93322e9a-f20d-40dc-91ae-dd9b6fa06698", "comment": "Malware payload (AsyncRAT)", "value": "d4a16e066254249598c107dc394482f69884f09fef36e4d89c3cd0f68e675dc97dddeb5cba868c6daace379cba87dbf3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054256, "uuid": "6d5e4419-77d2-42dc-a93b-70d6f1d95e86", "value": "T1CF644A243CFF502EB1B3FF926FD8F9E6DDAEE761265B606A1042030A8612D81DD5253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054256, "uuid": "4a59c56d-a88b-4b68-8923-70fb58ed74ab", "value": "6144:bgkc0c/OjocmHEk4Oz7XzoUdd9qkcM1E1nvwmtPEeJDCiRO9jEYMJD:bgkc0c/OjocmH5XXEUdd97t2Vvwm1Ee3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670054256, "uuid": "eefb1ddb-5c48-4065-b7b7-77af034b475c", "value": 317532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670054256, "uuid": "2d5356c6-9220-4177-aabb-bdbff5a4ae3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054256, "uuid": "a9306172-a8fc-4b48-b205-bea861acf3a0", "value": "b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35397141-7313-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670076185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076185, "uuid": "41b0fc48-ff37-4b28-89bf-f037de5e81f6", "comment": "Malware payload (GCleaner)", "value": "4c76aea0dfd8d8806be0642452448adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076185, "uuid": "f0d9fdc7-078f-47a8-bd99-84d9f30b3a6c", "comment": "Malware payload (GCleaner)", "value": "26e3e14dc540c4a43f55e3b64c304db0d7058ab1c3dfd6a8e447963321e0e202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076185, "uuid": "b38f89d9-ae91-4ff1-bf09-ab87dde50bce", "comment": "Malware payload (GCleaner)", "value": "2dcd97c170849fc881e6ca14d8ff27e53fafb495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076185, "uuid": "f46760b4-9c1b-4191-8032-ccc9de5398ad", "comment": "Malware payload (GCleaner)", "value": "b3cd2e7b981de8b45d3f1499d799e7bdb296d30b8ebb76fefb7a88457b32a70ff392e1b21394126e8dff548d8d0e6c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076185, "uuid": "2c13d109-a136-4c36-bd48-9ed895939f38", "value": "T10BF53367BBC91139C1269B322EAFF9CC0D3BB81448BDAF4681E41499BF3F8516812757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076185, "uuid": "879ca517-9cb9-466c-8ab0-65669ffcb700", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076185, "uuid": "49fe4249-92d5-4f14-b610-cb90910cdcb3", "value": "98304:g1UUCseN4ctX3TgbwPwaakQCgwTz8XcyT:5UCHtX3Tg+e7C7kXcyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670076185, "uuid": "7af1fe9b-ba10-4743-af9d-71ee8422faeb", "value": 3584152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670076185, "uuid": "becad121-0136-4257-b15f-f3db65de03d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076185, "uuid": "12742f1e-55ac-460c-ad55-31809d06621d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845b707e-72fc-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670066439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066439, "uuid": "e207c59d-2b58-4484-97f0-a0d5ea872551", "comment": "Malware payload (Amadey)", "value": "304ab6bb2439516194da25b15417f53e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066439, "uuid": "44b84e7e-f16a-4353-bb36-a3f36c28f073", "comment": "Malware payload (Amadey)", "value": "27ad85574664904bf50fd154f110b2920ab14c32228b74aca5d0f584dce991e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066439, "uuid": "b305b609-efec-4178-8562-20e3ad0981d2", "comment": "Malware payload (Amadey)", "value": "46694afcc0e10a05911d343e35103a25d02e9e12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066439, "uuid": "4e149e75-e9f5-44cc-ba26-28db8e7f0ca2", "comment": "Malware payload (Amadey)", "value": "4355450d7a10d659cf1acf56242929bdf3a7532a6ceae1e66d80054899e5d21c1c0b1d83d868d1a675b93896956dd960", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066439, "uuid": "dda2f60d-9077-4860-ab4f-ed175726128e", "value": "T10784E035B2B0E473C59314708067EAA59E7FB832996499C733662AAF5E303D19B73307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066439, "uuid": "2b422b16-6f15-4b76-8550-a622be9ce7f7", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066439, "uuid": "19b3ccde-8833-4fcc-a95c-767a70b6a6b8", "value": "6144:xhN+RTAGeVQQ7ly62byXedjgnMW2RqnL9AlYo:xhNiTAG27E62feMW3L+lYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670066439, "uuid": "51538d2b-0a66-4a8d-992b-1ecfb70ba7b3", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670066439, "uuid": "a688ccc5-ed62-423f-9581-135dd7ab9fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066439, "uuid": "8382d8bf-163f-448c-85d3-24bd5f1a2f5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96ccdee-729d-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670025753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025753, "uuid": "bf538567-b6fc-4428-857d-1ba14c404072", "comment": "Malware payload (GCleaner)", "value": "c5c9531cdd0e882edd35f1df1d3d182e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025753, "uuid": "0531180e-792c-457f-ada1-7a9cabecae3b", "comment": "Malware payload (GCleaner)", "value": "27d10aec22ed5658c57e4bebc2c2b75a2fd219ff92602ab90b96fb44ce3a9e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025753, "uuid": "09a34769-6f3b-4fd7-abaa-41bd43cf0d87", "comment": "Malware payload (GCleaner)", "value": "58c0fedcf8d0341f31dcd54193190c0b1cf143aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025753, "uuid": "7708bbf7-4d4b-4577-8ec7-0f287b2bebef", "comment": "Malware payload (GCleaner)", "value": "1626dcfafa50a4c7d1117789680d8c2f83192f055fce437fcba41e4d97c19f55848426c0ec416a52c71e246498ea9810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025753, "uuid": "de043e51-0177-422a-a204-92e757292bde", "value": "T192A53323EB89C430F9629BB54F50C894593EBA36697A0182A7F442383D77978DC743E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025753, "uuid": "442f9766-da67-4fd8-82dc-6411200566b3", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025753, "uuid": "9c0428c4-27bb-4e54-8c83-2cca862e2a37", "value": "49152:AWCCb5nIMw0yjPtRNEUMPQucM3Y6hblgsCRi4AnIfAG5cyR:ArWeMzYPeUaND3BCsCRi4bfXcyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670025753, "uuid": "b330f523-3a7b-4b1a-9d82-847021fbd20d", "value": 2239121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670025753, "uuid": "250156e9-3c35-40b2-96f2-c667cb64c625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025753, "uuid": "5f108a48-0d7e-42e5-9e96-cf28769a9f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1272194b-7358-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670105762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105762, "uuid": "121d4ddc-8099-4c54-b915-687fc008fa8f", "comment": "Malware payload", "value": "89cbbbb5fd72c47fcb3a09147ed51eb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105762, "uuid": "2932e0c6-93e5-4ae7-b328-6deb4f3b3feb", "comment": "Malware payload", "value": "28f644c622dc19e5cb80b319adabbf437421f8de4076bff4a6e781b2e26bfaa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105762, "uuid": "83e8fe1e-3bf7-4635-a7c6-7cd7ca953714", "comment": "Malware payload", "value": "5c2dbae6c631b904fb89d993719a71df9f5d97df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105762, "uuid": "da59c7ae-ed40-4931-9735-be5f00a70246", "comment": "Malware payload", "value": "9cd3bd38772e5eb6358b53e9d07c182848bf3acb402e37a1ebe73c2330fab723f91a96dec69b6743f8858e71332ab9bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105762, "uuid": "0e5c805f-81eb-411d-99ff-4437e5713921", "value": "T1F4F533D4F746B07EF351CF3A0D9B2414A17F2AF6A1B48A2115ADA3AC6F25469CE0C353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105762, "uuid": "3af6cbf2-8dd7-4c8a-8477-3f8a58e9e70e", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105762, "uuid": "c09169ea-e367-42bd-afcc-4ad0a252c175", "value": "98304:scsaXH1TkzFV83AthOLLzijOji+SnJrMxbA6FXcyU:7XEf8JzcOjMoA6FXcyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670105762, "uuid": "9b79da83-8992-4b66-88f9-ea5b7453da07", "value": 3566964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670105762, "uuid": "600318d4-900f-4fcb-9812-2fb064a36d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105762, "uuid": "11c6241f-c0f1-4d46-b4fa-af264df5ebe6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292a1529-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload (EternityStealer)", "timestamp": 1670056408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056408, "uuid": "5fe40b6f-520f-48b6-8dd8-23601659a1de", "comment": "Malware payload (EternityStealer)", "value": "81255ba900760f07de634deb83472328", "object_relation": "md5", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056408, "uuid": "ba7eb7da-5ab1-4188-8458-11c007240615", "comment": "Malware payload (EternityStealer)", "value": "28fb5919e3a1fc15519abf1b5b9307dfadb14d8f6d3a983572aaed61583ceb9b", "object_relation": "sha256", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056408, "uuid": "014e2dfe-da63-4387-9a42-152f370d8fcb", "comment": "Malware payload (EternityStealer)", "value": "b0573f0321587d845992f171ca5c6af8660fbbc7", "object_relation": "sha1", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056408, "uuid": "1e1314ac-143c-4167-a9ad-a36ba8298011", "comment": "Malware payload (EternityStealer)", "value": "6fe10baa00136b7af3f69a1cce622c9cdf53e92c403fac9e531c9091e762bf3efda9dcd1ec4fc28fbf1873db23931e35", "object_relation": "sha3-384", "Tag": [ { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056408, "uuid": "f2ea8fc4-9b12-4a6e-8528-0bec4c27bd82", "value": "T16574A7247FE43B29E1B4253DCC371333C3A402570F17B317A98A7A952A521A9DE876F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056408, "uuid": "e78bfaf0-bba7-4435-8c04-b97bd375cc72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056408, "uuid": "08a13443-ed0b-4838-afa7-aea23dec9f39", "value": "6144:0FneHO3bFq1IeEEc9kGY4mNq0wnxJ9anp9bzi1GjFjsC:0FneUI1bWJvxJ94x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056408, "uuid": "d9ac57e5-fb6a-4e24-9a28-e9c913b455ff", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056408, "uuid": "a20b0c99-267d-40be-993d-65ac242cc526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056408, "uuid": "178c444b-9ab5-4a0b-ad44-95cf1ef47b00", "value": "620000.vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5171db1-730f-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1670074735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074735, "uuid": "d1e7734e-3ed7-426e-8660-50e518c2f835", "comment": "Malware payload (ArkeiStealer)", "value": "b222f2f0919a0ac896e3f83f3b9b6003", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074735, "uuid": "da7bf449-3faf-4cbb-b93b-f9ac88f65b81", "comment": "Malware payload (ArkeiStealer)", "value": "292234b4e44187b5549566ead6297f05dc6b40310e4f1b1384ce190a79891117", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074735, "uuid": "36f260b7-5833-4f9a-ade8-2edde86ba11d", "comment": "Malware payload (ArkeiStealer)", "value": "37670412f4b98641407944b86df43f40bc23a67f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074735, "uuid": "a2ca6468-b66a-4f0d-b375-70615fa4ffce", "comment": "Malware payload (ArkeiStealer)", "value": "f5d6a63ef4aea13749fffaa25adc5eebb8d7c12d1c9185ae5966c2ebc1cf8c06ee726d20496b6258d6c0f776369c8e2b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074735, "uuid": "f7bda909-f91e-4e25-ba31-e2c42071122a", "value": "T1CBD4F1D07E0D5A0BC16DD1B796D722FA2FD4DED259FEC9C0D295126280A36F13032B6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074735, "uuid": "6aeee83a-22ed-4482-acc4-2a842ba4462d", "value": "12288:FsJ5/WfL8JGhhC7OiTa8g5MdNXLSR6ESvzY:Fw+8JGOac909CY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670074735, "uuid": "19948d5c-4371-4c4c-8df5-424f19e3a287", "value": 638624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670074735, "uuid": "65098c14-ee3e-4b39-bd7b-586519ae9f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074735, "uuid": "61deb124-b652-485c-b036-4e5e189c4f01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca189ae-72d5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670049864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049864, "uuid": "e4e23233-30e1-47e3-8ea7-8e7ce3a07c2b", "comment": "Malware payload (RedLineStealer)", "value": "7106bab16ae64b7f9bed1b90a2bbf03f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049864, "uuid": "8d583ddd-80d4-4d9f-95f6-050897ba2568", "comment": "Malware payload (RedLineStealer)", "value": "2a0e09e83a2f7198f6a9595d957dfcf0dcdf86a1c65ef4211c50eb15dd4ad598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049864, "uuid": "6a07ce7d-c3b2-4e8f-8e9c-6ab5169c4b38", "comment": "Malware payload (RedLineStealer)", "value": "ac6fae9627cf58654bc167bd63432111be9fd71e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049864, "uuid": "1b7f0981-1a0c-4221-adfd-aef31f492d4e", "comment": "Malware payload (RedLineStealer)", "value": "4d727b76a9ab384457d948ca2de7efc16ab50692d1b4153451300a66591572c1879d9f10cc743e493bda3896ed51c399", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049864, "uuid": "0f1aa20d-29b1-4103-b66d-7575943469a4", "value": "T107C5C050667C8900DC397DF1C5EFB96033E2F6993EB5DC2BA94866902A819C5BCEF04D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049864, "uuid": "1edf4990-98bb-4bc0-bdae-e04955d106f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049864, "uuid": "6ef735b8-1fce-481f-bc50-60c0285c427b", "value": "24576:pI3cT50k2PYbtJcLQ/KpE2lcpZCyphghPUuZLxNjcFttg7qFCMSrOfBFJm4kazYc:E3qCs/AE2lhhsa1N8/FKeFJm4vAKjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049864, "uuid": "de19d6ee-ff0b-4552-b87e-a2f9ba390641", "value": 2612224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049864, "uuid": "37efd158-49ad-4a8c-bd2c-cace231737b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049864, "uuid": "d02b231c-0b79-4a34-9441-9ff347dd85e5", "value": "SoftwareSetupFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1536caad-734a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099753, "uuid": "78a667c2-af8b-425b-94cf-95e241f045e6", "comment": "Malware payload", "value": "399b056476739d333b3ba28c3b7c1552", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099753, "uuid": "e6eee84b-3aea-43eb-baff-e93e70a23c50", "comment": "Malware payload", "value": "2bbe241373086ce764a8bf4dcf15e4722c43bf712fad7fc9aa7458c5a6b9efe3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099753, "uuid": "da4776f1-46d0-4f16-ae36-b73669a13d42", "comment": "Malware payload", "value": "819b1e656c28c34fb0b7e1aad5fdd55b4f2dad00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099753, "uuid": "08bd4b00-8c57-48b4-bdc6-4dbe4c08c203", "comment": "Malware payload", "value": "1ffe227eca1a4f7c0bb07df3be39a85ff77f929c3e3338ce5745c752dd0f71ef6fdab4b240f31e35edbacc70cb769dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099753, "uuid": "ade1d09f-b6b4-4250-bf59-a92a5d243d9e", "value": "T1A474D030F6B1D872CA92053094E6FBA19A7FB932596199C72B19275E5F303C18B7630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099753, "uuid": "6eca137c-7bdf-45f4-934c-21b3deadfdfd", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099753, "uuid": "3efedcd6-24bd-4973-b420-63b83ae01023", "value": "6144:HS0V/tYzaVRwXyWv6Tk1TOnMW2RqnIFfPqY8:Hzl2E1Tk1EMW3IFfPqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099753, "uuid": "8c7cbcec-e8ea-4c0c-854a-4b08070d3324", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099753, "uuid": "6e6f1005-c84d-4910-a7c7-225c7a63bbd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099753, "uuid": "17dfdbd0-63d7-4033-a6d9-e379161cc2b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22bac50-7322-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670082944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082944, "uuid": "6affa5c8-0c1e-4af3-b5f2-27de225292c1", "comment": "Malware payload (Amadey)", "value": "3d5b373da5c04c2d165fcb8dc9a23323", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082944, "uuid": "4023182a-5688-4433-8a72-8d60b8cb7f89", "comment": "Malware payload (Amadey)", "value": "2bc6565bb064cb49f1bbc5c353d13b9430936a77e3b044139806fe1ad7096297", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082944, "uuid": "77a72761-9b51-485f-ac12-31d0bad7cb38", "comment": "Malware payload (Amadey)", "value": "f7db0717a7533e2d94ed4cf5d7106bb2495c1bd8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082944, "uuid": "04a8050c-2f8f-463d-a1c8-78eb2bd9dbec", "comment": "Malware payload (Amadey)", "value": "016e89bbb5c0a76f24f52a5245f47277a812792bd64efa88538d677c1353982cbf4b88ac397404c8be20116f0da54b29", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082944, "uuid": "e88f137c-373e-4d2e-9247-8cccc03a6728", "value": "T14484DF3176B0D872C57201348766DBE0ABBFF4215DA199C733692B6E9EB03D19B72306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082944, "uuid": "fa2dbc29-a819-4619-ba35-313927d03cbe", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082944, "uuid": "b5a7efe7-c20b-4cd6-a32a-7dacd46565d5", "value": "6144:SithTjA3KBln9nhqPe2onanMW2RqnfeHY:SitRjA3SlntS7MW3iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082944, "uuid": "6a9a8e8c-1ca9-48d8-85b6-9944d95ee678", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082944, "uuid": "e53a1027-da7a-4107-a519-c9fc06dda241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082944, "uuid": "8b61f867-3e2f-40c7-8a4e-5bfb0aaef385", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d4383a-72f7-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670064073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064073, "uuid": "aa9080d8-5ffb-4ff4-a48c-e67149764155", "comment": "Malware payload (Amadey)", "value": "5766ed69acc04b43cf6b54baf0914673", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064073, "uuid": "4b5fadcb-9127-4527-b3c3-a35de47f33dd", "comment": "Malware payload (Amadey)", "value": "2bdcb75ebc0269a978086c219054bd5a8cb13a2452f7fbf7d7edb40fdc70c88d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064073, "uuid": "86a0cb2f-b56e-4a0f-a60a-95037a4d2b9f", "comment": "Malware payload (Amadey)", "value": "cfd1ac339e91aec2705280d4b1a93f8b307d5ddc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064073, "uuid": "28f773d4-8cfc-4015-ad6a-60314e53efd4", "comment": "Malware payload (Amadey)", "value": "6294c7b89d378391a66e8d9c5b769231cd9f332eba954ac3759d4d0e9b5e9ef9f1533ac06c73f25659bbaf13145e2c0a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064073, "uuid": "8d5865de-4439-4daa-ac36-3959e61574dd", "value": "T1FF84F13176B0D972C29305709056EBA1EA7FB4325D7199C723666B6ECE303D287BA307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064073, "uuid": "d91a222d-6557-45a6-83cc-0dcf2c61b7b1", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064073, "uuid": "1c57d691-6bd3-48ec-becd-e64f286d62eb", "value": "6144:DmBriAteFbDKqd4VarPDgUConnpaHeoruKPfknMW2RqnSIYo:Dm9iAthV6cUCYpaHeoSCqMW3SIYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064073, "uuid": "8b422c8c-90fb-48be-aeda-522a14dbac3b", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064073, "uuid": "df20d0dd-1175-46cc-86e2-a0cc0160c499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064073, "uuid": "ff8b95ea-a607-4082-950d-26b22f0f349b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be71cfcf-7364-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1670111204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111204, "uuid": "e586463c-f155-44f3-b691-0e272bd4e7e3", "comment": "Malware payload", "value": "359e6d400866893d416d68d7f8c90392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111204, "uuid": "d91ffcb5-f810-484f-b5fa-22dc80f341bc", "comment": "Malware payload", "value": "2d49055fff67f557d2010ac6da454baba1b707e290e9dbd035cfd413ee99a28e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111204, "uuid": "20572da9-ff96-414b-86ab-de013293337b", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111204, "uuid": "3befff11-3776-4ac2-ac7d-3a71c0d336d2", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670111204, "uuid": "eb3c8073-96b8-4281-a6d8-1c3ab9d5da73", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670111204, "uuid": "4dc01025-3ea9-45d1-a454-ba05f86b7806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670111204, "uuid": "3f28727e-1650-4020-82be-c70966b8a3b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c5baee-733f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670095297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095297, "uuid": "9c9280ed-1e5e-4e4c-bffb-040cdfd5dc25", "comment": "Malware payload", "value": "9d040d2419cff5cf71b855884eefb111", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095297, "uuid": "b11e687a-d80d-471b-962a-8d8087b0b0e5", "comment": "Malware payload", "value": "2e04dff87a14eafb21256e2898b20edf2bee5bbc693b561b6ff64519d08998bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095297, "uuid": "c5801801-64eb-4689-8261-5f48446d9313", "comment": "Malware payload", "value": "e4d4d4fe0d8ad8830867a3d279397c2e79618cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095297, "uuid": "251e1e00-850e-4244-9bac-e54a39c848e5", "comment": "Malware payload", "value": "2277da763606b148433eb92daacb87e582d73e4eb4cb9f5d3f7055dba2a9e7ff1fb40960c8c6c677736f4eee25e15c57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095297, "uuid": "556997af-ea93-4b35-a423-3e86eacf3fc7", "value": "T10815D14076D9B628F0E729F40FA5C3678227FCE446A2961B2F34320B5A71D418F6677E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095297, "uuid": "ff1e7d68-9176-4699-b74f-aa1681fef883", "value": "a0ca92c3ddaf9bcf268b6197e6bcb7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095297, "uuid": "8d6c6ae8-c4cb-4bd0-82a6-670c468be462", "value": "12288:yIBK7N1jdQc4qZ+3IGv5+LPlHq06CXGG8ibgg6Ciz8kCoK:gjZQc4PNv0PGGQtokw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670095297, "uuid": "c15f7ec8-6a66-4fe6-a82d-5618e4427d67", "value": 890016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670095297, "uuid": "150270d9-90f0-483c-91a6-7bf08a237948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095297, "uuid": "fb003ef1-de58-4df4-b670-1c676e182cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecc5ca0-7305-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670070510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070510, "uuid": "957b6dc7-5516-44e8-bc99-c7733c7cfbf5", "comment": "Malware payload (Smoke Loader)", "value": "310db4b82530176061fae7cf1842b49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070510, "uuid": "2903b8d4-3218-471b-b969-95d076c85939", "comment": "Malware payload (Smoke Loader)", "value": "2e508f2f3b720631125089ffbcba6890fcfb2584689e643db2bd64d6ede6007d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070510, "uuid": "5ccd4622-7bb7-47e8-8496-b7f512db1e95", "comment": "Malware payload (Smoke Loader)", "value": "28c4c01c3e0c843cdaf68ebbc3604410173430fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070510, "uuid": "cdc98163-e63d-4998-83b6-d280a656b0ae", "comment": "Malware payload (Smoke Loader)", "value": "97276c87fb99dd7cbbe084b06207fb84931030093ded96cfe4a7dfc318aab05b900de2812d8dfd561d82f51850f6e4e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070510, "uuid": "281b6111-be10-44b7-bd5b-966ae8cf0612", "value": "T1BB74D03132B0D432C1570D719466DFA19ABBF83299A899C72379E77E1E313D28A76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070510, "uuid": "d4218454-b373-4eac-aba3-d0c7edc8192f", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070510, "uuid": "2c862975-9f47-4305-9eb3-bea19ebc75b3", "value": "6144:K/Q7mASefI3OqvoSw8U2mQ+G9BnnnMW2Rqn7SY0:K/amASEI3bvM8p+cnnMW3OY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670070510, "uuid": "71469d95-fe5c-4d40-9211-0b80f381de76", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670070510, "uuid": "a1a11451-5148-45d0-ab47-d60de43b51bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070510, "uuid": "3c1b48d5-d1ff-4474-9b70-e1bd9196af08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f29520-7315-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670077171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077171, "uuid": "3cf9af88-558b-4a3f-bc62-1451c00fe18d", "comment": "Malware payload", "value": "15cd68e19a2f1ab284904963e3468abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077171, "uuid": "460eff52-7e39-4aa5-b667-fd2cd9637303", "comment": "Malware payload", "value": "2f83274b2e5cbe9c8bced262f0f0eb600f9ca32c5f5eac4eb32cdf1fd2498913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077171, "uuid": "7d292ef1-4171-4f86-80c8-3ee5cd06929a", "comment": "Malware payload", "value": "70b6815c2dfb37a99e881b5f78e224d70f542b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077171, "uuid": "4f966ea6-8402-44de-9821-8e07842769cf", "comment": "Malware payload", "value": "a2268e74f01a82723e3b0cdba3ae5a6e184d5fea98b012372b7f17e85b8c28c7ed3e6284cbfaec580eab28d7717c48da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077171, "uuid": "eece2581-1f3a-4763-88bb-929abdfa60b2", "value": "T1537512442B6247A6ECD3497D413AE3BB0731B9783A7AC6837754561FCFB42A28520B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077171, "uuid": "f8eb809b-5291-4038-ae93-6e5036b0117c", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077171, "uuid": "e954001f-6bba-455a-8149-55f3436b6d97", "value": "24576:bzz7rejetDEyjrWSFQuBs0vfrKw5g6FDmmrP/l7wm9EOo66CxsIpR3C82iIgv7Qw:bz3regyuBsE66FKU/lwm9HkCxsIpIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670077171, "uuid": "23ac6d0b-81c8-4777-8638-31dbe7bd7dbd", "value": 1564640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670077171, "uuid": "47b83342-5aa3-41ee-bba7-f6e5c57b0c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077171, "uuid": "8f2c7fad-9530-4b83-bdc0-1a3ecd2bb098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9292e9a-7332-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670089801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089801, "uuid": "b981a844-3743-44b4-9ff3-6d85f83b8639", "comment": "Malware payload (GCleaner)", "value": "519f7c13edc48674c9ac115050b84aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089801, "uuid": "70f52eb2-aa82-4a37-b7a5-2f0972257aea", "comment": "Malware payload (GCleaner)", "value": "2f92ffe52158587d6e9d88114ac342be60d625f3977990185827ec202e9d049a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089801, "uuid": "7bce6fa4-789a-48c2-8a0a-3924a2d61b53", "comment": "Malware payload (GCleaner)", "value": "0395d75e4ae8d4b7caccc908c227a16f116da80e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089801, "uuid": "1def08f2-a952-43f2-b95d-fa888ddd33c6", "comment": "Malware payload (GCleaner)", "value": "cb1ba4c2d2b05121685138e438a58db5e9f750229744774c97c3ec3c575f337671ce517e14e92a5fe957075d1fb11185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089801, "uuid": "b4306c8a-8800-4520-895c-1aacf97a36be", "value": "T11B0633547B319835C380F6764D87DEAA087BA7285561BD4621F8F11E6F864FCBC25328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089801, "uuid": "8e887883-d0a3-40cf-b5c8-ca902abd5812", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089801, "uuid": "93f713fb-e1f7-4334-80d8-bdc9089abff9", "value": "98304:Au4g5lq1Obh2oT4YEQCw5t/zkAVefBHreIwedXcyK:h4g5QzK904xkzZihedXcyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670089801, "uuid": "5076e433-cf4f-49c6-b506-eb78c3d9bfd5", "value": 3734993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670089801, "uuid": "296fb46e-eafb-4998-898a-4d979fe555b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089801, "uuid": "f09d5716-6861-4553-a1d4-6a3591adc9af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c415897-7326-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1670084276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084276, "uuid": "e7eb0b09-cae6-47a0-a4bc-29a5c1f03733", "comment": "Malware payload (AgentTesla)", "value": "62743a9c1c8921f4d0004c73802b12a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084276, "uuid": "a2421cd3-db18-4ffe-894a-c5af173b0ed7", "comment": "Malware payload (AgentTesla)", "value": "3092605445c3acdf8d63cc7db1924b8ff09f039c1c427dd5aed008c37b9d5575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084276, "uuid": "f0ba5166-b8a8-47a6-af4b-61e94b58c15d", "comment": "Malware payload (AgentTesla)", "value": "751dc4baf8c4ae5b219807935349ece9a322d307", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084276, "uuid": "ff331216-9f92-4ce3-9e30-899f69b91a20", "comment": "Malware payload (AgentTesla)", "value": "8c3d23af6e55f16fa4bc375d838b28e25bf3731cabb82dc577b4be71a8344bf74ad1da54a9f93b23aaa154f8c8e55153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084276, "uuid": "324ad045-9004-49b2-94de-5fbe690dc5c4", "value": "T144158C9173728963F58F01368485318CAEBCA543A2A6F2476F773A8155027FFFA9CE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084276, "uuid": "50e8a668-c368-42f4-8e17-d30bf8a0fe25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084276, "uuid": "d91fc744-8eb5-48c0-8920-98081b7b02ac", "value": "12288:jop/2zEJPE39sMqmqpFr5cE8LHW1IIfTv9eolLsXwVkp0eOVNdOQBJ/SEdRMA/Lr:joxZjmqGvLM/xpVk+dV9/L1t0In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084276, "uuid": "92cb3964-eedc-4f95-b5eb-a2e3754f56b9", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084276, "uuid": "87f6ccdf-f849-4ee1-b721-7f8a01ca0aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084276, "uuid": "774401ff-38c5-40c7-abba-ac5a620f6fdb", "value": "MONTHLY SOA AGENT AUG-OCT.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b48d93c-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051848, "uuid": "3682d4c3-51eb-44ce-8278-4c9338c0cfc9", "comment": "Malware payload (Mirai)", "value": "bfcb624eb142e26c06a9ef88fee2f736", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051848, "uuid": "a3ee731e-d33b-4330-8686-353ef26e0857", "comment": "Malware payload (Mirai)", "value": "314ddbd850eac1c21aaa0b5f5d066b33736289518796f2af3ccfdee41670d064", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051848, "uuid": "1d69c4cc-edee-409d-84a9-e3dd37fd1c5f", "comment": "Malware payload (Mirai)", "value": "50267a40c0c5951acd130e3080f0ba1e950c9439", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051848, "uuid": "c006b30a-3c15-405f-b1a8-facc9c1a0971", "comment": "Malware payload (Mirai)", "value": "0b940ca362a8d1910e9924d92069d8471155f1f9d68a272794ddef539ed8514fd80ab12097f12219a4293414112af632", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051848, "uuid": "c36329b6-85e5-478d-9414-448d17d1e7ee", "value": "T10EC3B677BB11CEB3C85FCD730AAA46011C8DA99742D56B6B73B4C968E74694F08E3C84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051848, "uuid": "cee5a888-41a9-4f37-bf4b-f3f6938bd11f", "value": "3072:izhrwtu+BdU5h1rnD7yTKdwS7F2GhsrBAe:uh7wdU5h1r3yTKdwS7F2GhsrBAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051848, "uuid": "6ccbb782-4631-49de-ae10-64bff01efa86", "value": 123914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051848, "uuid": "bb58b045-1304-41a8-9fef-fd728318898f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051848, "uuid": "7675f1ff-0bc3-4c31-a1ee-7612862132e4", "value": "bfcb624eb142e26c06a9ef88fee2f736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd5e812-72da-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670051936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051936, "uuid": "147d85af-0eb8-4851-bbb8-234967754085", "comment": "Malware payload", "value": "b2b159da524e6d3cf945d831307e650e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051936, "uuid": "6c24e134-58a5-40b9-9dff-d62afb881cb2", "comment": "Malware payload", "value": "315e3c3093352bd4ae418d86523a10884751241108c8f1a519063c8d8d23d9bc", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051936, "uuid": "7c530e61-f752-48d8-bae8-9e707ab9d1ac", "comment": "Malware payload", "value": "1de8a5170b59e7a44540f513051094c8385bb741", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051936, "uuid": "2295ee42-2111-476a-a3a5-98d20e5a2d54", "comment": "Malware payload", "value": "47d57f58e07ae97c60934a890331daaa3a063fd689cf4a728ebf75b043f9c879452109270e3ac23129cb6dc095bf54d2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051936, "uuid": "3fc82ad1-19b5-483c-b4b1-eb84f00b5626", "value": "T174E5F1DC72B0420335DCBA05887B4F9F17A52210B2D7924DED5BD877AA96B3B3522077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051936, "uuid": "e51b8ca2-fd1e-4e33-8931-3f29537fe70e", "value": "49152:/IhauUFuB6HhSBX7EtsLk2jXuzlW61VxG:OjbChS5fj+5W6VxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051936, "uuid": "1ff72133-19ea-4f2f-88b4-884201781737", "value": 3101028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051936, "uuid": "d5df0809-3f62-45af-b7a4-0f354c9f93c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051936, "uuid": "f1613af3-9cbe-4e8c-b89e-f3c64decb5b2", "value": "Notafiscal-usibf-47945-JVZGC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ed6e4f-7354-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670104081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104081, "uuid": "3e62dba4-5557-4f21-b90a-da202f5a24ff", "comment": "Malware payload", "value": "940201a4c735c8a5184f2f664ba650fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104081, "uuid": "a7a6ae93-5820-4a1d-981e-e01509aeaf14", "comment": "Malware payload", "value": "324867656d4050db5014bc7744925bb38dd81eed91fb7a4709af4a7aa4c3ec46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104081, "uuid": "6feecffc-fced-4b11-ba43-37e02856339f", "comment": "Malware payload", "value": "b0d99e0dcb1cde89cbc6b21fc3b363db27e2dbfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104081, "uuid": "60440920-897d-4828-aba2-20aaed5cc9eb", "comment": "Malware payload", "value": "a3f6d87b905a5a89acd7a0dda14738f9a34430e196e9c9dc5034422f5b39a58421153349b56bf473508c055b0ce87726", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104081, "uuid": "df317f39-09e2-4c4e-bb31-7f4061cb73a2", "value": "T18B74E13132B0D476CA6345319866DBA06AFFF8334CA19AC73369175E5EB23C1973A643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104081, "uuid": "6155e09c-c442-40f9-90db-d73fe18ec952", "value": "c13a4ce7a96b7de18434d9eecd3ddb46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104081, "uuid": "4e26e240-9159-4d69-bca1-b73a0c8c503f", "value": "6144:6EFmTOaKcDs5DGXz/z20QO+X1nMW2RqnYWY:6EFmaa9Ds5DGDb2jHMW3zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670104081, "uuid": "fbcaa3d3-293a-4f07-aac0-bae8f15ffef9", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670104081, "uuid": "0a7c85cd-5e8b-4c5f-9f21-6d50529b7593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104081, "uuid": "389e9a1b-23ca-4acc-bfce-e670e0a7969a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d756c8-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109009, "uuid": "11f94319-614a-4e3f-8e48-773b73744e83", "comment": "Malware payload (Mirai)", "value": "f5ed29c215462bc79bd3e5120b4d054f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109009, "uuid": "07995ddb-609e-4f22-88cb-cc50516f1d55", "comment": "Malware payload (Mirai)", "value": "326f6d4ff26111bb824668b98c44f38dd92a1631b0330da26f017f57a0c09124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109009, "uuid": "96ecb459-1e0e-4994-af77-cc2cadff6590", "comment": "Malware payload (Mirai)", "value": "836e2b94031a749dec2ddbf601818b8bbd15901b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109009, "uuid": "6a8d5879-cb89-49c1-8e05-63c433252de7", "comment": "Malware payload (Mirai)", "value": "355f340990e630ddec1f09d49e01a833fef3773e8a2ecf3bcb0251d3f0820ad2b19a62fad903853190a0be5d4bc6c53b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109009, "uuid": "b8fd0896-21c2-46ad-a69f-a0dfe2dacdc0", "value": "T11CD34B46FB818F13C0D6177ABA9F42053723D79593DB330659286FB43F867AA0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109009, "uuid": "e1882ac5-809d-4875-a8a6-de184498362b", "value": "3072:NMHPp2Y34jM82KSHfFBgmKVbwemS9j6RM/9KmywPoIlq:NMHPp2djIKSHfFB3K+PS98M/9KmywPo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109009, "uuid": "099c30dd-4bc6-43c8-9c9b-fd98580bcc71", "value": 131723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109009, "uuid": "2650e773-688f-4924-9d17-2080dca5e201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109009, "uuid": "ce9be76d-165a-4c20-9ac5-d405f2685ac0", "value": "f5ed29c215462bc79bd3e5120b4d054f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2daff9e9-72b1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670034081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034081, "uuid": "3f943d4b-0947-4f79-b47a-5beb0ddce15d", "comment": "Malware payload (Amadey)", "value": "7527d2ad0236c75890553e88569a4550", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034081, "uuid": "686edf30-9106-4141-b324-835c8779bbb8", "comment": "Malware payload (Amadey)", "value": "328cb914418ef699e3fe3b68f13041a86e934562c90d70aec9bbaba078ab0ef2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034081, "uuid": "3c3abaf0-3779-400e-a6dc-cb2669b5d42a", "comment": "Malware payload (Amadey)", "value": "e320364bb6fceb55e0ad6e9a88880197da493550", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034081, "uuid": "f22e9518-7979-420f-b098-a362ffbeface", "comment": "Malware payload (Amadey)", "value": "bd52e92a0f94623daa6ca64e92eb7cde498839d8144c9f0c786e5d2c8be7d71bab4bbadd46ebd40800c8555416fb25fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034081, "uuid": "e9c0bda3-6aa7-4408-b20e-c3c58a8c5ff3", "value": "T1CA84D100F590C876C18214F88966FBEDAA2FE8315561D9CF33A42E1E5E732E097663D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034081, "uuid": "9d5eb5f2-ea0e-484e-b94c-743ba493c1bf", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034081, "uuid": "75106f81-3695-44ae-9858-e06f8694f665", "value": "6144:Rd3bKIK/L18SpgcRW1poHtVTOqRsOkLR5GESHuR20wntjH:RJbKT/Bpgz1qHtVq2sZBhR21nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670034081, "uuid": "90781c8a-f373-4b4d-813b-8340d4de249b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670034081, "uuid": "a49d1c91-d859-44eb-8671-aa62c56d17cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034081, "uuid": "f550a8df-a6aa-4901-86fa-2011c0f63529", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2f5dae-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109028, "uuid": "b74a6a0a-a7cf-4b9c-88e7-512c0845dc4c", "comment": "Malware payload (Mirai)", "value": "04b38243326ee1b18edf454a346a9166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109028, "uuid": "9cefe28a-0d7b-4e36-a9ac-9fe3cc13a01e", "comment": "Malware payload (Mirai)", "value": "329d4ac429b8acdc152bfa5e9d011e848c72893efe1b530c5c7b83f4f6338fb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109028, "uuid": "727351e4-2bc1-47cc-8ffb-2f30e4e9eea8", "comment": "Malware payload (Mirai)", "value": "44d453fd0034f634f000dabd940f6246161acdec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109028, "uuid": "6baa5402-257b-4799-8c2e-01bcea2ec8d7", "comment": "Malware payload (Mirai)", "value": "2f104140839a295570ad42253a9e597fef0c91c112499e78f56b8cc52c05c450058a1a6d2aeef1c87310aad6953ddc0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109028, "uuid": "5a745809-0a56-4da9-8e67-8562a36b86fc", "value": "T1E763951D7E218FEDFAAD823447B78E21AA5823D627D1D5C4E15CEA001E7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109028, "uuid": "a9f04bf5-bac1-479a-bed4-c7be4ece55e3", "value": "1536:i0y4avHPPTn/m9cf2j/ScoTpxr+0jRb+10WAc:ih3reScoTjr+oReb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109028, "uuid": "14e9af13-7b34-413c-9227-1c5f8f489666", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109028, "uuid": "8229e5dc-f895-4c32-937d-61d08deb6cf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109028, "uuid": "6ccd32de-a16b-4b6d-808c-5d7a74ee65a1", "value": "04b38243326ee1b18edf454a346a9166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cb0e63-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091812, "uuid": "9b173768-1745-48b5-848f-578e0cba1d19", "comment": "Malware payload (Mirai)", "value": "251bc42bf415a9a79369d11c77811b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091812, "uuid": "42e6fb70-4341-4bcf-84be-6129c5389105", "comment": "Malware payload (Mirai)", "value": "35f26d430707edd66d2d1497fb18e50ffbb03ba5f19f23fb2cea1da9843e78c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091812, "uuid": "da9e5b8e-5d09-45f1-ba0f-513b8b047f34", "comment": "Malware payload (Mirai)", "value": "b058f4bf2d959a5e617c01e787d9ee876d8a5236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091812, "uuid": "108b7d92-2a9a-45d3-ab27-31bd033ca38a", "comment": "Malware payload (Mirai)", "value": "bc9def6df1b37845859ce98c3245c2fd7e9962e580cb5fd131b61c9f20d0d0459fa178b5bf17bfdaa6304d5b0e022dca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091812, "uuid": "4743c85c-32e3-4ab6-8771-ad377453737e", "value": "T1F013F941F5078AF3C40704B021EBFA3FAF30FDE95565965AEB66EEB1DA530C26103A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091812, "uuid": "cec8e5a9-ae5b-4c3e-91f7-46813e379b2f", "value": "768:QxCf/IMv/EgDR8RVprC42i4sgqnKY1nwsvKQLD9:84IMvsgd8C42i/gqnKmV3LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091812, "uuid": "0b00ae23-6f92-4bf7-b728-3dabce9fca3d", "value": 43792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091812, "uuid": "96e70782-61ab-4d67-b713-5aeca917a24c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091812, "uuid": "0020dad4-e059-455a-bcbb-8fce7937d91b", "value": "251bc42bf415a9a79369d11c77811b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed77eaab-72d1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670048147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048147, "uuid": "44c28574-ca63-41fe-8671-9f234c575a75", "comment": "Malware payload (GCleaner)", "value": "f1270fef9309ada3908285f01dbf4fe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048147, "uuid": "8be8dded-5d64-443f-b57b-286a40a023e8", "comment": "Malware payload (GCleaner)", "value": "3642103f7e7900d1255862ab0a4408e999cc0975c405009a72083a4ea047a6ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048147, "uuid": "9978ee65-dcc4-4f16-a0ac-885216d575c9", "comment": "Malware payload (GCleaner)", "value": "d3233b5b5907390b92196f3d88e4d9688b5cbbff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048147, "uuid": "30822e5a-64a1-430b-9093-ee0a3e1baff2", "comment": "Malware payload (GCleaner)", "value": "153afa84ae7b6d861426171cc62059341834553c68321171b8ea6af4b7da0cc1cb8f7614c022b1f61d8be7819f92c385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048147, "uuid": "1e53a962-f538-41d6-b26b-00b2d9f24bb4", "value": "T1A5F5331734A6D1BCD24E3BB29F1E901A0EA77983183D076D7EBFC8D91E5E00C99945A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048147, "uuid": "2001eddf-5282-43c1-8bf7-d13330187fce", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048147, "uuid": "5b621df9-d2ea-4008-bd1e-44cce339ed4e", "value": "98304:UGPGsJwXFAICom0sjYcKVZRkkhnZJJ5s1/durqXcyO:CsJwuIYjYcslZJJ5s1FHXcyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670048147, "uuid": "7e2247ad-7544-47f9-8a93-cda145fb5ce2", "value": 3635847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670048147, "uuid": "509fc255-e5f6-4afa-b45c-889bcf38bff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048147, "uuid": "cefe7c67-108a-4d62-8325-5f4458e8fec2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342232ca-730d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670073606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073606, "uuid": "fe9d62fd-1c9d-4767-9a8e-eeb051a042a9", "comment": "Malware payload", "value": "937b50d6281a451b089fc2263764b9e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073606, "uuid": "0e477c0a-ad82-4bf6-8efb-1b03569914c3", "comment": "Malware payload", "value": "378992342dd0cf708dce652fe95f03dfa12d22c8844dcc4681d341bdd9b0ead8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073606, "uuid": "dd55cc93-f271-4262-890c-6f6bc874178e", "comment": "Malware payload", "value": "3f2bca725cefa7dd0e09d918c09b92cce237bd9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073606, "uuid": "eaf48819-62f6-464e-93ad-269c42a00932", "comment": "Malware payload", "value": "ec11bf4209e6f839471520d9ee3b19d65dbdabf80b20e631f6307a0db8cbd58afa1e5541c985f3cae216e789a34a5d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073606, "uuid": "d92afc16-77bf-4370-ace5-e1a0266594f1", "value": "T1E764F01175B0D432C99621314464CBB0EFB7B1736ABA988737595ABE9F302D34BB630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073606, "uuid": "3f603001-e0f1-4c24-a2f7-83f66b2bc771", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073606, "uuid": "c555545c-bb2a-4095-b65e-3104c3c49b0b", "value": "3072:CtH8if76DAbTlg5JKOCl6ddUik5o0ZlLKpVLtI8s+uDmczwr11gvc8TGx:LifODA3KKxsdnIFKpVM+uRErTMcLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670073606, "uuid": "330d7185-f415-4bc7-9831-7c28f07948ec", "value": 309605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670073606, "uuid": "48151c18-6838-432d-acfa-b14ab8689422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073606, "uuid": "174ee921-da61-4961-839d-4e0184306486", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af04c83a-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1670052767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052767, "uuid": "8d6d4d60-12cb-4a91-b19d-49342c03e202", "comment": "Malware payload (Gh0stRAT)", "value": "a9a5fd9e81bf95ef0ca75219b25a4fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052767, "uuid": "c3c28f5e-303b-4a60-aa5f-fff262bd89cd", "comment": "Malware payload (Gh0stRAT)", "value": "38d75e5659fd0bd1bdef9676cf80ce5331b759bec33c7e5a4c55db73ef2c8d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052767, "uuid": "ba5986e2-6806-48ec-9b2a-4779ab65a122", "comment": "Malware payload (Gh0stRAT)", "value": "1082bdf4db2758cf949908f231c6cdf7ebf43064", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052767, "uuid": "958b0caa-6ad2-498c-b559-04b77171a35a", "comment": "Malware payload (Gh0stRAT)", "value": "8131d0b523d985974a886d079cd0b95f3d24fb810c9e36daaf63995076b295933041333500b3bb2ca8f4f923d7db7733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052767, "uuid": "11b79bda-c72e-4513-a57f-58968d5957cc", "value": "T1A992B80B9B6644B5C872CD3043BB0B7D8DB17C630A51969B0915FE8D9C34B1C6A2B79D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052767, "uuid": "2cb7e40c-621c-4d53-b57b-f384aaf37874", "value": "f3713290f9b79bae873f42558adbe57e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052767, "uuid": "790d9ae0-ffad-4213-8667-625fc6e7d591", "value": "192:zMa+OUrPLUVJnMbXX3mgUoyn9tU+Xh+sH:zdlUXPXG17lp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052767, "uuid": "d6df934a-ecfe-4083-85d3-129b65d68ca7", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052767, "uuid": "68e53a0e-0624-4286-8a5a-7d201c993def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052767, "uuid": "a898e354-2ae9-4dbd-9f1c-8f9983794309", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302540b4-734a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099799, "uuid": "7decd552-bdaa-4845-9e43-8de93f582b8d", "comment": "Malware payload", "value": "61de999f1862b283214880b3902a9ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099799, "uuid": "290e64fd-5f0f-4a91-9b2b-294a5364041f", "comment": "Malware payload", "value": "395b6a08c66ac5c26db8a19461fa440e09dd730c46e3b2d62f4d78b1eabdd82b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099799, "uuid": "ffa6dcaa-7d04-43f9-a383-b0b2147bfd9e", "comment": "Malware payload", "value": "9a307cdf80c9167add439f7030fc3cf471d52434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099799, "uuid": "922d458c-9ac8-4467-8ea9-b2809c31e999", "comment": "Malware payload", "value": "5819297ff0f7811b04361138beb815e08765c57c7248733cb691d49a5641871dea8159b6b41b30f23f9b5f7f80adfd3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099799, "uuid": "91b7e395-a7b1-48dc-863f-a55a574cd284", "value": "T1B5763321B8F18B75DAC70AB71ABC3CCA01BBA2400FE5019357DB5D2DD86DC651528B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099799, "uuid": "bf595e25-1c62-49c7-8c54-778de0c01e0f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099799, "uuid": "dd0c429a-e31c-4426-9f56-23536e248e67", "value": "196608:91Og37vsagYxWwiWWdy0fzzb4LV7u2QJPCYDpI+:3OgrvBgY8wIdTzzoVq2WXlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099799, "uuid": "c2db8fe5-e737-4635-bcb8-17bdc6c1603e", "value": 7603776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099799, "uuid": "6e888ec5-5d95-4ff7-9143-6788dc36918f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099799, "uuid": "f2bca7dc-c128-4bb9-81dc-2e23846ddbd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0095cabc-72fc-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670066218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066218, "uuid": "fc86ee06-2061-4ad5-a962-01e38deaa84f", "comment": "Malware payload (GCleaner)", "value": "9e2fdccc0daf2e786e7a10b4911d06ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066218, "uuid": "880be8b3-9085-4b34-9d8c-7ffa0882ec66", "comment": "Malware payload (GCleaner)", "value": "397ddb85fd35b89be41c94cd590a273836d56dd5ed6728fd32c30097f94d6435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066218, "uuid": "0a8a1b2f-ed67-4da9-a29c-b642165fb2a9", "comment": "Malware payload (GCleaner)", "value": "74de799bebf140c6850c4b4f317e0f8e9357eaa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066218, "uuid": "2fcb6315-cb6f-4125-ba75-362cf56ab1a1", "comment": "Malware payload (GCleaner)", "value": "90ebfab4a15706fcfd66fab7e42dbf3c54cd4782f17746c411f624872e767cafdf8e4a7fa683231db208eaf2f5c86ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066218, "uuid": "c1e1d29d-c02c-4696-9092-5b17517f4433", "value": "T12A063302D9F9DD76CA209BF85D79D696BDAF78707835220D76CE0C8C722AEB054C6213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066218, "uuid": "37bc514a-1998-4a83-a547-0ea97d4fe1f6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066218, "uuid": "4be13c24-b3c8-4315-a686-6d01a1311465", "value": "98304:4JXfW4K3rLPUMrbly7x8bgfLNiZzew8SkMgaNz/BEH23tWXcyf:cfBK7LPrPEQgf0VtrLBe6WXcyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670066218, "uuid": "0d2bcc09-3a54-47da-bab2-57b8d27163be", "value": 3748549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670066218, "uuid": "d9bda6c0-8c18-488b-a1f3-7f33a9d32d89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066218, "uuid": "f29972d5-ec79-45e9-8b31-b6346c9672fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90f881c-7359-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1670106444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106444, "uuid": "3f5941cc-e581-43e4-887a-05cf09051ae1", "comment": "Malware payload (SnakeKeylogger)", "value": "603fe249c0d10719a8d2fe5985e85d51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106444, "uuid": "ee151999-e37f-4fb8-8adc-35249c2e6726", "comment": "Malware payload (SnakeKeylogger)", "value": "3987c7ba08298c6fc3d6007468e751b3b751e750ea3a0ae5b2c5e699bac97002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106444, "uuid": "576d0487-2bef-4fb9-961e-97d3ce19c24b", "comment": "Malware payload (SnakeKeylogger)", "value": "f28fee2fea1ff815d079feb176daadd5fe00c28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106444, "uuid": "75f78780-b05e-4007-b451-4c82c369bcde", "comment": "Malware payload (SnakeKeylogger)", "value": "167ab06acbc3fa4f76df032b1011cf1f5dff785ca23fc1d936f03c442a51b232234580c987cbb4f93e67efe08dad7e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106444, "uuid": "fa459e11-19e6-448d-ba5c-18e0b3d94d32", "value": "T17C357ECFA0506D89D55F59F07C2B742039D3AD984498C09CA3ED7BC62AB375690CAE2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106444, "uuid": "23a43631-db5b-469b-83b3-f413d44bbd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106444, "uuid": "bf57966a-1498-4518-bbcb-8f544ab35ab9", "value": "12288:krmZJbxpDFw37lLnJK80DMx+XYRiVMaCSwMZ5cVz82UZmapTE6BmcoNbjSC:krt9KZDMx+IA2erHi8TpTic1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670106444, "uuid": "c1b3db0c-e277-4701-a031-a620724145bf", "value": 1143296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670106444, "uuid": "44d58014-1745-4e84-9dc7-0af29d0dc5ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106444, "uuid": "5bc14462-ebd6-48ee-b231-58d43fc07bd7", "value": "12220173387_20221124_13363111_Hesap0zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a9a224-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091803, "uuid": "e108bd19-d664-46e4-b045-40089cc86a7f", "comment": "Malware payload (Mirai)", "value": "a56586f703a7a0dffbf8606103c4f69a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091803, "uuid": "33bc66b8-39ea-4f9a-b8dc-46697ab8657d", "comment": "Malware payload (Mirai)", "value": "3b6b04e491d0d3a84cc364e6d5116adb9ae54a8911aedebb79d0f284b4ed4a1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091803, "uuid": "dbf1fcac-0d30-48cb-8ab3-7e349e5aa205", "comment": "Malware payload (Mirai)", "value": "f651f0ed6b2efc83669d7775cdfe16593e01b74a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091803, "uuid": "fa9ad422-39c3-4859-a429-9e5022d5ced2", "comment": "Malware payload (Mirai)", "value": "5aa64065ade446df8a9745db8ceb48683846d8de5c0ca924e0883af8852aa720a71a3d3f54afe9ee1ec29f653763b2f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091803, "uuid": "ed77740a-04fe-4156-8df0-fab081cdc6cb", "value": "T142234B31FA361F13C0C264F461F74F1879A5AADF29A5869A7D712ECABF205C07502EB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091803, "uuid": "db69678d-b23f-4c83-8fea-7bc4ab4f39e9", "value": "768:FDoBjtvg6UQ6QyS0S5mhO+lSCOWpwmJh+0V0U8Y8cV:FDGjto6UQ6lSGRtYmfjV048Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091803, "uuid": "1fc5ad6b-c4fa-4ce0-9acc-d4dbc0b0ba8f", "value": 47512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091803, "uuid": "af8499fe-af19-46d8-ab5e-80251463002d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091803, "uuid": "31a25ebc-b7d3-4038-b5a2-b0626f37c314", "value": "a56586f703a7a0dffbf8606103c4f69a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a0eeea-7303-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670069468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069468, "uuid": "d600ac5a-72d4-498f-8d04-a7b95cde2e7f", "comment": "Malware payload (Amadey)", "value": "4f176b8b547e91914973ab69c3d97463", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069468, "uuid": "492676f1-2650-438d-bc4a-adea590a092e", "comment": "Malware payload (Amadey)", "value": "3bc50d7efc3339c87c47efed5e366957eed91a1adbab05e1ec28284cf911406f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069468, "uuid": "75222749-2ebd-4fbb-8d0c-7289d28296a2", "comment": "Malware payload (Amadey)", "value": "2200cbd26ccb1630123f5ecd8df695851fb52cdd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069468, "uuid": "85adea6d-33c0-437c-b392-ff71e48e1469", "comment": "Malware payload (Amadey)", "value": "3b36bb95ae2c0d26eb93a4ab8590a79e6d3e5dfbe871bdb1dce61fbf77c2ce2e2c77ee06b2406845f4b0f241f3b340cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069468, "uuid": "d88524ca-c042-49e2-901c-9221567bbf5c", "value": "T18F84D03176B0DC72C1C307314066DBA0996FB4626DA2A9FB2369275F6E303C1867677E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069468, "uuid": "a0a266e1-05b9-4b88-b0b9-e147440b0af9", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069468, "uuid": "bf1b14e0-901a-4c7b-ad89-fbf3766a7fe2", "value": "6144:p5p8X1A6eaO+OEQImT4JqWtc7I74pnMW2RqnT+CnFYU:p5pi1A67OnWjJqWEI+MW36wFYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670069468, "uuid": "39ae6810-140f-4399-95d7-59719c8a7c12", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670069468, "uuid": "688e6825-892d-4ea1-9354-438edae67811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069468, "uuid": "b752faf6-ba12-4f07-8677-43e05ce337f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d45c23-734d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670101290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101290, "uuid": "fb9873de-187f-49a5-b0ae-a194a75413d1", "comment": "Malware payload", "value": "0b48282146973d481e004851373bbdaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101290, "uuid": "36485dcb-2192-4837-b014-b1fe2cc9b1c7", "comment": "Malware payload", "value": "3c868367d2fe2bdda3f38fdc739069d9ed75020747c1170b6433f5563d8c51dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101290, "uuid": "924af73e-d869-4f20-8adc-23c248b5c48f", "comment": "Malware payload", "value": "69efbcffa4e2fd1dddeef601fe3deb8a5c3b89df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101290, "uuid": "c88db738-1926-4cb3-bb54-728df53cb6c6", "comment": "Malware payload", "value": "d102578b39270a76f938b60fdf48789a7dfcd78933a854e92186b5bdfa07fdc27117737aa81d87d6460f590269a51605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101290, "uuid": "1b225abe-d916-4381-bb04-c11c8aeb0261", "value": "T12A063319F7B599EEF0C35730AA8F5E720C627D72123145142E8D2AAD3E3E6D929C8374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101290, "uuid": "fd28afb0-d2e3-4490-bf23-e14f85a1e292", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101290, "uuid": "95d5bbf9-c039-451d-9037-d9d9db8e8f78", "value": "98304:M0wrTdXZkB82HO6qmWqY5HtV2radOLi/WUEShiclpsXcyr:Hw/dIrTqzqY5HrKaOLA3B3sXcyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670101290, "uuid": "5456e8c9-6580-49a1-8655-e304906d8e2e", "value": 3768446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670101290, "uuid": "908b89aa-6bd2-4776-835e-8f14f4f25e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101290, "uuid": "712daa29-7267-4706-b5a4-3c7df6e62169", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dadc83b-7334-11ed-9266-42010a9c0072", "comment": "Malware payload (Chaos)", "timestamp": 1670090426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090426, "uuid": "aafe8d17-37ba-4690-a6fd-939dd85fb00c", "comment": "Malware payload (Chaos)", "value": "fb79473241a92f1c04b5bc7ed0cfb2bf", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090426, "uuid": "14955363-e7e6-45d1-9563-e3b04c8ffe11", "comment": "Malware payload (Chaos)", "value": "3cbcf3dee3ab20b3bdc0ac1e536746f1f6ea63a8c242244d495400a88327de18", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090426, "uuid": "5f67f221-fa49-420a-a806-55a313f52b7d", "comment": "Malware payload (Chaos)", "value": "cd127d6ae09b5add9d2c853e3a4e1a24f60e2cf6", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090426, "uuid": "dfcf94ab-8e14-434f-a856-dc52229819be", "comment": "Malware payload (Chaos)", "value": "c23b41629848b0b8c7a291a54843865ff73faf432430729125acd8fb37b44c7747cf2f7e583ba57b4b8eaec190ea7bbe", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090426, "uuid": "bf03e2b4-d504-41fd-a1c6-d4875fd6c5ab", "value": "T170250B2439FB9019B1B3FF625FD8B5DBDD6FB7333606A45A209003474613A81DE9263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090426, "uuid": "05630dab-245c-4100-8e79-8d3537bddf47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090426, "uuid": "2d36fb7b-47b7-4251-989b-78ad03c1bc90", "value": "12288:9mQUSWRuFedHplaBZsazhevXEXp7SNHTdlXqvG3V2r63TwE8ltk1TKjx8fhx+gFK:8QdBr2SSukAEhJWv3306Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670090426, "uuid": "1469aac9-70af-4334-8212-e172b25f2014", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670090426, "uuid": "7cd93dfc-595b-4956-a1e9-fca06e816649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090426, "uuid": "ae6cf26a-c4e8-4a45-a1bd-9f4ce5ee3b63", "value": "3cbcf3dee3ab20b3bdc0ac1e536746f1f6ea63a8c242244d495400a88327de18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f87f1d-7351-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670102867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102867, "uuid": "4550fb68-8879-401c-a798-e53f1cf86170", "comment": "Malware payload", "value": "e692690baeee15040262d06cef5df1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102867, "uuid": "905f3005-ed3d-434c-8373-50c8237adf77", "comment": "Malware payload", "value": "3d20609f369c640dc9124771fd5ab93144d8cd622866beb69c365458b5cb83c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102867, "uuid": "b90b3624-6f2a-4f4e-ad26-889c9ecab6bf", "comment": "Malware payload", "value": "e91aceff3406ee258968008d4652228f3cdae2c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102867, "uuid": "49a3445e-e30d-4a75-91bd-06f2f3bd7da2", "comment": "Malware payload", "value": "d03c4a8a254fe06cfe435406b658c18fdf929f9b562b75b8b3421ffb94917870f44a3f20ae96dc51bf0ffcc241e59c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102867, "uuid": "ea66030c-1971-40a5-bacb-6ef97511d578", "value": "T1DB84E03136B0E472C55F057C84A6EAA0EB7FB47119A49DC72364276EAE703D18A7630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102867, "uuid": "11bb8b15-3bb5-476b-ab46-c87131cc1389", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102867, "uuid": "1cc92d2d-1bd0-4dbb-bad1-0b9507d77fcf", "value": "6144:olFFcsnYk1nhc6u996bLOwjbkq3+UnMW2RqnBLGYc:olFG8Hny6G9kLNkI+aMW3gY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670102867, "uuid": "8b807a53-b29a-4dfe-961b-e571cb4629d9", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670102867, "uuid": "c701dbeb-27d6-4213-b941-5d89b6a10733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102867, "uuid": "de4fe30e-30a1-4278-b1fa-002a359ae6b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7ea46d-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083200, "uuid": "b97e0e24-d46d-4c5a-a68b-0278746743df", "comment": "Malware payload (Mirai)", "value": "dfe2083fef30b7521d6c0d3ee111a5d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083200, "uuid": "6960d1ff-8ce4-496b-a342-9a0e65427323", "comment": "Malware payload (Mirai)", "value": "3e6b39f1a93902583c58b54eb111d6725492c6fccc5734797abab00dac7894f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083200, "uuid": "f78efcc0-afd5-4c62-9120-1ee918cf7cd9", "comment": "Malware payload (Mirai)", "value": "a7b32fe47c96da1f7b5f737b3b9d3327d7ac7ea6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083200, "uuid": "fe46db9b-a132-437b-a979-bdfeebaeb395", "comment": "Malware payload (Mirai)", "value": "9c6e0ebbcf8d1111a41e8e62f6bab8cabf4452b7fa4e48641fda3564dbdde31b6ce848aaf420dcef9fc436719864e973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083200, "uuid": "02d06000-4f21-4849-9296-1468f0eaba7e", "value": "T179539EB9C4E8ED98C6684578B714C93DD723940465D33DFAEB46CAA7800BAEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083200, "uuid": "e6faa9f3-73e0-4f68-90e0-5b1bb5daf4ac", "value": "1536://BMsvJvJabwtlw3bqSsH6aOIy/Cfs32j/JQZI1qhC8La:/JMSR893O6aO+f+uWZIYhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083200, "uuid": "79d443c1-25e5-4344-b865-f08dc036f00c", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083200, "uuid": "46364176-325d-4281-8166-d78f4b78a6ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083200, "uuid": "8c1104a5-6ed9-4f96-9097-56dff895ad6a", "value": "dfe2083fef30b7521d6c0d3ee111a5d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f8221c-72e8-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670057790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057790, "uuid": "9cc29c14-a16d-4cb0-be2e-413d81738cc7", "comment": "Malware payload (Amadey)", "value": "b112223db0ef4d7850b7acc09969d06f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057790, "uuid": "089b22ad-6245-4490-8026-e5fc4ff69ea9", "comment": "Malware payload (Amadey)", "value": "3fe5a1ce986a55334e337ff083af1c6aa740f70c1dc8165e82a7a38657905157", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057790, "uuid": "23c37a2e-a605-49ac-8817-99b5e9478683", "comment": "Malware payload (Amadey)", "value": "1abdf1dd23c25673154d245329d698a73be24010", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057790, "uuid": "9bed53c2-b1f9-430a-86ff-c1ecb2779aea", "comment": "Malware payload (Amadey)", "value": "770cdb7ed5ccd061332fc1a52c3eddcd14b6390ec252ec03fa0db86962029f6ce53dec17e1acb3538318ede2a312a666", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057790, "uuid": "c225aaf2-6f78-45c9-8881-23838db7a317", "value": "T1EF84E03177B1D872C98705704062DBB1AA7FF4F25DA09ACB23A5276E5E313E18B76306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057790, "uuid": "fa1edd55-78a6-4847-8858-342b512db924", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057790, "uuid": "e6bf6a30-5189-419c-b8cc-ad130297c9f2", "value": "6144:++YSw/zXYh1u4fr3iHOepwiZCRfCo6nMW2RqnDZYi:++I/zXAxmHdHC0PMW3DZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670057790, "uuid": "f74b9289-738d-4778-97f6-e5aaf27f597e", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670057790, "uuid": "41406cc4-58e9-423e-8313-11c8d7608243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057790, "uuid": "86e297d9-dfe6-471e-9615-45a0a0eb2c14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e92d1a-72c1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670040944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040944, "uuid": "e6832e09-20e8-4e5a-ad13-5ace6f07cb5a", "comment": "Malware payload (Smoke Loader)", "value": "0ca57024f575bf3a62205224bdedc860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040944, "uuid": "7e7f913b-9bc0-4de4-ae70-79906fe557e0", "comment": "Malware payload (Smoke Loader)", "value": "411d7e9d42f4d9decd9b9b275cf52c26a82f617a8deb8c52b97b53ebe47296bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040944, "uuid": "e0d6ac71-6160-4df0-b26f-7e94048dfed5", "comment": "Malware payload (Smoke Loader)", "value": "69d75fd36076dbc60f57871ebeeb01c800697a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040944, "uuid": "7bb7a35c-c189-415a-8359-11a38a3fb4f8", "comment": "Malware payload (Smoke Loader)", "value": "ddbf8501f3513270d94b32bef32130f91bb06f8a83b101427ab50d488c81b23de7385cc92f2de3181ca81f57c8aca039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040944, "uuid": "aebeda61-117d-4ffb-b515-67c618f57572", "value": "T12E74C000F591C836C68605FD8826EBACAA6EA8315664D90F33746E6E5F733D047673C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040944, "uuid": "404c137b-15ec-4252-a1e2-e19d597b0141", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040944, "uuid": "867e4d97-defe-4815-aba2-41c225929e13", "value": "6144:/odTIlKLI8FyXcR+KQtHLthP97TmZKOOguRKUM4/jp:/oUK1yXFKQV187aRKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670040944, "uuid": "8fc75d8a-b041-468f-b4cb-2336cc022675", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670040944, "uuid": "4bb2dd2b-566f-4558-8214-f4505edf55b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040944, "uuid": "4102b69c-72e9-4599-9a1f-d4813f8bf361", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d49ac6e-72f8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670064709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064709, "uuid": "f8d0085e-cd14-4c9e-8e94-52fed2ed12d9", "comment": "Malware payload (Smoke Loader)", "value": "2d4e1c6820b711f7976c49fa5a52cb2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064709, "uuid": "888ec278-e477-4ce6-bf5e-3e184386ddc8", "comment": "Malware payload (Smoke Loader)", "value": "4213a7a83f792214b9cf0f495d736ba3be5eb07a0ad7513e08421c29a9e865a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064709, "uuid": "ec44879a-8e3c-412e-8d68-a5a5a4bafd38", "comment": "Malware payload (Smoke Loader)", "value": "09f5141a65f3ea43c1c360bd3483f922ea1b6b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064709, "uuid": "b40a2ca1-c578-435c-bb14-a7d82035c7d8", "comment": "Malware payload (Smoke Loader)", "value": "54eca3993c4bbc3c613a76a0a7812b962ee2fe3a2e09458ecdaf8aef02e47444c3c93806df4c6c2df1d53d31c662ca07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064709, "uuid": "225c4936-03f2-4dbe-9528-427f14e660ac", "value": "T1ED74DF3176B0E832C3530572C166EBE09A7FB93259A1D9C733691B6E5EB03C18A76707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064709, "uuid": "1f94a49e-cc6a-4943-afeb-025dde187532", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064709, "uuid": "228352e4-52d9-4b3e-9422-56394a755a52", "value": "6144:pGlTRA+en+l4AFi1mJjQaj3agSGFlXnMW2RqncLpXYo:pGZRA+ZhicMajkItMW3cLVYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064709, "uuid": "77e1f123-1526-4715-97aa-736c046f02c3", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064709, "uuid": "5e2a138f-6224-45f9-b677-e722b7e5501a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064709, "uuid": "adf342ff-8878-43c3-9fb0-5376c1fcd68a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d819a1-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109064, "uuid": "05f7b12f-7d98-49af-9239-85abece883c5", "comment": "Malware payload (Mirai)", "value": "9d9e0f68eb4192f15012c238d2190401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109064, "uuid": "fc574112-583d-4f6c-be96-323a275de7e4", "comment": "Malware payload (Mirai)", "value": "429160d446485226df9b098904bf99625c55611acbece572ab8f2abefec91a0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109064, "uuid": "29d97e0a-c5ab-4d60-bf97-94f2a8a0b290", "comment": "Malware payload (Mirai)", "value": "afafdf98827f2acabd614270f775ab870dd245a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109064, "uuid": "e757d9a3-0c93-4c0a-ac60-b5e0aa4a28a3", "comment": "Malware payload (Mirai)", "value": "310a4644ecea152c4b109dab401ed393741bfa7364cd246b233d2d0bfa90985e36c79e9dde34232f4848a5f9c09431da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109064, "uuid": "a8a81e1e-7c31-4699-bea6-ea9257b036da", "value": "T1CD631856F8818F15C4D502BAFE1E154E371717E8E2DFB2139E206F603B8A56B0E2BD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109064, "uuid": "c8232770-faab-4371-982f-7272d145faa7", "value": "1536:9/nO1aCTYOgTBo3MuozK+MafQjTQlMJimV5l3hmOb+10mI:4a0Y5toQW+BOV5l3hmOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109064, "uuid": "e1657fde-f0eb-40ef-943a-3ffc5cd9f676", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109064, "uuid": "d288b5cd-b9bc-46b5-a9bf-a88b07821d99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109064, "uuid": "80e25a4d-8934-46ee-ae64-37ba04f87c02", "value": "9d9e0f68eb4192f15012c238d2190401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c0e24f-7321-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670082435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082435, "uuid": "d38d9609-8bce-4ddc-9df6-8e1e62ccded0", "comment": "Malware payload", "value": "bed51d77dc5e4496c9abd5a5ba493414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082435, "uuid": "a34d5e9c-9370-45e3-8648-ed743f50bdb9", "comment": "Malware payload", "value": "42b4ef73941a95d500ffa0ad413eff312f9caa7b8589ff0ee0642a9c4b1cee3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082435, "uuid": "d1743e3e-871d-45eb-bef3-ef3dfad49cb1", "comment": "Malware payload", "value": "49d08ee4c0e89d1a3fe1815156276486cb9e1e77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082435, "uuid": "9faf0e9e-5593-42e1-9e13-c4bd1b76fe1e", "comment": "Malware payload", "value": "04e6ce4d4bf3b0f098358455d86961939dd04258fc09de611927e708fe1b8561ae15876eac8ac79ae47e6cccd90f7929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082435, "uuid": "73265bad-faa9-4d61-8c3e-df58278ccb81", "value": "T1F016CF68DA0390BED81305F0057BFBFF9520563548E18C5AEA8CDEB4AE72DA2571970F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082435, "uuid": "f2ee6666-016c-4e29-9539-57c41ccdca9e", "value": "e938cf895f4033bfe19de42d5b79b0de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082435, "uuid": "b2114212-5b63-4db5-b2aa-bde0b0ff200b", "value": "98304:4UV867uFPrfCGiVGcmYWQ6IU8PYV/k1Kd8aCC9NLWmDmYIEAkl3g:TVlksmYf62EsKCCXLhXl3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082435, "uuid": "6ac7dba2-c97c-4c37-a949-b6a22d8c10e3", "value": 4231384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082435, "uuid": "af0867ee-32b8-451c-bc09-d06fe29c4bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082435, "uuid": "6f92ce02-02c7-429c-9864-700b75e53e8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f310711-72ff-11ed-9266-42010a9c0072", "comment": "Malware payload (TeamBot)", "timestamp": 1670067612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067612, "uuid": "205df5fd-0914-474d-ab5a-bd939eea0a93", "comment": "Malware payload (TeamBot)", "value": "6f9bdd58f6e5339a90ae7c38a963ce4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067612, "uuid": "f29ac938-f239-4819-a08d-7b5ad7ec52bd", "comment": "Malware payload (TeamBot)", "value": "43f822b1220756e8484429635c2de1d11565e1c1de484c735dde760b06033867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067612, "uuid": "2304ae1b-f5e6-4bf7-bf52-6978a4ceb483", "comment": "Malware payload (TeamBot)", "value": "199064011605cd86388f66865404a7da4d384fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067612, "uuid": "25108059-c12b-49c6-9b51-6e88942ea1a4", "comment": "Malware payload (TeamBot)", "value": "3fea43a5b466a32bb601c4a150e8a88d2f201d009257f06312c1effdc1e3ef1e482d5dbb66a7dc24e62ce80f2a711e54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067612, "uuid": "93ef1510-e231-492e-8104-e0d8c6d4ce0a", "value": "T1D5F422223580C172F62B9174AC05D6B46ABB78B4093967DB7FD902AE4F343EADB11347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067612, "uuid": "979278b1-16cb-48fd-b238-6ef2d8ae161f", "value": "099d662a2293f03d302e7f9a64bba216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067612, "uuid": "403113b8-3b18-42ae-920f-85dc4c0a8e1d", "value": "12288:6gnDX4H5bVSKW4hfNRE2/l7wH0SgiHzHpzGf6O1FujvQB1SfDLoy0uqwF/WB:6AW5bVSKW4hfNpd0GiTpM9FMPoPIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670067612, "uuid": "8b9de9a0-70e3-4f0d-af5f-947490374961", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670067612, "uuid": "f7a93825-fc7c-45ca-85e1-77a8f3826086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067612, "uuid": "5799fcd3-83e4-446c-b766-2c30de07f6cd", "value": "6f9bdd58f6e5339a90ae7c38a963ce4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b81f9e2-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670108998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108998, "uuid": "3cc3cc1d-8ea1-4d15-b7f4-7d7cd0f71671", "comment": "Malware payload (Mirai)", "value": "4a2877c5f867e623f99d3b6669e57eea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108998, "uuid": "22687a17-8cbc-4b22-a191-3e88eb3c5751", "comment": "Malware payload (Mirai)", "value": "44a1bdd0e0af0d5080d6c00b869d008be5a74d5488cbcbfee72db20ec2be301f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108998, "uuid": "5b65e8be-2524-48f6-9e05-41fba7abf519", "comment": "Malware payload (Mirai)", "value": "63c826e99d8c7ce4517da21e175bccf759678eae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108998, "uuid": "5026415f-08d0-4cc7-8668-cac5880c3ecf", "comment": "Malware payload (Mirai)", "value": "71a0deb5374345206e65286d49f2e1fbe4d4bda397a1dd49ee86cac253ba515656a729d209a9d29e7f38735827ef0ec3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108998, "uuid": "f209870c-0530-4300-b358-ae5c1149b005", "value": "T1A9338EB5E42E5E90C15602746428DF345F23A6C4E3836EF60795C3A24457BADBA0AFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108998, "uuid": "7022f577-e268-447c-b750-94db040c5641", "value": "1536:Nak4Fo5dhwX4EupnCkIK59kCCS0ob+10mq:Nr4mFk0nCkIK59kCFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108998, "uuid": "50f64056-f4ab-4576-b1f6-2f0af47bfc16", "value": 51588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108998, "uuid": "9ea51abf-36cd-4b42-90af-db4c18fd59f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108998, "uuid": "2d14a801-d06d-4239-8e39-bb275c1954e9", "value": "4a2877c5f867e623f99d3b6669e57eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43d6c87-7334-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670090571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090571, "uuid": "848d415e-874f-44b6-8f6a-a43a2ac051b4", "comment": "Malware payload (GCleaner)", "value": "1d6636b2150be085ce7de68c7bd5b8df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090571, "uuid": "7a15fdcb-e5aa-41aa-b100-4a5d4578fdc6", "comment": "Malware payload (GCleaner)", "value": "46d12f6912d53d3e2cb7eae11b17556ff019ac9137d2ffa34dc40381ee2316ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090571, "uuid": "1ec78273-49c1-465e-8543-141362b3eaba", "comment": "Malware payload (GCleaner)", "value": "08e9b0130986187d32bf031d9ad5ec0343ba14ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090571, "uuid": "29882715-9127-4da0-8111-ed735c9b5afb", "comment": "Malware payload (GCleaner)", "value": "20c86a9d86844e984ea0903fb022d1c654a6e2e5439b118a3bf6706c3ae27391af85588a9399d3f0ed64404153e735bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090571, "uuid": "c7424aef-e871-4938-90b8-dcdaef18ba8d", "value": "T18F063363C49AC332C9729D700BE64BFAC47B1DE758BC444239D86F16253AF45B9843EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090571, "uuid": "3d41080f-c3e6-4118-baca-8b5784f3b4cb", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090571, "uuid": "980e09d3-37aa-45d2-9b49-4aa499c52a8c", "value": "98304:IZ1ryowf9Wc/PLFK069ZfREDTUBW0oXcyd:OdHiPZKZXkXcyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670090571, "uuid": "d0cc40fc-70fc-460e-babc-01f2e75c3605", "value": 3761917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670090571, "uuid": "e51af9c5-e835-4881-b0ba-369a45a06e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090571, "uuid": "a294efcc-6481-43a5-81b1-256d22dc5f24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d880d85f-7341-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670096216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096216, "uuid": "c0953fc5-635b-43a6-a9cd-68df29ec2f62", "comment": "Malware payload", "value": "bb3f40b5c57eb16231202d7a3ec8c165", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096216, "uuid": "79fec842-46d7-41c8-8f0a-48fc853f5387", "comment": "Malware payload", "value": "4ac35beaa9c9fd6e8e9e996db3f2db385499bc58a04e1a33431499e47d08805e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096216, "uuid": "335924e8-c595-4b8a-9510-4573ab7c54d8", "comment": "Malware payload", "value": "cc34fd0b091e34df4e2617f9b16aa53f6a37282d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096216, "uuid": "0706ba5e-bede-4e25-afec-7fda87160584", "comment": "Malware payload", "value": "5eb5aca3e742956a2a35548b4b1eb44af8793f687d735acfc2abf5054dfd1e612be7a5eb18357cc40fa90886ce5c655a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096216, "uuid": "dc2596a0-16f7-49fd-b30d-d70c6f1a1872", "value": "T1F374D03072B0D972C56E413C9566DBB19ABFB9325D6099C32369272F9F303D18B6630E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096216, "uuid": "666602e6-0cfd-4760-8ebd-dc12006af7bd", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096216, "uuid": "7d9f72ef-884b-47b1-804f-86b2f343a79b", "value": "3072:AOpnGPSgIV5gjH68w6Ad3hdBn3EeCmtW5of4LQGnWNTC6NRMHnlX7LPLHYDrEGo:rntgIYjHi6Anj3FtAok7nMW2RqnpY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670096216, "uuid": "5526a234-4d02-4540-bb16-602981f4e0e2", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670096216, "uuid": "285b077d-2abf-44fd-b1de-e059f95ebc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096216, "uuid": "b0e91665-0515-4b28-a261-8333a70c522a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a172b5d3-733f-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670095264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095264, "uuid": "6a150b10-7fed-4f0f-a9bd-bff460cefd7e", "comment": "Malware payload (Smoke Loader)", "value": "2acfa9bd0bc95541b7f1bff8dad84c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095264, "uuid": "60d26506-57aa-4e71-a281-0c3874511731", "comment": "Malware payload (Smoke Loader)", "value": "4bcc65733e78cec8015f4ce203db00cce503f71470dc486ffb67ef8511966d15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095264, "uuid": "74d652fd-0bf2-4b43-9459-51aa845b5a87", "comment": "Malware payload (Smoke Loader)", "value": "dbb0da1581757b8f579b59e6a40ee74035b4f32d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095264, "uuid": "d4a73c2a-bd98-410e-a2f9-770128e827bc", "comment": "Malware payload (Smoke Loader)", "value": "5380a215559d50dfcb9718794dc9614375d1b56d0c1fd86912c3a2213c358eb695b0f85f917e1cc6d67d5c382cbeb999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095264, "uuid": "776bf3a7-5221-47bd-9e0a-03cb83b3816a", "value": "T15B74D03176B0C872C59305345526EBA1AB7FF83258A195C737296F5EAF303C28A7A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095264, "uuid": "2296834a-dd79-4cd5-8160-41f96791065d", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095264, "uuid": "e4d2eefb-a4bd-4c92-83fb-bfa128a18de5", "value": "6144:H0J6S59/aveWZCTkBMY2tDCxbnMW2RqnLqY:HEH6tZCTkBFMW3+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670095264, "uuid": "544f9fc6-7efa-4c49-80cb-7be18da1a42d", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670095264, "uuid": "a64c1483-1523-43eb-8cb1-e9a93d8913c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095264, "uuid": "431ccd95-32b8-4af6-afdf-0c1f23e6d874", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6871c5bc-7318-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670078418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078418, "uuid": "ce36e85b-c7ab-4796-a7c0-106afe6ee5db", "comment": "Malware payload (Amadey)", "value": "f03a0b08812c23c4e0af20d5c62c62e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078418, "uuid": "dfd2b19a-52c0-4687-ae0c-6009444c7dcd", "comment": "Malware payload (Amadey)", "value": "4c2bae54ee075be22551847a7164b690259e1de0ebf5f1b087a1b8e8048ce8c6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078418, "uuid": "5e3804b7-1a75-4c52-a8b6-078fd3fd877b", "comment": "Malware payload (Amadey)", "value": "f2b96519f27c09624192ed17a46469bb8f3ca038", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078418, "uuid": "b735d10c-c377-4235-808a-ed6aaabfc37a", "comment": "Malware payload (Amadey)", "value": "32fe27fac62759197069bf5f9c763c0e5e2932075820fe4c6e08f6bd2570c62c283c8e331a20ff4ae61d47cf9efd2b5d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078418, "uuid": "becfc61b-6460-452f-ac02-f70a62f9d264", "value": "T11684E03076B0D432C56304358066FBB1AA7FB9325DF5B9C72365279E6E303D18A22F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078418, "uuid": "b31e559a-0ab2-4efb-a59c-4078ae282e18", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078418, "uuid": "941f42a5-5517-4da3-8553-aef66f4087ab", "value": "6144:a2uXyAXKdlkQbj6qFPlO5r8DbOFnMW2RqntElY:a2AyAXRgjrE5+bOhMW3sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078418, "uuid": "8029473e-fd6d-46bd-92c9-51b59bf1704c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078418, "uuid": "b97ac604-5427-4ba9-958e-d2325b61661a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078418, "uuid": "ef4257e4-1f63-49b5-8277-7cb28b6c5d5a", "value": "f03a0b08812c23c4e0af20d5c62c62e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1ba210-72cd-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670046423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046423, "uuid": "a061aff7-6d3e-47de-889d-78cf1d118d42", "comment": "Malware payload (Smoke Loader)", "value": "73db407dbae69ddd26b73c18d004e362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046423, "uuid": "724afd82-0f36-4a21-b6bc-6276c6ec6ba7", "comment": "Malware payload (Smoke Loader)", "value": "4f294afea378ca5c1ea9a9dd77a6eab35014ba7808d04f9fe92a7adee38a774d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046423, "uuid": "ef28ea21-9abb-41e8-bbbf-9efb56c8a3e4", "comment": "Malware payload (Smoke Loader)", "value": "b89d02fe427752d2c4d2347b4dd6e7bb650fd522", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046423, "uuid": "b3c217ff-02f1-4ddd-847e-8d58f3b50c56", "comment": "Malware payload (Smoke Loader)", "value": "44b12ea4f3fa82f6c28df31f00fbf3a14b794d7fc4eea2da09da21039d2f1045e229fb4fff7fc6096eaf562748a2574d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046423, "uuid": "4b8cca05-1cd2-4fb8-b170-e69800242055", "value": "T1CE74DF11F691C876C44205FD8825DBA8AF3EA8316A25C94F37A87E6E5F732D142763C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046423, "uuid": "5b5c5a1a-8f6b-4333-b69b-18dd41b9b596", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046423, "uuid": "ae9f0895-616e-486c-a79f-d21fd6a5a6b6", "value": "6144:r0uIA+Ld8StMcRFMlJFNdl5gL7uRxqsuqjp:r5B+9tMNs+Rxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670046423, "uuid": "8f0151c8-1b57-4afc-91e7-4ff149a46899", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670046423, "uuid": "fc1a9db2-2bf4-4848-8b01-b07122c98b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046423, "uuid": "e2f88e59-38b9-4739-bf5d-2322c054cee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80894d90-7342-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670096497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096497, "uuid": "afb71564-9f8b-438a-b28f-5650dcb724a8", "comment": "Malware payload", "value": "fe0f93404b15f80818aae121eadf3d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096497, "uuid": "89307c4b-9353-4bd3-8738-872c39ba0afe", "comment": "Malware payload", "value": "523c6658b1007a69deee06bc8a1a4ae12ccacfb5182eeb696a75a08b74993453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096497, "uuid": "cfdb94df-66f3-4ccb-8afe-0d298ff01dcb", "comment": "Malware payload", "value": "f031e7cecc35da5c18d60e3cde7038d136c1de38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670096497, "uuid": "4a2574a0-8a15-4837-b134-214d92976c95", "comment": "Malware payload", "value": "6e1b00b1460120d1ce4e786a28749026a39e62aa55ed1da7aba71c376fce0c967aaf8b8ac7840ffc4f22f8afd86ce316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096497, "uuid": "0cbbe46c-cf7c-4cfb-acde-919b575f1fdb", "value": "T1DF84E0303160F472C6974431856ADBE3AA3BB9325971DEC763696A6D9E303C19F7230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096497, "uuid": "d534a6c7-b3a5-447f-825f-b2898a70095f", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096497, "uuid": "ce3be79c-686f-4c60-8983-63091f10a575", "value": "6144:elVV1s3zv9bds2d2tgtKZSpZrXSnMW2Rqnqb89YA:elVPspbP8Zab0MW3qY9YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670096497, "uuid": "ddfa0179-e3d4-4321-a94d-db8f451a7dc5", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670096497, "uuid": "8afa75b7-b5f2-4fd2-92bf-913a795e6b58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670096497, "uuid": "1538683b-1182-4199-9da7-7a20dea0349e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40567732-7345-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670097678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670097678, "uuid": "8131cf5f-cbb8-4ce8-b3a3-6ca4ed53441a", "comment": "Malware payload", "value": "061bf2b99ee9fe86da2f79ddf513957b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670097678, "uuid": "511a3c58-eff2-40fe-bf80-41577ee0212b", "comment": "Malware payload", "value": "5242b4344cfffddfceb99a48059caf30a2601038516aeb31f59b672d38455460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670097678, "uuid": "560567b2-c5b2-433a-99df-958fd1de4e0b", "comment": "Malware payload", "value": "d68c880edf54c1ac30db2cca508ca1abf092e12c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670097678, "uuid": "434f1c04-62dd-4905-9457-5eb5e8363061", "comment": "Malware payload", "value": "6a13bcca43258538f0df7a77b76d167b5d24022e9b28fce1c542ed138c56bf4a56bccd263fb12a4fb82edae681a126d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670097678, "uuid": "13a1f9cc-c22d-42ad-b46b-306ede964204", "value": "T1200633B36231403CE1484B71AC83F461441BBBB76D66934273D82BEA7F27DACA91CB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670097678, "uuid": "53c89666-a332-4f00-9eba-d0c2bda3dc17", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670097678, "uuid": "3355d86d-4cc3-42c6-ae92-7ad53b8215ff", "value": "98304:MeYgrTCv90Q1oQ96n+XmFzhULol3FU8yXnz7YraXcyZ:7rw0SoQ8+XmFzh+ol3FX4nIraXcyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670097678, "uuid": "2301f00f-791f-4dbd-903e-7f32ca949047", "value": 3773635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670097678, "uuid": "c11975cf-99ed-4a5d-9a77-a404618732cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670097678, "uuid": "47496a0c-27d0-4bc5-b707-4b59db917755", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d4b188-72ed-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670060128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060128, "uuid": "1a24e88e-04d6-44fe-abb8-342732156f1d", "comment": "Malware payload (Amadey)", "value": "b3969f2ce22792b7d26c1d314d28bd0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060128, "uuid": "834f7ed7-e207-4fe3-9714-5346c71ccf30", "comment": "Malware payload (Amadey)", "value": "52b9fba60a8eb27d5ea44c9e80d4869e5eb7ab8d83088c13b318b9607e045b6c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060128, "uuid": "0ea4e744-9517-43fe-b3f1-ddce9673556b", "comment": "Malware payload (Amadey)", "value": "cb433953bafdfc235a9817c58ac23e57b64474e0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060128, "uuid": "fe6ba553-44e5-4c14-9fa0-4bd8882d76e1", "comment": "Malware payload (Amadey)", "value": "71d9914fce5efbd99e097bd13badbabecb47c6abbb2088cac7696ee514b4e94b984dce78b01dc7c48cc2c2c2e4da7224", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060128, "uuid": "acefc10d-e6de-4cd7-b341-1fa32fbaf16b", "value": "T1D184E0313EB0D876D293C4705466DBA1EE3BB8278DA599C73358166E5E307D28A3E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060128, "uuid": "caf436f9-6b3d-4851-896b-2ea1716b90da", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060128, "uuid": "bff84383-d23e-423e-b894-911a8b7f70b5", "value": "6144:GshtfA6emFPXfkkqfI/6LRzV4yFInMW2RqntTYo:GsjfA6Z/fnqfI/6LrJF2MW3tTYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670060128, "uuid": "9f58e217-80a0-4772-96f4-ba840a06ed42", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670060128, "uuid": "3ef38ec6-686b-4f05-9b33-1ca341670607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060128, "uuid": "a2abcdb1-fc3e-4f5d-9ccd-5bb498c102bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a01e540-72db-11ed-9266-42010a9c0072", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1670052060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052060, "uuid": "77ddcfbd-58b9-4e38-a83c-5ffc40c5120c", "comment": "Malware payload (YellowCockatoo)", "value": "fe6e7a4572c36b4ccd45770cee2ee97d", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052060, "uuid": "333d6d6a-fe64-4eff-948e-d1c8578774e2", "comment": "Malware payload (YellowCockatoo)", "value": "53f94edcd6279d8ae7b4f704b25b58ca91c70f9d5efcd107e4e5c0fc0002370d", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052060, "uuid": "f381e8df-e3d2-43b5-a6a4-9febccb6cb2c", "comment": "Malware payload (YellowCockatoo)", "value": "6630ebc137d257edab8c2b3d417b53ffa42d5483", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052060, "uuid": "08fcff0f-80aa-4901-8165-a48845382a88", "comment": "Malware payload (YellowCockatoo)", "value": "d074934ddd1d54a9406154459f2b409413e08062b717947c8daf392a73f63491f720ed81baaf1758449b6debc9ce5cd0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052060, "uuid": "c95d345b-23b9-44b5-a5e3-9b408ed43639", "value": "T1C5F5FF8181AD6BE7E5904EEF5D191A82F382B52190D5E8824CFF732F1698CF677814E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052060, "uuid": "917a7a74-5048-4591-9bd7-655b197c5084", "value": "24576:AclkPToIpBYHo5PFllAewm+B3bIFerS6UqPiXz6eYzxJNUtuzU:AcWPTuHondiLIFelPr3x7UaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052060, "uuid": "e6ec92f6-a19b-4d48-a0e4-4a8f9769e44b", "value": 3454500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052060, "uuid": "74fb157b-c36f-4100-ab43-921fa5fe02e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052060, "uuid": "22f0ba92-a5ba-46f7-9fc9-99d807048a63", "value": "8530546911.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d60189-7338-11ed-9266-42010a9c0072", "comment": "Malware payload (zgRAT)", "timestamp": 1670092045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092045, "uuid": "a1be09b9-16c9-4abf-b559-4ca629d90225", "comment": "Malware payload (zgRAT)", "value": "20a99b793163e9b1a79ea11a74debb42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092045, "uuid": "1e647077-dd25-4171-a785-f40bd557f0c4", "comment": "Malware payload (zgRAT)", "value": "5610a0d658d856896277979b6ef9d099340442c501644f5844d37724a25f1fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092045, "uuid": "f408bcc3-96db-46f2-901c-2879f29b187e", "comment": "Malware payload (zgRAT)", "value": "8eceaa1d92d71fcedd55192f47b03d5da74a2470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092045, "uuid": "4dc9048d-2448-4456-a391-ffb97b98ab96", "comment": "Malware payload (zgRAT)", "value": "ac21b51c53a12d1eceb9d79dd55cd9a7893629ad13674282cbd92b4ccc5ef76ff75250f8ea1ffbbbd2a156f8512e6c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092045, "uuid": "2e05eee2-ab7f-4e17-b47c-e18c8febeed9", "value": "T125F49DD613855C93CA097EBF1E8DA98E32BE19F3DEFE90C81D58B84116F66199D00EC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092045, "uuid": "fec06c4f-83cf-4c03-b8ee-eb27987d5fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092045, "uuid": "b8e5e3ea-a483-48c7-8455-05d100fb3a63", "value": "12288:BTFLOm73Swx7bK03P/HO5U09+yTWsUkOui5dkNJfp/sVfdc:newU033OYDDndm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670092045, "uuid": "757c424f-2d1a-4964-a18f-d00b2c5ca9c0", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670092045, "uuid": "15927413-ee9e-4cf1-992b-6687bd8d2725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092045, "uuid": "9f1d860b-3408-449a-bb61-aee3b581819d", "value": "SecuriteInfo.com.Win32.CrypterX-gen.16708.32103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731b878a-72f3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670062545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062545, "uuid": "2680a019-dfa6-4d7a-9252-c6ce5fcf0150", "comment": "Malware payload (GCleaner)", "value": "780099266c4cf79fbf344297b0a4e29e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062545, "uuid": "da301b15-8cc9-43bf-86c9-9426fffa3b52", "comment": "Malware payload (GCleaner)", "value": "56c2ce95cb453b4e04a32a274ff5bfbbc79d8f3109c95b5310dec5c5d6c95940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062545, "uuid": "24f2c779-4830-4a06-989c-680fb0d0b2b2", "comment": "Malware payload (GCleaner)", "value": "4cb236de55a5be0cb33a17bc8afcc37745fd5fdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062545, "uuid": "97332412-e626-4205-b0ad-bbd322dd6fc7", "comment": "Malware payload (GCleaner)", "value": "d949719b8d5b6e4d4dddb974c3611b09dff4f3d62564fd61455518a6730c3b39e06eccf8e9f15b1a6321b5254d4dae72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062545, "uuid": "08b6c848-ea3b-41b8-877b-d10a5503a91d", "value": "T1340633097226BE39E6C35EB12FDDCC051832BDD5A96FCE422BCC121C3F15599E8997A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062545, "uuid": "06735800-d940-47f9-bcc6-8f8fae5b476a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062545, "uuid": "417269ab-a909-498e-90d6-7b8161c3de8a", "value": "98304:Y6FkeCkXmcadfFjZesdsnA/dSr/zupZXcye:TFkHc8fFj7obrrurXcye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670062545, "uuid": "dd41273e-c604-49a6-98da-99bb54fbbfd4", "value": 3702253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670062545, "uuid": "a6bcad94-e450-4c13-820f-ae023e80f6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062545, "uuid": "51cb4ebb-3819-459a-972f-879e8242f95a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43f4fd5-734e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670101819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101819, "uuid": "4e5058b5-5a82-4ecc-8163-b020eb6724f9", "comment": "Malware payload", "value": "9a209ba173f414d86c6c593aa0a21e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101819, "uuid": "15f05912-08af-4acb-af1e-77f4c94d75a5", "comment": "Malware payload", "value": "571d1dcd69d0b217fe9746282523e5a073eca6f3f3fa10cd0ebf25252c998cfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101819, "uuid": "293c37bd-41d1-4de0-ab03-2066387d5650", "comment": "Malware payload", "value": "73235784af910007a10dd4f6e4534e5d9e2ae36d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101819, "uuid": "b1e2f41b-61dd-46f3-91ce-4710bdc20ce3", "comment": "Malware payload", "value": "98388044429602e055a2b96c385473eb78457c55c05d1228873ab26e50d927eb7bff3f4cf735d9c20b2010d8db2df40b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101819, "uuid": "cf92822d-4dbd-42cf-b93b-3dca715897c0", "value": "T11374D03075B0C872C693057D8466EAE19A7FF9329B608ED72759276F5E303D28B26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101819, "uuid": "54428ada-2666-458d-bef5-b702de29a90a", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101819, "uuid": "d99fa053-18ce-4106-bad3-a2c81d848074", "value": "6144:u7p/tYs9ZN00cGgQOnMW2RqnL8IFu4Y8:uNl7RcGKMW3L8UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670101819, "uuid": "4519f274-77fa-4f8f-90d9-ae033bfdb867", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670101819, "uuid": "b355f17e-89e1-4d24-a1fc-bb277f23673b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101819, "uuid": "76594d67-18dc-45cb-ba7d-254b535ae013", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98b6266-7339-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670092728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092728, "uuid": "980c546c-621a-45d4-ad09-daa9ebcf57e2", "comment": "Malware payload (Smoke Loader)", "value": "621c0fd0ee8af3ecc89e689777b63f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092728, "uuid": "1a3a88dc-774c-409d-990e-46e956214469", "comment": "Malware payload (Smoke Loader)", "value": "5ab83cfcc4777f72f2915aff52432a07d80941e77b0b2468e447743f7a4d2824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092728, "uuid": "60abf2a9-b4da-4a88-9ab8-9b4a9de505e1", "comment": "Malware payload (Smoke Loader)", "value": "b8f806a993aca6c562b72be8a52f9484fddb22f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092728, "uuid": "615e59cf-30ff-4836-92f0-353dd4736234", "comment": "Malware payload (Smoke Loader)", "value": "271451104c7c1b735efcfd3920a4d34ec80adbb2b44b897ce79c2228fd294f7864d86fce9db454c586c53856027dbdec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092728, "uuid": "80bc8e88-76a1-4b16-b939-87a3c08a653a", "value": "T1D674D03436B1D873C95305349426EBE1BE3FB53119A199C727692BAE5F313C28A2634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092728, "uuid": "cb9abe1a-a46f-40d3-8e88-885cd7adbcd1", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092728, "uuid": "44e0593a-48be-478e-af04-1a1bd89cec50", "value": "3072:dF0xxK/V7I5A2aHUBGZ3NFR1Et3GQ6HswXd5c5oGnWNTC6NRMHnlXVXZUBRsxHYg:Cx0V75f931Etyt2znMW2Rqn7JUIVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670092728, "uuid": "23213ecd-d73b-4a1d-8c76-71ad5721888a", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670092728, "uuid": "99a68c73-1145-48fe-9cb0-37ce6eef2a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092728, "uuid": "8fdbb0e1-50fa-4f83-9d4b-ca372c71a519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a841156-72d9-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670051229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051229, "uuid": "32344439-b2ef-4cd1-8b13-5d51beada3fb", "comment": "Malware payload (Amadey)", "value": "e92306ddbff9d092e07365196a7f554b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051229, "uuid": "c44e1ce8-72d4-472b-8553-8b999ef415f2", "comment": "Malware payload (Amadey)", "value": "5af13aebaae22404d2958289cf606d9dc7b8e3918358a06ed0a43e7a72eff432", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051229, "uuid": "fa53ce90-5f29-46da-b740-ad7e410979d6", "comment": "Malware payload (Amadey)", "value": "8480210706aaa2770db94284faaf6cbafe309ead", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051229, "uuid": "5fffcfcb-5ef4-4340-97e3-4c2065b0b7d6", "comment": "Malware payload (Amadey)", "value": "8f438421cc88e0f59b2727af2e09ca4eeb1ed135f7b3889a116be15695cf19deffffe89d2890b6dd5589128d63bff4da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051229, "uuid": "0118c87a-f67f-49c7-8be9-c681e34f20dd", "value": "T1BA84E001FD90C476C18207F98916DB98A6BEA8315A21C57F37642E6E1E332E056673FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051229, "uuid": "08634649-841c-4308-9eb8-88d3e2d78954", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051229, "uuid": "8dc57b3b-9dd2-49e8-b341-05f34c4d9ee6", "value": "6144:t6i3IKeL38SpgcR2wkOVApVaR+8wAcIBuynUQuR8Huj8:tPTe7pgxOVApYAz3IBuCUdR8HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051229, "uuid": "8724f95a-f68e-4040-8047-31cc27e0bf68", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051229, "uuid": "4d37e18e-abec-4a0f-a3f3-168284c5d574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051229, "uuid": "e8535b94-cd65-4efd-9986-33392c58d9b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa534a62-72c9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670044598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044598, "uuid": "c4b88fcf-cc0d-4ca5-a1da-5b4e069a56ea", "comment": "Malware payload (GCleaner)", "value": "e6ec61daa8256a411b99ee84c8b84774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044598, "uuid": "6dc13c19-d3e6-4f7a-a848-a2a516d4a767", "comment": "Malware payload (GCleaner)", "value": "60c33c174a42326d2b867b697df6d9fe33bc83d4b124e0eb69dcd5cbc5db9d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044598, "uuid": "25e1dbc7-ca7b-4dc9-b036-8e640b7d69bf", "comment": "Malware payload (GCleaner)", "value": "932aee58c158bfa2aa25ae5d78b83baf33901881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044598, "uuid": "249d96e4-9275-41a8-9986-95916ca80413", "comment": "Malware payload (GCleaner)", "value": "f8ef3eaed7c919dcde879aedc51bcfb1f8fe982e8aa8dd10c18249222e38cce7f5edf0f13fe0549e53bc6ed66775db81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044598, "uuid": "7d3303e2-0203-4df7-b862-27e07e67b521", "value": "T1250633EBB6564D38F0B0057DACC5D6C62277326488DE1B0A6FD5EBAB1FB2121CC95213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044598, "uuid": "cd881150-5697-4edc-8abb-c0fe7f6f4d16", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044598, "uuid": "f03a82c0-7c90-4a33-b902-066ff58899a3", "value": "98304:8++vECLo6ITS9Qt08QZqk7R7WgY1s24BXcyO:nnT3UcklBAeBXcyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044598, "uuid": "3d47c8b9-f742-46a9-a33e-e5291473d55b", "value": 3740097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044598, "uuid": "567aae55-07d3-492a-893a-11c6e6d6daae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044598, "uuid": "2d58beea-cc4e-41b2-a090-fc99c3aee659", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5371c453-72d1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670047889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047889, "uuid": "32946a3d-2ee6-4c2d-9014-a1cea47f1ee1", "comment": "Malware payload", "value": "1f580ce580680da21e09e100dd1c1429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047889, "uuid": "fbbb78d2-766c-4932-8fa3-8fa4a7cb476b", "comment": "Malware payload", "value": "60c92bbca6f81c66a589a6bb41843702c487e8832097152badb5c8980e71d934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047889, "uuid": "391964de-7e63-44da-a19d-4651a7e8e61c", "comment": "Malware payload", "value": "3f1c76081a99f5fae7c98b5f3e43e95240e0e67c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047889, "uuid": "32b81c52-cd25-4fd4-bce9-b41eabfb0951", "comment": "Malware payload", "value": "ad8d42263318a58b1f41665ae0bc87773cc43c7f1dc93852bdadb401e6f9268aee6bb01e3b3ad2c33c36615090b53df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047889, "uuid": "359130b8-79b9-4177-863d-11581c9cdb12", "value": "T1F576337035D48CBAC2A13971856442ED6CE8E3220E69C47F93E4676C3E3DE59E0377A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047889, "uuid": "b6335048-5963-4a9d-ac27-655e0017cbcb", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047889, "uuid": "4c2f30ec-87fc-4ea0-8cd7-d41ff8f6fba4", "value": "196608:91O48t5S//naG4zfZuyc1RRV13UvWVAVw0RiZjNnR:3OTt53zf4n3U+swlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670047889, "uuid": "beab8710-2419-48fd-9c83-ffe54e43d38a", "value": 7601577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670047889, "uuid": "bba69e99-ad92-4ff0-8367-ac64ba3b2cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047889, "uuid": "aa451c70-05aa-4f68-87b5-f3bb5d2d105b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9285a791-72a4-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1670028667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028667, "uuid": "bb5c9d5d-a75c-4606-8f54-98665d6a713f", "comment": "Malware payload (SnakeKeylogger)", "value": "42a3b27df3ba1849780e526c42de50ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028667, "uuid": "f21da4a8-e34d-46ae-acdc-a3a68d11da2e", "comment": "Malware payload (SnakeKeylogger)", "value": "6121c5bbafe4f3afba5ca58695f5951e99c5d638362fc9536e32a249c16f6442", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028667, "uuid": "346e70e9-feb0-4b3f-aefa-49472b5f813b", "comment": "Malware payload (SnakeKeylogger)", "value": "83af4612bbcc7f72aa094847b1eb1680d5d95926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028667, "uuid": "6bd84291-f2b5-48e1-ae86-e9bc566659e8", "comment": "Malware payload (SnakeKeylogger)", "value": "c83504dc39866c0ff64bf9c4a71750f0e4dac280bac682f8e513a7593550bc19879faeb4d63e69ffd5a32d24842dabd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028667, "uuid": "20dc7d68-b3e9-411a-835f-874845525f2d", "value": "T1FFD11915AB948777EDA68773ACF353810378E700DD43CBBE4CC8961E88497690B11A74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028667, "uuid": "61aac6f1-a846-4258-915b-ffb260c490d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028667, "uuid": "108721de-1bf3-4ace-9303-8b7d07c5586d", "value": "96:wOaINHv03Lgcwh46MYKFIW2FL/dUrqGQkkeru9w3GnUODL:RaK0q+6mhwD5GceUwv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670028667, "uuid": "5664d223-4752-4c1e-af47-266b59e529fa", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670028667, "uuid": "c9feca28-f4ab-41f8-8424-c2ae512848df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028667, "uuid": "19496255-606d-410c-9b61-e31bd9fef890", "value": "SecuriteInfo.com.Win32.DropperX-gen.6556.5302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d48c558-72f3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670062401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062401, "uuid": "04838f5a-1030-4548-8365-8eb420f349ef", "comment": "Malware payload", "value": "0217a0b22670948d3d986d345a2b9cb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062401, "uuid": "ca4a0c2a-e7e9-48fd-8c3d-55ad898d500f", "comment": "Malware payload", "value": "616812fc478db8cb2f4be4aae6094fb9e93ca2449c9b0841beeb9f7960914437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062401, "uuid": "018132e0-7fc7-4aa8-a278-933639695c4b", "comment": "Malware payload", "value": "716c4f9ee09bacbc8cc20e69518ddfecfe143120", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062401, "uuid": "d3cde30f-297d-484b-86ba-a017328ff61a", "comment": "Malware payload", "value": "f47357bfb7e9e724448191a6510a9ccb3d5d99ceda4b4748a966c3b02846a02263cff907bdad2357977087c109604b5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062401, "uuid": "abc300f2-9457-406c-8e10-64d4708995b7", "value": "T1F8752304ABE099B3ECA6073045ADA77166B9F5709771CB476389863EAD313F00E9178F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062401, "uuid": "8fcba92f-938e-438c-a67d-e37036895a26", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062401, "uuid": "1bb1aa88-99af-48dd-be84-8be27fb80469", "value": "24576:hrkZGqdcYAqu/kVFPhsbuPNPMbMHv8bo46enVRMosJJPM+2Fxu3sCmnx21:uXcYVRKSVUbUUboSMosbIHu8e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670062401, "uuid": "a61c37db-093f-4367-a9c8-9ceb64ee5009", "value": 1596312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670062401, "uuid": "b351fd6a-a469-4b4c-884f-b68a8d8029d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062401, "uuid": "7bee577a-3f6a-47a5-9520-9f32e97fe973", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c7bf0e-730a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670072488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072488, "uuid": "2b6c93e8-baec-4083-96fc-2cdc63298b1b", "comment": "Malware payload (GCleaner)", "value": "fc638d7ebe4d42dc6b4e2f37dc9bff87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072488, "uuid": "b396fc12-420d-4a01-92ed-1563b6db5147", "comment": "Malware payload (GCleaner)", "value": "62287540be46f2a1f4a06fc6244b42bf7ffc468790317d1b88d0a33e5fd30059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072488, "uuid": "accfa26d-8b4d-4eb3-b9db-3572ea0c0e72", "comment": "Malware payload (GCleaner)", "value": "4fd7889ffaeb106c0eb5f44f5c99daa1018f607a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072488, "uuid": "9dd0d613-285c-4518-ada8-a35862b494ff", "comment": "Malware payload (GCleaner)", "value": "2be3a6d978a058da6d37a94517c0d8ca5b79c9ce43de0f8f8317ebfaf4dba4bc591e7e7aefc8b26578725e9c2a033ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072488, "uuid": "d65c0a92-aa35-4b67-aacd-346d2e16e901", "value": "T176F533726EBE0032EB4B9D3D0D874A672421A0E13DBB4285F6AD5FB82C130AD7579747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072488, "uuid": "a290f85d-41d9-41b1-bd24-0a182da1b941", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072488, "uuid": "da9f6b4e-e875-45f1-8923-1058150569ad", "value": "98304:8S4zJ7NrJvpiX23ikjKXd77yiQ6bfDwxDvXkjDaUwdXcyW:/4xAmSkjKXVyiQwf0xDvXkr0XcyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670072488, "uuid": "3a8352f3-0be5-40ce-bf21-80360f0ab854", "value": 3590814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670072488, "uuid": "cf34758a-eb7f-4723-a3ba-f4ddbb4fe373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072488, "uuid": "c0345ab4-fd2d-4663-8215-5fedef5342c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cab36b3-7361-11ed-9db1-42010a9c0080", "comment": "Malware payload (NanoCore)", "timestamp": 1670109617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109617, "uuid": "09043d0d-cfd0-429b-b187-def224e84172", "comment": "Malware payload (NanoCore)", "value": "18cd96c07ff82aa2d322d0e66426734b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109617, "uuid": "68fec927-0af2-4eff-acd5-1efe63bf9447", "comment": "Malware payload (NanoCore)", "value": "62ef85b80d921282ea82b900e2d2663d75e433470a3236146adeddabd3ac6a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109617, "uuid": "126614a0-295f-4476-97e5-2636d1ad7166", "comment": "Malware payload (NanoCore)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109617, "uuid": "91751ae2-699e-4319-804b-6fef1d82cb04", "comment": "Malware payload (NanoCore)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109617, "uuid": "6a776a73-bfc8-403e-ba04-baafaaa2bd30", "value": 344722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109617, "uuid": "e381faec-aba6-445e-8ba0-01acb01873e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109617, "uuid": "08b0f160-d9c2-40d1-90a1-277981e460b9", "value": "18cd96c07ff82aa2d322d0e66426734b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ed7f8a-7317-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1670077879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077879, "uuid": "99adccc9-4670-4b62-b781-7ff4b92442eb", "comment": "Malware payload (AgentTesla)", "value": "67d5f51dbf07a75c9d7b988137220263", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077879, "uuid": "688004cb-8b56-4b07-91a4-a8ec948e97ee", "comment": "Malware payload (AgentTesla)", "value": "63ab71c16a6c9bba733a43e5470b5d67af055a6db778a42e464758556fc47a18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077879, "uuid": "9b9cae89-65d9-45b4-9889-3d287b3590c7", "comment": "Malware payload (AgentTesla)", "value": "cf318ddc9d2af790b61e0b4e29cb4146e4d81f11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077879, "uuid": "5e4b6ce5-452c-48c6-a6ee-82bd553a9f2b", "comment": "Malware payload (AgentTesla)", "value": "f702a9ff63ed3e7c0f7d9562938de48709db6c084f620fe1de18b57cb53c804a9a12e99f16fb77d2e4ba9d9599b20ecf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077879, "uuid": "77316eca-f5fd-45c9-9f23-ef302b8cc5c3", "value": "T16B153A60B1998915FF39C7FC36E1644A309A1DE0A8B96CE44C5576C20F382C4EAF79DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077879, "uuid": "4792f091-c1e1-4e78-be28-8e274b41fc95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077879, "uuid": "1872dee7-c441-4aef-8be7-124da2af3291", "value": "12288:G0wOZQAZ4qAbHqvkhlByhqwIjDKOngN9gyPvLT+ikg586aWHff:GeRAusLchJlnNmyPvZB5O8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670077879, "uuid": "43302222-d79d-40be-87f1-89a63a9f1388", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670077879, "uuid": "3138ea4e-0559-4ab0-a59b-d88769d882ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077879, "uuid": "bd854a1e-4176-494f-8c37-595a6bf3f6f3", "value": "SecuriteInfo.com.Troj.Krypt-TF.5433.14899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840a898e-72b4-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1670035515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035515, "uuid": "bbe57720-474d-4925-9944-222f58f84d7a", "comment": "Malware payload (RecordBreaker)", "value": "2a728aad63774f44138cde9309364816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035515, "uuid": "a62364ad-12fb-4fca-b29e-a36d904d8036", "comment": "Malware payload (RecordBreaker)", "value": "63bd78626bdc182ce8a281eb406bb08f5c3aed0ef766bb399e4e04c9fc3ebdac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035515, "uuid": "87c9c51e-a3c5-4e78-99b2-1eaa477d2535", "comment": "Malware payload (RecordBreaker)", "value": "b42cee63571416e135793c4e2f69530809cf8865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035515, "uuid": "809cf64a-5354-4e61-83fe-64f8dbf28154", "comment": "Malware payload (RecordBreaker)", "value": "1050bd4861d00fa15ea3e53e3baed6396ab52722e2beddc777e2f7a1b255a5157d0190f11e4a1fa755c675ceeae8bb02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035515, "uuid": "1cef7857-47ed-432b-b5fb-1bafcf82545b", "value": "T17F74C010F6A88B75C1C205FC882DFB989B2DA8325564C94F37643E6E6E332D196763C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035515, "uuid": "993b845c-6fdf-417e-bd32-ddc8b57f7ad0", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035515, "uuid": "918126b3-2271-42fe-b095-7c06e809a028", "value": "6144:QvaIlhLm8G9QcRNrhXldCgf53bV17JuRMjIjK:QSUhA9QirhXuqdwRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670035515, "uuid": "87a43b50-dfc5-43f5-afb9-05ee804d4d4f", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670035515, "uuid": "80cd57f8-3bf3-4e01-b6a5-eb283a115aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035515, "uuid": "dc08d0ba-6bb1-4819-a3a3-5bfb9240b298", "value": "2a728aad63774f44138cde9309364816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6413abc-72c3-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670042149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042149, "uuid": "e48236a2-8e4c-4928-884e-ee054f523a47", "comment": "Malware payload (Amadey)", "value": "37ffb217a687f1da23c7f33ce13b9acb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042149, "uuid": "a5a3bec9-1c93-4b4f-aa3c-19fb95a79627", "comment": "Malware payload (Amadey)", "value": "6415346285a0c9ac16f5e63960ad0679fd50a5ed61ac29b13227cb5a69878810", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042149, "uuid": "2d51a172-8639-46df-a9b3-19991a9d9a6d", "comment": "Malware payload (Amadey)", "value": "77814a268beda6a17ec639408e9e548c8094a229", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042149, "uuid": "035ef8d4-fd89-4a1f-bff7-2b589dfbcdff", "comment": "Malware payload (Amadey)", "value": "0d74ae66a515792a2f2099d58982afa85566908a14c3057c0f3174a7e999dfcb7817f88df3edd19d25e945cfa7a998b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042149, "uuid": "4ad1895f-b2b9-479a-8e58-93ec3700ad47", "value": "T12484CF01F5A0C436D15205FF8825DBA8EA2EA872F664D54F33646E6E5E332D097333DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042149, "uuid": "5cc32c0a-b2b2-4697-9f11-1d591133855a", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042149, "uuid": "b624df70-af1c-4903-93d1-8dc2c9e90fcf", "value": "6144:Vd3bKIK/L18SpgcRjbzpMrPkWiLpwEtPDIL/asXnVrJ4uR0p92j8:VJbKT/BpgIbzpCPkWiLpD7Ifv1RQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670042149, "uuid": "1c14569a-a859-4dc8-9f31-ab1f19b26ccf", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670042149, "uuid": "346cf59f-74c5-4595-9f40-99452bca9330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042149, "uuid": "eb046984-54e7-4580-8a18-ceda09241c65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f4c474-735e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108563, "uuid": "32de38d6-2a79-4bcf-925d-ba6463895376", "comment": "Malware payload", "value": "bd65afbdc58836bf4a21827b42ddfad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108563, "uuid": "06bef116-0137-437a-9035-ef1d265be6e3", "comment": "Malware payload", "value": "6415ed206a26c4e6788eb0e945073eb073a005defea0e1b08c1a206d8bd64ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108563, "uuid": "3e65d8de-2dba-4fab-8900-cb22ab3b99d5", "comment": "Malware payload", "value": "d3267af4cfb887f6896fbfe7b99a05542308e8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108563, "uuid": "721cbf5f-0841-4abb-a152-6a57416195b6", "comment": "Malware payload", "value": "dedaaf29ff961dfb4f1e98e7d327f70654a2296368fa103aedde7744127c623de1f6dc2dfe9a4b500d99e2d597ca2fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108563, "uuid": "1576165c-7eac-406d-addb-a36f5e46278c", "value": "T1997633063AC551F4C2B701300C818F9791E5E7AA1E350DBB3BEA749E87B31E6D617A4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108563, "uuid": "6d82145b-9e18-4d4c-aa97-fd9012236a74", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108563, "uuid": "d2c6bc95-812d-425f-8a25-2a7e94151bad", "value": "196608:91OScJmUdkdjI3TcvugJdsRhaTgwFSDy/ZcW+HqmgkgVH3xliR:3OJs4MU3wRJaDaTJFafHqBPx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108563, "uuid": "646ddf6b-7ce3-4f08-8d44-65875326f9a8", "value": 7586185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108563, "uuid": "505d9321-e818-407d-9b68-ab640c6c5029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108563, "uuid": "0f7be1a5-5671-417a-9107-d933b01045ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491e1835-7324-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670083520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083520, "uuid": "3f291e1d-f942-4a64-b465-dab1a6386f88", "comment": "Malware payload (Amadey)", "value": "f1c4a9f93c1b7795d6d30c1f9bf4d10a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083520, "uuid": "d8a8b579-ed22-43a2-9fa9-fdcde6a34fba", "comment": "Malware payload (Amadey)", "value": "644e89e25764a46b3743f05c76c812659a54155eeb03e088b703beb3e6c79d57", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083520, "uuid": "4ce384b7-13fd-4e99-a9f6-6a8868fb987c", "comment": "Malware payload (Amadey)", "value": "2e2bb0136da12dcef91906d55eab6278e551f9ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083520, "uuid": "e930d592-54f1-4ce8-956f-71074eaf4d47", "comment": "Malware payload (Amadey)", "value": "739913d5e82504df19b8fa30ab897d411e1c51bb9bcf027eb4a9a15fdc6dc956169db0345b6b3cebd3aa2985591e0378", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083520, "uuid": "c45b1bc7-b099-480b-b64a-9c9a9330b8cc", "value": "T1CE84E03076B0D875C54304F38566EBA09A7BBA315CA199CF37652EAE4E333D186623C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083520, "uuid": "215c1239-07a0-4b86-8dc6-6f0cd05dafad", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083520, "uuid": "85a9925e-205e-4f4c-8402-8677772a6f14", "value": "6144:JdJLnAXKaAa7/AE4OGRYsfQSl1SanMW2Rqn1dhY:Jd9nAXPAjROGRYjSLpMW33hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083520, "uuid": "b5079dcc-8b4c-4212-8292-8c8184a032c6", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083520, "uuid": "031ddd94-fed3-452b-8d80-6a502598b2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083520, "uuid": "be2a3357-d0e7-4c66-a6ea-b4668715cee8", "value": "f1c4a9f93c1b7795d6d30c1f9bf4d10a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc356ce3-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109053, "uuid": "c10ae8ec-7b0a-429c-a333-8234d224a35d", "comment": "Malware payload (Mirai)", "value": "2b3db0cfd2717d55b87e7096f57c554c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109053, "uuid": "abde5c95-6d87-49c2-b033-8cbb1c655d99", "comment": "Malware payload (Mirai)", "value": "647a0c8e24f951b6c2008a8eb73a06aa83000f296c59740d6600de0860856ac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109053, "uuid": "ea936b56-867a-440f-afea-451e82be3dd0", "comment": "Malware payload (Mirai)", "value": "bc05462acb99504356fe655799037f02a1273cc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109053, "uuid": "4645a9a1-9da1-4501-a527-f722646e558e", "comment": "Malware payload (Mirai)", "value": "d04a1890e1a92976f56298dc4ec9f6d24bbdc8618abedff1959274554bcaffe19dde03fb4adeca35b7e15eee64458215", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109053, "uuid": "ff068cca-bbb6-4c97-aa33-ae230602a775", "value": "T1CD436B25BD762D27C0E1A07911F74B11B9B947CE26A4C61E7DB20E8EFF146402A13EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109053, "uuid": "2388d432-49c8-4b12-9024-1daf1611b170", "value": "768:eQo04UgTZnyBTDnSKN7b7BWofO+TYiLwmJh+0V0U8Y1dC:eQb47TZnyBTDnSKzjImfjV041w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109053, "uuid": "c7f812f5-8a57-418f-a5c9-5c0c22b4cac0", "value": 59792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109053, "uuid": "15a9a7cf-c084-44f6-96ce-9fb3bba3b98b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109053, "uuid": "d38cd138-2af2-4693-b3c7-c176c89601b2", "value": "2b3db0cfd2717d55b87e7096f57c554c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d784bd-72cd-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670046361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046361, "uuid": "2255decb-bc6e-4d52-ae47-06790d545292", "comment": "Malware payload (GCleaner)", "value": "99dddeeef06350adfad38ccfaa64d85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046361, "uuid": "87c8347c-7f77-4f76-b60a-d8286ba21d05", "comment": "Malware payload (GCleaner)", "value": "64ac511e6e6821be951f5e78b5b432c91c6ee2ec6440449d2a48318e935f271d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046361, "uuid": "c683f203-3b77-4fba-90ab-67c79f82b624", "comment": "Malware payload (GCleaner)", "value": "d7d14a84353bb0105087ced39fff68bee8caf307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046361, "uuid": "ba2f124c-4638-4611-97ae-27bc281c85cb", "comment": "Malware payload (GCleaner)", "value": "76f73ec1c3dc7b1b5cbbd38e7807e7542e73fb6a9ea84243cb0be9c47dd372abbd6c9b347d34051c7642ab1109ff4cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046361, "uuid": "bb02a666-c7d1-409e-9f07-13cd07a11251", "value": "T13006333A71CF823DD722C77D8C16C9588D987CAB5C94B609353C979D3C3EBA1189862B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046361, "uuid": "f7279b81-6d3e-48a2-a408-a1044a7fea68", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046361, "uuid": "088beff0-2bb7-4ec5-8741-96054d90941e", "value": "98304:ET/hYRlJ8xFL5m+hiAMJymZnp2HP3EDTN4DJmzSREMXcyn:W5mwF/8Ab+sPE3NGRRdXcyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670046361, "uuid": "1c7305ae-8635-438a-8c2a-c5125f6103f1", "value": 3746961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670046361, "uuid": "b417b5b7-8d7d-42d9-9e43-f7521d4e3f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046361, "uuid": "96f032d0-bc34-4143-aca8-48ca5f26ef6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f4e209-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083221, "uuid": "ebf513de-4ad1-44be-a159-c05459715d5e", "comment": "Malware payload (Mirai)", "value": "9c0dfa17f791547d7893c66813cc0916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083221, "uuid": "c71d5e42-34a7-4586-b03c-214c4c8298e6", "comment": "Malware payload (Mirai)", "value": "65d0dfaad673ecc1b7b36413ac786f70a64ef7562d33b7b91c556c416d062a82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083221, "uuid": "6639da89-6d3b-48a4-bd43-58d08bf4fb95", "comment": "Malware payload (Mirai)", "value": "0d8e9c5ed956a40f7f035e0ff65c660abf47a382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083221, "uuid": "e96cf29b-d6c2-4174-a230-47da626083cd", "comment": "Malware payload (Mirai)", "value": "68b3eb7da185db5f3633fb4e5acac282b7ff30a0924d2f890e27d6b9bccb1213cf6bd74f15c24935e388efb22b0f14b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083221, "uuid": "1005cf76-0907-4182-a350-43f51d59af55", "value": "T184F2E171F9626170E2E05A74311D4E4636944CBC907FB811B0AA7A9CFD72E121A7EFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083221, "uuid": "d704ca97-5199-4d59-8d0c-850b675ff83c", "value": "768:6u9YDJSsqL8dTvlz+kZaJftXp/KJxrKu+lmLSZzV9q3UELC8:6u9CgsqL8dTlqk41tXp/K/5+sLqoLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083221, "uuid": "8422cac6-af8a-48e4-85ae-eedb36a512f6", "value": 34492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083221, "uuid": "aa6b1a0c-65ae-49c2-a290-43cd8e1a249c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083221, "uuid": "3733cb94-d5a4-46ae-b216-b20b723d37ca", "value": "9c0dfa17f791547d7893c66813cc0916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f3ea499-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670043963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043963, "uuid": "cfc5bd5a-d2ea-4a65-b17f-91ba5fe9f79d", "comment": "Malware payload", "value": "c9cbdf87cf400e9b9d0b020d71084b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043963, "uuid": "8ed0d839-2679-4b80-8659-5ea10a62eaea", "comment": "Malware payload", "value": "65dd91343bb818a51639380c3f66dfd72c4cb3308d17f6f08f6d7407db48c548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043963, "uuid": "1d47af39-1397-4d32-b141-c5c8d1f8ebde", "comment": "Malware payload", "value": "429af66b681bc72e6129c0f27f7d702d6114ba4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670043963, "uuid": "599cb2ef-5810-47d1-add3-7fbf9f1e5171", "comment": "Malware payload", "value": "5b7cc26f9bbeab0df1f1e0a06456f5e4e3b1657ce0dd724d2e0f1faf8ffae7b2e3c3b039c61b237a5f9ad7bfd99017c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043963, "uuid": "72119bd9-de6e-4ec2-9cf8-ab43ad96e3c0", "value": "T10A7633543EF84C30CAC9C571D9B45BF336A9CB691E7184372F68454A0BBE75B8237A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043963, "uuid": "04b0220b-47f5-43e0-a886-31a16a5c72c5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043963, "uuid": "dc4c626e-3390-4e89-8dee-d52d106d70be", "value": "196608:91OoGEq8vOhXGsZtbZQ5Hxmm0XZB8nNHUYz8q:3Oojvu2QZQUB8NHVQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670043963, "uuid": "e706c210-488f-4cf8-bb5e-8140d9749cb6", "value": 7584207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670043963, "uuid": "d22fa302-1279-410b-95fd-592258774810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670043963, "uuid": "0133ce5e-b925-4d10-a9e5-814ba60fdd1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c548b1e-733e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670094665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094665, "uuid": "9e271cf5-0031-430b-b94d-dd2f3cffeb0c", "comment": "Malware payload", "value": "f440f46301f3eceed4dcbe4c588e7ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094665, "uuid": "84afdd9f-8957-466c-81d4-61f8e4855bc2", "comment": "Malware payload", "value": "660098eb9a29dbb8cd281b609c5fc33fb02e57490e3ca322a0953f19559a4c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094665, "uuid": "8301d33d-1933-4259-b44c-3ad320433150", "comment": "Malware payload", "value": "99a4321574883ae3fe87b0988284c245a40c909b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094665, "uuid": "0d914e61-4ba6-45f9-868d-e7cb3dbc5057", "comment": "Malware payload", "value": "cc995b0f5b760ed3c81e8af5075bb97e7f9d83ecc53efd3689002b2c221fcfaff76170bf8e48fffdaa7a64681759df67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094665, "uuid": "f791206f-a417-430b-be58-1e4707324d6d", "value": "T1C384E0307570DDB2C5C3053555A2EBA2AA7FB8316D6399CB2369666E7E303C28732707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094665, "uuid": "a2a9fb45-e10c-4f79-acec-8b4eec164798", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094665, "uuid": "2f939b90-5a69-4569-9a46-04df7a02b6a6", "value": "3072:tSEzaMU+JuiaI5ABOUoq1AmZ++mLXORZcxVNdi9CdXp9jrD9ZGnWNTC6NRMHnlXj:aM4ia5gUoqumcpqoDj9cnMW2Rqn73Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670094665, "uuid": "bf4dbf3e-363b-4226-a283-cb2a9fb68614", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670094665, "uuid": "20630d54-f61c-4720-a0d1-6c3120fe9c04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094665, "uuid": "f8d0c820-864e-4918-9e84-3993e1af82c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7029586-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109044, "uuid": "893e149d-a1ff-4d13-8958-ad3554a1c6a0", "comment": "Malware payload (Mirai)", "value": "1bef306a1ff8145aa7cdee32afc6bae9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109044, "uuid": "c2c99c98-40a9-4daf-8d38-d0c609f4344a", "comment": "Malware payload (Mirai)", "value": "67ebb38ec9f4fb32dbd8a43d40c9375bbb9cc95aaa5fc907ffda20e77d903791", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109044, "uuid": "7ff54abf-4f3c-47f4-9b7b-30d658b4e4fa", "comment": "Malware payload (Mirai)", "value": "807d0bd9c22ba4661ef546ec8bc3517ca67489c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109044, "uuid": "42ec622f-c705-4573-8025-9b9c30850a7b", "comment": "Malware payload (Mirai)", "value": "3a5d5e9d8c6b6174982371f3fdb7ffdc21e05d81eeca822281576c556bc1e7ec6f446dbd3f03a830e68eb81a0a949fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109044, "uuid": "059fe02b-aa62-41b0-b00e-301070a24f04", "value": "T17F132A9AF8C28B2AC5D0127AF66FA95C3320A3E8C2CF7303DD605B51769741B1E67E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109044, "uuid": "f007a7f8-dc43-4bf5-a76a-21124247e99e", "value": "768:yOtFa24bBR99FJpPuTTDyQyCchpxgzXwzo5tH5dPQt5RpjDbTUfNmwbZ010U5gjl:yB2c3FJpPunchYzXwiH51Qt5R94Vb+1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109044, "uuid": "e7ff659c-c390-4e02-9196-42cd61bc1392", "value": 44552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109044, "uuid": "a114c67f-75ec-482a-b66d-422fefbb35b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109044, "uuid": "b3c60b96-647e-409d-9137-f94d207739fc", "value": "1bef306a1ff8145aa7cdee32afc6bae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cc6ab0-72be-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670039685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039685, "uuid": "4dae4624-3dc9-4b6a-9dcd-e5310ef120e5", "comment": "Malware payload", "value": "c5124caf4aea3a83b63a9108fe0dcef8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039685, "uuid": "2fe222bb-e410-4b8b-8fd1-4b1be4c20221", "comment": "Malware payload", "value": "6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039685, "uuid": "e35e77a7-11c4-4d87-9025-d2df97dc2a9a", "comment": "Malware payload", "value": "a43a5a59038fca5a63fa526277f241f855177ce6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039685, "uuid": "11bf299b-0f64-4094-8c27-d419569b48cc", "comment": "Malware payload", "value": "fb6fd677ff215f38098d150a86977662e34e99f9cc3c464ba7e2b7c117039154c26c4960d8c21bb546b8dde92c578eb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039685, "uuid": "80b48acb-ea21-4be8-ab74-2d000bd4ba3e", "value": "T1C2020CE3E3B959FBD738037D0987D929717C232147DB93143E58102A6F96E846863A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039685, "uuid": "5734892a-ccf0-4fc6-b9c6-e1a765f8e9ce", "value": "e82dd51b077167be63c004bed23d0c1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039685, "uuid": "8190f493-0fb6-4de4-9776-60cc6ba4fe7b", "value": "24:e1GSgMQIBU/Fxu4ZrzXW9UTdkgkhKh5aEH+/pIzqPnRuV4MPgic:SgMFYO4ZrzXEjgkhKh5a++XRuqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670039685, "uuid": "12c4e974-0963-4b2f-bfa0-69a921e53115", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670039685, "uuid": "7aea0d26-0e45-45db-b9bd-2c52e7529f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039685, "uuid": "aff72567-aff8-4c5f-87ad-a67b155837d2", "value": "6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dc78c7-7313-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670076505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076505, "uuid": "c2a7f9fc-5e90-4824-9071-ae8c59288769", "comment": "Malware payload", "value": "463a277326376c39d83f6dcc7ca87df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076505, "uuid": "1037f904-5a11-462d-bd6c-b016ceb70305", "comment": "Malware payload", "value": "69dcd8b3286d2afbd9020d491f1b6d334e22a38466dc8a20a86e60640b25a2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076505, "uuid": "3fd36b16-47da-4cb3-a15a-fe3541084c7d", "comment": "Malware payload", "value": "35009ca3b6560cca8363a5dbc946cf5569b8d43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076505, "uuid": "c0fd0150-6d5c-4d69-9fc7-2f46a4cba006", "comment": "Malware payload", "value": "72e032b93656feb8e366e0d5f20c9559c2f9c1a90f9b0ccde8f632b16d1a8b3a7c9c5b668227f83ca854e8019898e507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076505, "uuid": "0c559ebd-3f44-4df5-af85-9c231c373b7f", "value": "T1CD763362B9E28E78CAA1043398F43D57F732D264CE61893363DF014E0DA9664E397763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076505, "uuid": "29d06148-0c5a-4f29-a627-ddf4c5042b0b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076505, "uuid": "296f2964-4924-4b14-a768-f3eeb37e1044", "value": "196608:91OpFcSz+Qa2y/7qGVN6QDdSDsNBvVYg8:3Obz+j2y+qly2ZVYg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670076505, "uuid": "ffa1420f-5bdf-4207-95ba-8d5557d19dbd", "value": 7624442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670076505, "uuid": "5f93cef1-2491-42ce-b2a4-430c74f5961c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076505, "uuid": "4e359c8b-ce04-48f6-a808-3679c7917145", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b2b365-72e9-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670058148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058148, "uuid": "950f82b7-8e0c-4b1e-a536-371bfee1cba2", "comment": "Malware payload (GCleaner)", "value": "48c4cddbb86889e90ccbc8c0f4bdba2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058148, "uuid": "2c0cd5e7-f00c-4ac0-a8d0-9c8e7ac7f137", "comment": "Malware payload (GCleaner)", "value": "6c37f1b41a2920e8cabda76d99cbe9f95923b5e134022d2976e389b7bdb773d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058148, "uuid": "1421afee-8f89-4fbc-bfef-a20b8b0ceb77", "comment": "Malware payload (GCleaner)", "value": "faaf7f8c03a2935e5e6b93c3e66a493f12eeff97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058148, "uuid": "7398cfec-72ba-4d86-961d-41c60d1efaaa", "comment": "Malware payload (GCleaner)", "value": "b0f8522988934dc251ffbbecb77128785b989ecacc0265157b001a056af9bcd73c9c5caed9015aac770694ab1ce49166", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058148, "uuid": "ad8deaf8-f1c9-483f-9102-cc239799e91b", "value": "T16FF53352424E1D3DCE468FB11F9CC639816D39763DAA29037BDA094A5BE725EE80C33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058148, "uuid": "b6af4d3a-199d-4509-9dcd-2c081caa1df3", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058148, "uuid": "3d2e375b-7f05-4f35-a138-f76053b04067", "value": "98304:YOL20H4nMn5yDPAepYJsvSrlNeWmQCAQrMSvTXXcyR:7L2qWMn5mPAeugQCAQDrXXcyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670058148, "uuid": "0a91cf6f-185b-41c7-af56-32c205f4b00b", "value": 3613708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670058148, "uuid": "2d4bbacf-4a75-4aaa-9492-d68d8429257a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058148, "uuid": "05b82ba6-101c-491f-b863-cbce7218b256", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6274c434-7326-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1670084421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084421, "uuid": "c560c183-3ac1-476a-97ca-01ec757dd616", "comment": "Malware payload (njrat)", "value": "a1a64f8671681ba96b48cfd025a42449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084421, "uuid": "9971bd72-c44e-48a8-971f-418a534c3058", "comment": "Malware payload (njrat)", "value": "6e1ebf0254015cbfe98dc308aaa75dd346309633e179f812174e564fb4b648ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084421, "uuid": "f15eaf55-2b99-407a-aa18-feb3edfd7aa5", "comment": "Malware payload (njrat)", "value": "13369f1d952151f24a50ab3506ad1541677f46e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084421, "uuid": "3324e398-9177-45bd-a47b-c555b2821e0b", "comment": "Malware payload (njrat)", "value": "d0aba9f911bede0e427ef3f10db46bec0f03afcefaa5f5871ade3a5ccfb3a96cbae37f49b5f42c2897ebed3ce86c9520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084421, "uuid": "07517b0b-f32a-4d26-a603-cec98f516229", "value": "T133C2E92D37B58232D2EE067E4562EA5043F5D04BF227FB0E4CD958E94B5B3C60A41EE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084421, "uuid": "ab973338-211e-44d7-b078-46180317f49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084421, "uuid": "774a6348-7fb5-411f-8655-d9b8732e4fe6", "value": "384:EL0M2XwBNOaLNOFs/Av2yeCP1BBvMl7AQk93vmhm7UMKmIEecKdbXTzm9bVhcaSy:St220U0Wl7A/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084421, "uuid": "ed177bfe-de78-4092-bf0b-f5b92d825ee5", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084421, "uuid": "227c7b12-e30d-4991-a027-1c7a0768be2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084421, "uuid": "e086292e-5fab-43b6-b511-733224746831", "value": "a1a64f8671681ba96b48cfd025a42449.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb67ac4-72f1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670061512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061512, "uuid": "b572b6a9-9460-4ee3-8e56-1dd3f830947c", "comment": "Malware payload (Smoke Loader)", "value": "95db850b5834cd30c54e0d9f7e0d8747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061512, "uuid": "569aa8ca-3e3f-454d-a3d3-851942759cce", "comment": "Malware payload (Smoke Loader)", "value": "6e2363503ae8b4dde5be25a116a0a0a434c2a2a223819d37fa81a702e57e4f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061512, "uuid": "d3620178-a07f-47b2-a3f5-b68adc84b578", "comment": "Malware payload (Smoke Loader)", "value": "48ca16b578849b106c78967b65749bffcba1c15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061512, "uuid": "d86721b2-86a3-4edf-9dc2-67b62e34dbe8", "comment": "Malware payload (Smoke Loader)", "value": "b6e25ba7ac855b57112a54cc5104b76071c505e5d2d24aa07e030e818a2a0f2c3e0415ef9a333c8f6f203b9eb2a7a21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061512, "uuid": "a45f4252-96a3-4be7-a255-6f93199cd834", "value": "T19F74DF317AB0DC32C29B05714456EBA1AE7FB8325D6099C73365676E9F303D286E7306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061512, "uuid": "190f7285-8e93-4d67-9272-230a4d81fd43", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061512, "uuid": "26816e75-e29f-4214-920a-8cde68cbc479", "value": "6144:o5EA/GqfoA5EDwhhai/vWJDB9lkwHnMW2RqnDyyzGY:oqApoA5ZhhT+JLHMW3eyCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670061512, "uuid": "64d9a888-4110-4bce-a819-8adf735234bf", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670061512, "uuid": "63a03ff1-103e-49b1-b693-5111db52e85f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061512, "uuid": "245948eb-b09d-4626-b500-0612680422ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf53c43-7364-11ed-9db1-42010a9c0080", "comment": "Malware payload", "timestamp": 1670111255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111255, "uuid": "5391b087-95a2-458b-bf9f-9f91213dcad1", "comment": "Malware payload", "value": "83bd1c2c44e5c9fb9442da421d8348f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111255, "uuid": "eefd80b2-50b5-4d2e-91cf-3ee7b02fd7d6", "comment": "Malware payload", "value": "6e34b694794629a40678792313325ff9d8f4d3d53eba2633015293dc29ab7205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111255, "uuid": "48044874-8e15-4210-aae4-8748f4123e12", "comment": "Malware payload", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111255, "uuid": "d7b51807-cd38-40ba-b06e-2d73650f3c08", "comment": "Malware payload", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670111255, "uuid": "02842d87-e0fe-40e4-bc31-46b3f68bb88a", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670111255, "uuid": "b5fd219f-915c-4ca1-add7-4705cc70fb91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670111255, "uuid": "193fd4ce-362d-40c6-9eb9-e883d1a739c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a450da3e-72f8-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1670064775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064775, "uuid": "aed2a6b3-de2d-477f-a177-a118bbca0949", "comment": "Malware payload (AgentTesla)", "value": "c602a8c1d11236ae15cef6d0506019e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064775, "uuid": "80c8c10f-ab54-416b-8c2c-af32eda59d0c", "comment": "Malware payload (AgentTesla)", "value": "6e9e7f85765b936dbee0d489d4b30048881a558489c4c8691187a781117c9b9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064775, "uuid": "357fbf95-78d8-4a26-8f2d-349aa568a5e0", "comment": "Malware payload (AgentTesla)", "value": "7de05fd3a996f5d804c25e8ce9f9721c56c86b48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064775, "uuid": "5624533d-1b49-41df-b7e7-58915ec5d1a6", "comment": "Malware payload (AgentTesla)", "value": "f6d7932e3bf1a5958b1910e13e6add42ef30f19fdf7b004b7f12b114499eb7d85a1a910923bd25d31adfea1a30de1784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064775, "uuid": "db804007-8001-4f93-9838-f1a1485585d3", "value": "T19025DF8077A6AF71F52967F33512814827B23C6EA5B1D2286DDDF0DE2671B404AF0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064775, "uuid": "5c257d19-4b89-4ba1-bc48-bceab513947d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064775, "uuid": "3919247d-817c-4b8d-931d-5099c825c462", "value": "12288:2VvgqU+D7Zy1Z/e1jjHUQ2F6GDlFlfs6G8gieBU3nk+uOsZ72at15zCDdzoa1cfN:+vz7c1Z/eFHHmfvRkokHZF5zCDdEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064775, "uuid": "f3ff6feb-28bf-48dd-ac5f-9fb9e4d902e8", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064775, "uuid": "d62bc567-0d2a-4b74-924e-5c3afd219f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064775, "uuid": "953785b6-c966-4bc8-bf28-3878e3af4927", "value": "Atlas Price Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f3363e-72f8-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670064824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064824, "uuid": "ac8d2efb-8a14-4809-8800-26ef74868198", "comment": "Malware payload (CoinMiner)", "value": "1aad530cf007fa3cf66491df74ed18c5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064824, "uuid": "9f2dd07e-144d-44f2-832b-cb8ae83ecf1f", "comment": "Malware payload (CoinMiner)", "value": "6fa9af2985ae51764b5821c16287abcb1e02f8e184d50383f5615c687cb00d22", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064824, "uuid": "fe04b815-3024-42a0-935c-7f74b34853d5", "comment": "Malware payload (CoinMiner)", "value": "a81c35121b5e5de58fd7a76dfdc89b8530f8f718", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064824, "uuid": "c3fae1a5-837d-483d-81f6-57b3d48c14ed", "comment": "Malware payload (CoinMiner)", "value": "13e8e46598da8b707118d037ee1e6150e25e7c9aad3a08eacd82f876acdb55c099d4c3b2f2168ee4e657e17c5343ec7c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064824, "uuid": "f11ae415-61d4-46f9-8ba6-c035c2510881", "value": "T14565D082F7C4DD25C0F602319AA64965EB35F75762220B4A738DF32B6FB2B809943747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064824, "uuid": "cf3f3627-7e9a-4979-8de5-08d6d304277c", "value": "2d0a541ce09cb8bc4438fec3909adc1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064824, "uuid": "58022082-3179-4d5e-9909-9113bfa71421", "value": "24576:oS9mE7v7zmwbY2QkHqai6GuJFESjBnyZ46eCTOsuzh4IxAtRiGK8uA:oS9mE7vvmYY29qT6GuJFEMLQOsshPM/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064824, "uuid": "781e3e49-980d-46a7-aabb-45444451a626", "value": 1510064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064824, "uuid": "6a5f9e43-96bb-4852-8ec8-22c2514b19ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064824, "uuid": "33499485-5442-4239-9a61-3c4bc4075496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a8f175-72b8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670037130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037130, "uuid": "4563b864-428a-4ad4-9647-f796ed62a5df", "comment": "Malware payload (Smoke Loader)", "value": "f95421e5541f1fec8f2b754d203f76e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037130, "uuid": "2499f583-7068-498d-b293-77c5390a8f36", "comment": "Malware payload (Smoke Loader)", "value": "6fb31cf347d33edf839bbbe40d74977b0e91ee7d08ed0feceb1cf46c518016d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037130, "uuid": "d7346b7b-dbfe-4388-9fbc-ac0a3d0f75df", "comment": "Malware payload (Smoke Loader)", "value": "4a3d0c19067f521717f4c3aef66fcefad84a86d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037130, "uuid": "cc67f536-b2ec-4b9f-af60-4c3cc6d1cc70", "comment": "Malware payload (Smoke Loader)", "value": "f940b01c7f4ae580438c16e10c5c8745f245828300f4bac297fbcb169aaaeaf442113454a63037eeafd21bf123089640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037130, "uuid": "0b88bb1b-427f-42a3-93d5-67df1791fc40", "value": "T11F74D001F690D876C19205FC8925DBE8AA7EA8315524C90F37A92E6E7F333D196763C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037130, "uuid": "ca040be0-f314-4114-944e-dd2f381a05fc", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037130, "uuid": "ff1534d9-f0dc-47a4-b8c9-49395c91c908", "value": "6144:tVeIOXLx8CZAcRqEW/DxCvXw0DFk6IuRcj5j8:tU3X9ZA9xCvw0JRct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670037130, "uuid": "061eb5f5-51a7-4c11-a93a-752795ec95f4", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670037130, "uuid": "6688dc3f-a1d2-46ff-b80d-a06c0d62302b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037130, "uuid": "5e754edc-6317-41e9-9173-7ded5a12468a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff7c2f2-734e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670101865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101865, "uuid": "a3209980-ccd1-4a30-a6b3-098303423512", "comment": "Malware payload", "value": "7cc27bc546e9b50a54fd57bb081a5f82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101865, "uuid": "0cdc54a8-d491-4f8d-b24f-5613a7f7e031", "comment": "Malware payload", "value": "703928f08a9c8d1dff99f444075d93008bfc8b1516f2771f6150983cab65549c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101865, "uuid": "fbc34ae1-9644-4067-a59a-6690cae1060e", "comment": "Malware payload", "value": "0f4ecc7382bfacbcdba005c37efcc207823b1fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101865, "uuid": "f4d93830-b8d9-4057-9648-154f810ff4e0", "comment": "Malware payload", "value": "9287e4e4b7ffc0bfc7e77bd0d913bbff27e5aab8d6cb91ef517699fa3e6bd79b9bb95469ccc4f615a300558e6390fc69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101865, "uuid": "b43e0887-ad6e-4d23-850a-1f9b06b7e8eb", "value": "T1D2763393B8E389BDD26352714DB43EF988E8F5AD1B224C2707521E3D9D3C14D40BA9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101865, "uuid": "54953d7c-ae09-46ab-8a98-6cf38b5f7556", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101865, "uuid": "06201677-198a-4977-8e64-c672877a9999", "value": "196608:91OL9YANvVSXVkcAZzsGAkKXJxsshFkles9+LYEV:3OLnVSXVzAZvKXbsM+es9+LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670101865, "uuid": "1a84ef3c-b577-46e3-99d4-52dca48acfc3", "value": 7597366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670101865, "uuid": "eb2beb71-8bf4-49bf-a3b0-ce833fd69891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101865, "uuid": "0eb2d131-4b1f-4fc5-b4e7-de8eb70c6bdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacbb25f-7354-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670104326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104326, "uuid": "0ae5a40a-bd5d-4422-b12a-a5dc6780c618", "comment": "Malware payload", "value": "486b86a887b58e78bd56852837e7c6f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104326, "uuid": "1f857837-7ad8-4cd5-bf73-daba233998e0", "comment": "Malware payload", "value": "70eb8a8c714c6561019571cd6e6855482b3a5cdeded1ed2d4e1d933367e201b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104326, "uuid": "64efe943-bd6e-4082-9788-aad01784ff26", "comment": "Malware payload", "value": "a5301bd2be1baead3eb41f6d00d968060a827b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104326, "uuid": "38befd82-8d19-4daf-8aa7-07204a3dcb32", "comment": "Malware payload", "value": "841d1e289500d86c1745ed42c804b3ac8af2e43298ccb4a1c3849dbbfcd64321c073e60371ac868df3b335175c695193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104326, "uuid": "8fee44a4-799a-4a4a-8845-2d17925261c8", "value": "T1C084E13136B0D473D9630531956AEAECBA3FB83159A188C727692B2D5F303D1967B30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104326, "uuid": "85164329-55a1-4f31-892e-2ab548721a95", "value": "c13a4ce7a96b7de18434d9eecd3ddb46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104326, "uuid": "994cd77a-1e57-4ba3-af46-522cce2144a3", "value": "6144:q6nyGZB/b8tJTsHzH+z1FZyWBp0NnMW2RqnF4PaY:q6n1jQJAHzH+UWBp8MW3GPaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670104326, "uuid": "41cb4d78-15bb-49aa-9c64-25b904a4b064", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670104326, "uuid": "9d85e8f8-a7d4-400f-9a9b-b504646184a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104326, "uuid": "d5467dec-cb3d-4ec1-89fa-664cb5d99d89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb3a1b7-7335-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670091020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091020, "uuid": "110d02e9-9183-4361-9f60-dd8594aa3cd0", "comment": "Malware payload (Amadey)", "value": "72bab2f5022e2a693bacd6e525f692b4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091020, "uuid": "df67b6c5-ae33-4381-a5ff-0e450512cfbb", "comment": "Malware payload (Amadey)", "value": "72a5dbc36f17ce80ba47ccdba7af4be5ed7952c05e508a0141f69ba50e314ea3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091020, "uuid": "fa7a79b4-7e4a-4e9f-8afe-729eb78687e0", "comment": "Malware payload (Amadey)", "value": "f4a05cde09c69f18a11ea2b7f83a4462d0ae5908", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091020, "uuid": "c920631b-8332-45c9-b5e6-fbfb685e0593", "comment": "Malware payload (Amadey)", "value": "4a8c195c0da25992252e8552abb597de4fb5add716b40537047d6e82acb21099ce97d1c7dab578cc3c61b59550bfd41c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091020, "uuid": "5ee5c816-e618-4ee5-80a2-bb0adb77773b", "value": "T13D84E030F6B0D872C562053D4826DBA09B7FF9326A60C9C72729176F9EF03D19A76346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091020, "uuid": "28282eaf-44c0-4c9a-960d-f35ad43832d8", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091020, "uuid": "b2a8ebe1-762b-41bf-aafb-e12d31eb11b6", "value": "6144:8GHAM5cilZ7Yk8bE6Ww8E+4vZf8Ox3LVw5nMW2RqnrffBY:8YbDpx8bE/MZ8Ox3xwdMW3rffBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091020, "uuid": "4b00b624-5f62-4674-9e4a-d5d2f29c2994", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091020, "uuid": "50a55c68-17f1-459b-adea-0a0b4213487b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091020, "uuid": "0754876c-d4cc-4e61-94dc-b40ba3d85621", "value": "72bab2f5022e2a693bacd6e525f692b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea87688-735d-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670108144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108144, "uuid": "f277cce0-3b58-4dac-be15-41e31891253b", "comment": "Malware payload (Mirai)", "value": "a829e635126f478e4052ac1b1b14da8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108144, "uuid": "46cdea87-b950-47de-8776-2bfc6eb68ee0", "comment": "Malware payload (Mirai)", "value": "737c8e1d4bf6829e04dde1710dded88e1baee38bbed69a217cf9c9a59f73394f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108144, "uuid": "96dd9c4a-f44c-4d43-9b73-7356c25498e0", "comment": "Malware payload (Mirai)", "value": "4a75cd72859d5130883ce16dada594c916ba62e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108144, "uuid": "fb3369fe-981a-4a2b-b2a1-a8e49c5f6e61", "comment": "Malware payload (Mirai)", "value": "47d65a131e573efa94071bce14917f1ca66146c43a6ad4718373d693e2dc8311880a353f310190e8480e26b4d76e302d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108144, "uuid": "8cd86082-cdb3-433e-a006-1069ce475650", "value": "T1E4437C42B21C0A07E0631EB0343F5FD08BBEEED122E4F285699F9BA68535E731545E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108144, "uuid": "52ea2bd5-dbf5-4bd8-a21c-e74c9a6eef09", "value": "1536:8oHk68IU1VlUrzBmyBtf2s7PIIhb+10mD+:rX8I6HU3h32yPIIeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108144, "uuid": "975f5fe5-0b05-42a5-853d-47119bb1320e", "value": 55784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108144, "uuid": "5925bfe5-d973-499e-b217-32728b02d11a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108144, "uuid": "b19eed19-0ddb-4400-9d5c-a450909a6810", "value": "a829e635126f478e4052ac1b1b14da8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd4622b-7321-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670082346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082346, "uuid": "3162ea74-a4bd-4cdb-9b37-746abd03684a", "comment": "Malware payload", "value": "f1d6603648716040c99f41f85de0465e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082346, "uuid": "11ee615f-da48-438a-8e5e-5f2c4f7f8e96", "comment": "Malware payload", "value": "73aaec53b725237311cd441c1bbaa3ddb855641f04da56578006f26d0c7a7e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082346, "uuid": "1db9b364-ae3d-415a-ba23-375205b8806b", "comment": "Malware payload", "value": "279a0c2af4c081074c03e32e6e21e7cf4573e113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082346, "uuid": "c90df5df-48a1-40a0-bd51-9c6506434b17", "comment": "Malware payload", "value": "3c540b0a09ac3bfd13d8a463cf115ff27a534441d890e0be876e1bc0ce0f92cf300b3b461bc3574dbfcd8d7e459a9040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082346, "uuid": "ec07be65-3157-43bd-8661-e3a327049ddb", "value": "T18076330177FACEBBD30255791C6467BAE379C47156F900FB7316089CF63A2A0901BA9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082346, "uuid": "d2cef54d-bd69-496a-bdf4-cb6e573071af", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082346, "uuid": "28eccc27-28d3-4411-b97d-120433cc0b8b", "value": "196608:91OFTdgjumO5VDHhW7Wzdeml5MGHE+0f33K1X1rc:3OXEumO5VM7IIuMKf0fyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082346, "uuid": "736aa35d-8062-48e6-a9b6-749f36632583", "value": 7607827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082346, "uuid": "79d7a167-c2f8-4d07-81b7-e57ce87aaf16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082346, "uuid": "eb76f83a-03e7-4ead-8324-1f752d4627f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3413a60f-72e7-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670057285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057285, "uuid": "8f0f6255-5b0d-4a42-ba34-2eec412fd58b", "comment": "Malware payload", "value": "a570818a02ec06912769f9e59d02c5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057285, "uuid": "3f7bc23e-e7b1-4ce7-a80b-470effa75be1", "comment": "Malware payload", "value": "73f655fb9eb087c5e3a8753f9222b7c6ddad1c6b1a081a7f2522319e305e303c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057285, "uuid": "a9bcab57-6389-4008-9aae-aeb608bc66c2", "comment": "Malware payload", "value": "8e0263dfe3f84758f4106fa53ef3681e6611a02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670057285, "uuid": "8b6f054a-3b07-4684-a2be-3e6aa06b0b2a", "comment": "Malware payload", "value": "d1de90fe7b84f5bc9ffba230f9a2c5fd9e1191b313a61aac673966864bd437e7225adb68c32c2f5c896ac38c99d4afd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057285, "uuid": "21716929-c2dd-4788-947c-db26f3caa4c3", "value": "T11CB39E213990C032C49724714464CAA1FF7AB53256B99D8777A817BE9F303E2A7B734E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057285, "uuid": "9546198b-b04d-4654-8ad1-2e26a05c5a8f", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057285, "uuid": "ac431d32-87e8-48c9-ae4c-6e6a098b3213", "value": "1536:mzvlot7Longl4hetYlcrpz3dLvcbuOVxcmR5Qh:mzv87Lcqc2N0PV5Qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670057285, "uuid": "9b979a28-43c9-4495-a69e-e67e902813af", "value": 115970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670057285, "uuid": "5b458a15-77ff-46b6-b103-4c88bc58756f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670057285, "uuid": "85f13e16-56f8-447d-9abd-898c60e054e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7704328-72ab-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670031709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031709, "uuid": "e3eb13fb-8620-43d8-9dda-6f92eef7c2e4", "comment": "Malware payload (Amadey)", "value": "8f323cceaed013f05967ceaaeaec0489", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031709, "uuid": "3f76975c-b8bb-4689-9887-75d879be74ee", "comment": "Malware payload (Amadey)", "value": "74a3cccadd08d560b7f35841db57d00a464f381cd8173a75d729e3bf93e1814b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031709, "uuid": "61f62ca1-f033-46e2-b659-cdfccbe8d36f", "comment": "Malware payload (Amadey)", "value": "bc2c050a13da2cabd8416c9d7d4b33117146fa7c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670031709, "uuid": "dfa4a85f-7163-4844-8259-800cb904aef7", "comment": "Malware payload (Amadey)", "value": "aa9d8eff0ff63235554ce457c45d37ee0d5b567cb40e114084bd25653c6d250f06cf94b16bc7da3562d211c5e9e07cd5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031709, "uuid": "1af99dc9-0634-447c-8960-55107062a59d", "value": "T1AA84E114F5A0D876F15201FC8825D7A9AB3D68315A35D90F33A46F2E5E332D1A2723F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031709, "uuid": "e6709821-9675-47f8-82b9-d41756fedc68", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031709, "uuid": "1df6213c-f01b-4b1e-8dec-a0c6e631c965", "value": "6144:MPniIxJLi8eVIcR5P/lfN38IU+P8uRzSHoVjK:IiQJMVIQfN315RzqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670031709, "uuid": "8db34042-1e18-4457-adcf-cbe8ecf10e22", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670031709, "uuid": "28da4188-8a07-4fbd-99f4-e6ee8aac6ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670031709, "uuid": "d4517c2a-f72e-48ac-a15e-499d1edea475", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8756a109-72e0-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1670054418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054418, "uuid": "2e5faa69-3dc9-414a-9bc2-94be791e90cf", "comment": "Malware payload (njrat)", "value": "67da6f5ed1373b2d46cfd8f1e9201970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054418, "uuid": "89e39973-6bb5-48a6-95dd-22ac6d600192", "comment": "Malware payload (njrat)", "value": "74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054418, "uuid": "4a7e86ef-d298-45d8-b61b-5e5315d46359", "comment": "Malware payload (njrat)", "value": "1820da1f12be9f23a4de58bfb8d3bffc792b9754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054418, "uuid": "b1420e78-612f-4cd9-9f7f-d5be9f14243c", "comment": "Malware payload (njrat)", "value": "bd6e14f20ecb1716900f3805cdddb4667a9afce0bcb56baa4817d6433470ee0bab6ddc81f93f65c42ee9fca6cd9fd58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054418, "uuid": "ba78cc70-da94-4eac-8cd2-e4a4ea03b578", "value": "T16F74F11396D0907AE0F523B099FB19A307BDBCA46E74A3AF820568D55C357D079B832F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054418, "uuid": "7c76baec-42dd-459a-a533-d3de5b32fcb7", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054418, "uuid": "68ef5f77-19a0-42bd-a8cd-3c1c17223548", "value": "6144:3jbeip2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltLKUPBXdRRLD1H5KPB:3uKAsEVC6qEJO/PdBQKGtpD1Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670054418, "uuid": "226a19c3-616f-4681-ab56-ff5c27074378", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670054418, "uuid": "5394b54e-cd13-445f-bf07-57999fe1a869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054418, "uuid": "30dd37bd-92eb-47ba-bab4-fdc23416b55b", "value": "67da6f5ed1373b2d46cfd8f1e9201970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d8e257-7322-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670082920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082920, "uuid": "889995a4-6b60-424c-b94c-b9f13b6e51b9", "comment": "Malware payload (RedLineStealer)", "value": "9659be137114d42695d75b312269f494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082920, "uuid": "c10821f7-2497-432a-ae91-5988b507d6db", "comment": "Malware payload (RedLineStealer)", "value": "75d21bab38dc50854b1c54991092b47c92784b9b98f5293faa93ddaa2ee6322b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082920, "uuid": "764ed8c6-930e-4ba5-b0ef-aadcabf2fbf1", "comment": "Malware payload (RedLineStealer)", "value": "52fede52b6c2438e1f12937431b395faec152abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082920, "uuid": "dd3d54c4-97d5-4050-948e-a0b0c29ced84", "comment": "Malware payload (RedLineStealer)", "value": "f4e847b1dce088c864b607ea34b48eec90119dcaa6b581b96365dadaada49069e9125e1223a1ad006805a1df2bce5992", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082920, "uuid": "93042192-bf86-4aad-b162-9d6cade5409a", "value": "T15584AE140BCD9E07C27B4B7950F1F370C7F883D2B953D75A89A658DA3E25F84EA00AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082920, "uuid": "225f952b-70db-4774-add0-b24a0b9c8741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082920, "uuid": "de6d7d34-e24f-46a0-b007-e2f3e8b4bbf3", "value": "6144:aYMZMBKxFIS8vsIthMacxero0WWCDsDtwwGK6NsFhMgZK386f:aYGMoIt+arIWCDsDTGKzY38Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082920, "uuid": "3641604c-bb6b-4211-9798-af0f254d88ed", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082920, "uuid": "07a15350-e6d5-4b6e-922d-6da1555dec46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082920, "uuid": "06181acf-e667-4409-8cb9-7035b48ef9dc", "value": "9659be137114d42695d75b312269f494.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f841b93-72dd-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1670052982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052982, "uuid": "cbbf32e3-5064-4a23-b209-a021426c2ae7", "comment": "Malware payload (AgentTesla)", "value": "1ab66537aa5e76127a5ca907ae814fe0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052982, "uuid": "7849a45e-5cc3-4b79-9713-7ae80d08b708", "comment": "Malware payload (AgentTesla)", "value": "7604e738af25d6555758575a5a98af1e57e85ed5571dc2d2588b58c50f0864db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052982, "uuid": "c4673aab-2ced-40cf-a55e-df1e03e2291d", "comment": "Malware payload (AgentTesla)", "value": "97bb5b41ef20cd53520e87a92bb75f93cea49a06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052982, "uuid": "90804cb6-e214-4456-9e7a-4c3cc84ffaa2", "comment": "Malware payload (AgentTesla)", "value": "5e1c9aae133b2f5a7602b83fa2031dbebbbe538fb0cbff0d804c852a373168f07272882b18e192875521d1ea98f2fe56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052982, "uuid": "b1a045bc-7de2-45bb-9460-ff5af27afac4", "value": "T157F42860B1588916EF79D7FC36C5154A311A1DF1A8BA6CE84C8674C20E381C4EFF99EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052982, "uuid": "ebbb2d84-d408-4bab-9042-3ed5c17ce6dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052982, "uuid": "633a4106-6265-4c58-b4b8-661002f06912", "value": "12288:kLcuCqwqX4/wGvAgZNzg8PpvkruVhoXkg586aWHff:7uCqVXTGvAgHsAaruVIB5O8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052982, "uuid": "918bc57c-7e50-4095-8740-1484c36fed0d", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052982, "uuid": "91ba6ff4-c73d-48c5-81ba-191d04a7d53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052982, "uuid": "b2ba2ae7-bccd-46d7-ab9d-c18a56a8bdaa", "value": "SecuriteInfo.com.Trojan.MSIL.FormBook.AGCG.MTB.18730.19437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aab3b7c-72fc-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670066235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066235, "uuid": "4f3eda69-f4cf-4928-be42-fca4fabea135", "comment": "Malware payload", "value": "d7d3b3086012dffcae409a1724c65be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066235, "uuid": "2a002785-b9c8-4383-955e-2eabb5e1f6eb", "comment": "Malware payload", "value": "768fb46335f40f77f4e537dfacdd12beabe553de01f611f33d7048a3e1204189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066235, "uuid": "700c4691-1ebf-4915-b429-342ac5b167da", "comment": "Malware payload", "value": "d0bf289ffce50c2225eeebf52cb7ef2aef8ca211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066235, "uuid": "e7d82ceb-fc97-4d85-ab35-0a4443fd5fba", "comment": "Malware payload", "value": "19666c8ee4dd451eb471c87efed509a3874864ac2b01f5ff686983da9aba79835865a642e463f49052da8ce7bfd64bb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066235, "uuid": "e7075f07-c081-491a-ae02-2999f97bd110", "value": "T155763332F9C0047DCA9467BAD9182B3751E3E8251A318F379BD4686C3E38948E93D57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066235, "uuid": "279ce024-8cf8-44f1-b557-39003d215149", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066235, "uuid": "611ee8c3-6d05-4471-ad08-bce5f165d10d", "value": "196608:91OgChqsYavMjT9jIytIr8wRzIEOmOm+CzB69kkIEU:3OgQvS91tMOmH+ecVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670066235, "uuid": "1de961a3-d10e-47aa-958c-db4d29498e89", "value": 7583152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670066235, "uuid": "7bb32ef4-476a-4867-a035-4b8ab786c1f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066235, "uuid": "edb3355e-e341-4b53-a015-a350dbc48c2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83713113-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083188, "uuid": "ad483b28-77b7-4372-8a4a-a8864f8054ed", "comment": "Malware payload (Mirai)", "value": "cf78785c33977b2ad3fa28e7f20b0eff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083188, "uuid": "dc671823-1768-442d-a3cf-6cccc1ef5889", "comment": "Malware payload (Mirai)", "value": "76c45499b3b0d4a4806b29041727d2e04a02a0c3011fcd3d042ac58c822242fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083188, "uuid": "1f06cdbd-9e0e-456d-9d83-20132de1cb3f", "comment": "Malware payload (Mirai)", "value": "bbe41983a7a9afa78f1efa80ba50d7955cc2333f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083188, "uuid": "abba1cb9-933f-4004-b4dd-01ad6c2f0f18", "comment": "Malware payload (Mirai)", "value": "218771d1bbb8ab1c29f6b237a3fe1bb2465e9ed765836efdb949bc37af95404da632cabde4f0eeb58d7c3c0d1306470b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083188, "uuid": "e0dcc81d-4fa8-48fe-8d51-c37c40f632df", "value": "T143334BCA66022E2DD5D65CFD80734F0ADD552211A4A3172BB3ABFEC339332A4FE45949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083188, "uuid": "ef398812-6842-40e6-91b8-fb7828266068", "value": "1536:78+/b91trZyUr99C7ZQ2Fv7cuMKg1pzADn+:7599Kn6uMTpED+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083188, "uuid": "df5faa3e-dfd1-4cca-9e35-57e774f83980", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083188, "uuid": "92544d6a-bb07-4817-922f-d71332ce7dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083188, "uuid": "183e9022-57f6-4906-8872-37489f4485e0", "value": "cf78785c33977b2ad3fa28e7f20b0eff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b9cbf8-7327-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670084836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084836, "uuid": "48ea78f1-4bee-49f6-8b5c-350c32de7187", "comment": "Malware payload", "value": "210c2803c4387322927631ec399e14ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084836, "uuid": "50203bcf-0e11-4934-9331-12c832248393", "comment": "Malware payload", "value": "77bf59a5c64f5983800939c4babb6d9d4e9ce722afa40dddc107b00ad57b628e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084836, "uuid": "401b191e-1011-46bc-bfb6-3e0a8f529bba", "comment": "Malware payload", "value": "79f767e4bae27a790b92f6f87b7e11febc0fc0ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084836, "uuid": "19ebcd9a-4d47-4cc3-8456-10e8699a2b76", "comment": "Malware payload", "value": "24b136883f9b4e0fa25f17926a998dabc8c6c05c3b8c3f551e0bc93d54b5433ab6b6a3c998e647a4f13bec222ad871aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084836, "uuid": "a0ba221b-5473-4886-a20f-d8f19f79f255", "value": "T1DA76333076EA84FACBD04235D96C5FD197DAC370099B68876BED896FAA7C585C037038", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084836, "uuid": "71826869-5e62-4c5b-bb57-cd6170e9f0f2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084836, "uuid": "b22aafc7-450a-42b1-8b53-1c4410e9b227", "value": "196608:91OFpwuuutkjYNPwBxKJrGwJGJhAeBbMcYx5gej+Bg4:3O8uBNSMr9JGJTYx5z+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084836, "uuid": "2f9e10a8-bf26-4989-8d00-e72df8f87bb3", "value": 7596926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084836, "uuid": "6558f0f5-9098-493b-901b-e039ee635bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084836, "uuid": "fb8d401e-1bad-46b1-932d-8fa176c90d2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fa1edd-72a5-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1670029217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029217, "uuid": "2ac12033-d8c6-45ef-b152-93a7f9bef9a0", "comment": "Malware payload (njrat)", "value": "539a1c84e8f25f54c520bbf48b4aab6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029217, "uuid": "39cc9f94-af2e-4ab5-8087-f370f17cb17e", "comment": "Malware payload (njrat)", "value": "79c358be65277404a46eab5f2eaa0d2938a70ba55a2396c4957bddf7699b441f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029217, "uuid": "fab4e7fe-828d-4843-9b87-3df436a49f3d", "comment": "Malware payload (njrat)", "value": "45872ded1cda755c5221958332e9863680b992e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029217, "uuid": "ef8b259c-3a6b-4ab6-9b78-55706f249ca7", "comment": "Malware payload (njrat)", "value": "bbe84a65b49325038bfd56eeda553e2992909f2c906a796eedd41e76aaedbba5157f560977e5bc08f9192977f4746c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029217, "uuid": "71200483-cbb3-47a8-9679-bc3625144a1d", "value": "T1ABF3E85BB04886CDEC6D2F3B229B891192F0A46F9273617F13D5E19708927490F5FE3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029217, "uuid": "1ffb8cfd-f4d0-45a3-8a08-8073ad35a696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029217, "uuid": "ac52b696-a9da-4a94-9482-8e19a33635c0", "value": "3072:HcXCfxe+yJJFy5K7u77HeoT1V0Qh634VHyaJl1lH5:8XCloqKO1hJl1lH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670029217, "uuid": "09badc05-5adc-467c-94e7-1c6c530b669a", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670029217, "uuid": "96f1b77d-43da-46eb-9537-80e88582bdae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029217, "uuid": "4800bdad-921e-410a-951e-ee793287a49a", "value": "539a1c84e8f25f54c520bbf48b4aab6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e6f70d-731c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670080322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080322, "uuid": "81cb0bad-c09c-422e-8bf3-ef85ff3d0b42", "comment": "Malware payload", "value": "1ea89a5498e3186ded51fae0918bc5de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080322, "uuid": "1b60137f-0c3f-4e77-841d-9cbfd87b576e", "comment": "Malware payload", "value": "79fcf442e09508c975fed47442355cf7af5ec310343f0f7050328f6e5d563262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080322, "uuid": "474d2367-f738-4ddf-aa09-c045ec4cc79d", "comment": "Malware payload", "value": "1a0262c0bc94fcd4acf7d630d4751e3b0811862c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080322, "uuid": "a33a6d27-a8d7-49fa-848b-c37167e3ad32", "comment": "Malware payload", "value": "7f60c39febee7adb03675dfc7eca11a03041b81139be897712b50c478ca56910c75639eb3e206bdbaac13a84977db7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080322, "uuid": "230a27aa-74da-4625-84c5-4e3d83bd7381", "value": "T1DF22F9217BFCC237E2B78B324DD36E50097BF2516019E5AD14C9020B9E63744AE93E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080322, "uuid": "41fd2150-1151-4ad5-8790-b83541d980c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080322, "uuid": "a283cee2-4101-4aa4-9a1a-9830f2d47410", "value": "192:pMdoBVS5EEboY3zNIQgHVSrmSGmX+jBaRCTfbT:bS5EEb7jNIQgHVSrmgqBmofb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670080322, "uuid": "a5f84412-d20a-4385-9af7-5bf9d147389c", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670080322, "uuid": "47e8dd90-44c6-4c6c-a70e-78f685c7a8fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080322, "uuid": "cb9b4df7-060b-4f58-a124-f4127ed948e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35dd8c1-7348-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099187, "uuid": "4a905943-d9b5-4352-ba17-a99ad000c128", "comment": "Malware payload", "value": "ea96254c4ff8fc74f5cf3d18cc2a4f7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099187, "uuid": "7630ebd5-61e9-4b52-bf41-1e584fc752ab", "comment": "Malware payload", "value": "7ae95936285e2ad5dd43a3d9cc891fdc5f21dd2460d6a9210bed01a1ea86b448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099187, "uuid": "a88d79ce-f8bf-4aa1-acf5-21ad3da39aa9", "comment": "Malware payload", "value": "ac13e45118bf39a71439eadd68b95822a83635d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099187, "uuid": "f494bb7e-e456-483b-ac3e-b1f883c35c57", "comment": "Malware payload", "value": "c2e111375105111a63e7b4dea75c0a2e517295d0fb62a6ae4805642ed8d0fc4e9e065f893b6f45e5c71e8ee0d23591ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099187, "uuid": "7b755d2f-461f-4e03-9fd3-0de3d5ed9759", "value": "T1CD84E07036B3D873F65210714566DBF0AABFF933296199C7E318266E4F303D29A66306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099187, "uuid": "0f88c8da-3939-4592-8327-4a392ec00a1d", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099187, "uuid": "e348c241-736c-4927-b287-c19572858a33", "value": "6144:YNI1vYkelvxtQkzcCP6xRa7NNcyB+5FjnMW2RqnC2Y8:Yy1fORyxQ7NNcKiMW3C2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099187, "uuid": "ccca2408-4ffa-4150-8170-b8ae2a59880e", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099187, "uuid": "9f856725-29df-46ef-b7bb-f291994ef0f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099187, "uuid": "6f07e044-b779-45f0-929c-cb4efa053bf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6a82c4-72d5-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670049699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049699, "uuid": "16cc1938-b477-43ce-bd95-4155990944f3", "comment": "Malware payload (Amadey)", "value": "9f312b7ecf21318e84a574cfd3713dfb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049699, "uuid": "04914574-f514-4b03-b910-7a7df3c3758a", "comment": "Malware payload (Amadey)", "value": "7be8947904916916e35dbaa4bf15196b37b30cd3933409971ccc90b0a5e71c82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049699, "uuid": "66219edf-da04-48d2-b549-46a9ac400408", "comment": "Malware payload (Amadey)", "value": "d5a04ede122af84b46cb38deedd604dadc3f2d76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049699, "uuid": "bb50c5da-dacf-4a83-af06-b10f07e2e6d2", "comment": "Malware payload (Amadey)", "value": "6df1e6c385c823a81fc954a9ebdfa896a1e2d1fc86f6a3c08e8855612e9c6044015e1a5939dacc1d63e4a59e91abd221", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049699, "uuid": "9d6441b7-1a02-4dfe-b369-0871b659002e", "value": "T1AA84E110FAA0C472C18301FC8952DBA8AA3DA4315A61C97F37946F6E5E332D196773F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049699, "uuid": "a872476f-1ac4-4c15-a9ba-7b93bdf0bd82", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049699, "uuid": "c30d520e-8c87-454e-b886-bc1361689346", "value": "6144:yHwI8TL08i4kcR953o5LDGQlx5Z1KMDjWZuR7j8:yQNTG4kL5XGQf5Z1/rRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049699, "uuid": "d2521185-590c-46da-b285-fed3ceb8e078", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049699, "uuid": "79e4299b-3a99-468a-908e-c24226268073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049699, "uuid": "4eddfd83-2e3a-4b89-b643-7a96b482e863", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc35693d-72dd-11ed-9266-42010a9c0072", "comment": "Malware payload (QuasarRAT)", "timestamp": 1670053218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053218, "uuid": "a59f94c5-5cef-4470-b493-279c3351f09d", "comment": "Malware payload (QuasarRAT)", "value": "676c8f98cc2b88e0ed7d1cf10d2ba378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053218, "uuid": "9bff1041-4354-4eef-af0b-d1c1b2c699f1", "comment": "Malware payload (QuasarRAT)", "value": "7d7fe5ce2f7924efa69717b37fbc5347686676628ac014d683dfa335803b74cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053218, "uuid": "4a0ad813-23bb-457e-9dbd-2c882995d9aa", "comment": "Malware payload (QuasarRAT)", "value": "1380bdd6018174a0b2785cecb1b0ac908726a3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053218, "uuid": "a3ae486a-4ee6-4196-b726-f455c1b52202", "comment": "Malware payload (QuasarRAT)", "value": "9424959d618521f1c5170c6fa520f1eee2723d0860eacd2575ffeed6d425516d66c3efbbb094e3fa4f0c6a3f72b2af27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053218, "uuid": "e0a2e83e-2d5d-447a-bede-0a893d98b406", "value": "T186B45B8123FC862BE1AE577DE871042597F4F407A6A7EB4F4940A2F93C567429E807B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053218, "uuid": "6e8022b4-1659-4627-81bc-318d2bdd19e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053218, "uuid": "0f0cb69a-6c80-4d90-95fd-d607c292c0eb", "value": "12288:QTEgdfYHA6h8B8Cb3mC/SePdpfbZ9cda:lUwStbmC/lPdpvcda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670053218, "uuid": "02b6eb47-7054-4675-ba92-aff9ccaae72e", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670053218, "uuid": "0aad1cd0-9fd7-41d9-b79a-ddad2bd862a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053218, "uuid": "5e82b909-cd5f-4730-aee4-87f054fc3f3e", "value": "676c8f98cc2b88e0ed7d1cf10d2ba378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bf7b31-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670091788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091788, "uuid": "7004514c-6343-4d16-9452-7a18622a55fe", "comment": "Malware payload (Smoke Loader)", "value": "e2d0350e74735f3198dadd352ea95992", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091788, "uuid": "ba092cb3-2e6c-4eef-ab0b-5c6e414d7776", "comment": "Malware payload (Smoke Loader)", "value": "7e4ed6746e495e2265d594d7799f78bb947b8e035502ea5214f4f8b078dc2c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091788, "uuid": "90d2c661-c300-4d84-a0de-18b0fdab84a0", "comment": "Malware payload (Smoke Loader)", "value": "fe2c54187ed962fed100e2b2749c2ef2576c3788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091788, "uuid": "5c9d63a2-5675-404c-9e5f-84bd3d225b52", "comment": "Malware payload (Smoke Loader)", "value": "9db51a512e251829828c6d601aa9c9ce97ef6041d3f2307eab2b44acc17b0c2b2dd8f9c31d18597e43e62a0f319b4253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091788, "uuid": "f5d6480e-9f82-4a8c-b33a-3a88cfbec9e8", "value": "T1F474D03076B0D871C553043485A6DBE09B7FF43219A099C7E3586BAE4EB03D19AFA35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091788, "uuid": "7ebcf65d-9aa1-4523-ac3b-15ee90664cf1", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091788, "uuid": "a47e311e-0a18-42c4-a7c1-2d910f3d27d8", "value": "3072:YMYjLPN+mI5AwiRxp3CHK33NKPLRgbk1cSaJuYGnWNTC6NRMHnlXVuc3B2GAQHYg:wLl+m5lwZtAueJ2nMW2RqnN3BM0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091788, "uuid": "530ffacf-7a9a-48f1-9ea8-12f9085c5e67", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091788, "uuid": "db989b34-8927-49e5-b3d8-f9a58157dc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091788, "uuid": "ad6b6f58-7acb-4fb4-a47a-bb01f244cf29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a903b5-733c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670094036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094036, "uuid": "67ddd51c-30a2-4f93-8fdc-7a3f271606b5", "comment": "Malware payload", "value": "d75ff30f5424005d66d87f6e512266af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094036, "uuid": "4f58281b-07b9-47f6-bbad-69465ffff80c", "comment": "Malware payload", "value": "7e8b4454987217e0e0b9ba0da5e55e57fdf5c0268342e963296fa88f64c26cf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094036, "uuid": "0de7fab9-cb8e-40df-8cbd-2e80a2741131", "comment": "Malware payload", "value": "4eacfa000bb45ce5fb86901560afcc833e5be5a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094036, "uuid": "6c5f3ca5-772c-4015-9bd0-3fcab1542faf", "comment": "Malware payload", "value": "08fb6fd04d8a2e9227d1222f9e75dc8de6551dde4df5447a11dd3754dfab82b65304f6249e5ad4ee787cdde09e973282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094036, "uuid": "3711a692-06ae-44de-8f60-694a696afccd", "value": "T11706337A22F3C6B6FA6984F55D3AD300D773B1E0382D9306E7DD88457E666087868317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094036, "uuid": "f1382d4f-b2b9-4323-a05e-161e72f9b994", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094036, "uuid": "4562d828-b6b1-4f00-b02b-c24eafe934eb", "value": "98304:AO6uPYpvJTvTvlY3Rl0hxIuPZXh1sZ0T/qEhDcPJXcyb:nlPCvhTvlYhlIdBXh1PFMXcyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670094036, "uuid": "ac49946b-0626-439e-aeea-2948583a5e22", "value": 3743120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670094036, "uuid": "27340054-ace0-49d2-9442-40a9b315fa0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094036, "uuid": "bf5a7be7-e366-469f-a795-5117c9f8e358", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a9f0e2-7359-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670106572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106572, "uuid": "8a675e2d-6a76-4827-be07-10d6d5e220dd", "comment": "Malware payload", "value": "6d6cda36668f5c560b99806b66d032a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106572, "uuid": "5b82a78e-d778-4383-b63b-5e2cb67bc8d6", "comment": "Malware payload", "value": "7ebf75397b289571aeb79ba79966b577adf79375e8ec31c31ce18037e7bc8646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106572, "uuid": "52d053d7-1244-439a-b5dd-d354531a3592", "comment": "Malware payload", "value": "f51d2ec852ddbc4ae17aa6bc3173d0171667af15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106572, "uuid": "dab5e449-a6f5-4180-a442-f75b9b079386", "comment": "Malware payload", "value": "71b4002f027e23c9b5563dc608997f97c6831f11d328a3bf0485a6e4bcdda0498ffc1e925e42a001011ea765f0e10ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106572, "uuid": "35325115-1ff4-4b98-916a-c40e1262082e", "value": "T1AA74E07032B3C872D99315315066FBE06A7FFB325C9389C667692A5E6E313D186F6302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106572, "uuid": "7f37dcf7-943c-4691-b1d5-2e6091f6d93f", "value": "fabdd81d465096fc2ac5ac1410a7de25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106572, "uuid": "b03603d6-e9d7-4b6f-851e-76f050dd25f8", "value": "3072:PwBNXChTTY95XmTfaI0/oHdOETVQtEnQqkJ4LGnWNTC6NRMHnlXWmxLhhppHYDrE:gWkH2fZdOE5QtYa1nMW2RqnBLhrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670106572, "uuid": "e8e3301e-36a4-4619-ae88-1f5cfbc4b5f5", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670106572, "uuid": "d57ad04e-329f-4615-9e98-5b91b0181c77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106572, "uuid": "e5b3540a-1ece-42f2-9635-64b5ef9e1838", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347a5225-72d7-11ed-9266-42010a9c0072", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1670050414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670050414, "uuid": "acaa499e-a4bd-43cc-80b9-0d96797f2e5e", "comment": "Malware payload (Gh0stRAT)", "value": "5395ab157300e5d6eac5307be6e8cdab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670050414, "uuid": "2422adde-e7b6-40d0-88be-eb44e25e8e62", "comment": "Malware payload (Gh0stRAT)", "value": "7f08cb852ff571daf21c36be14b4751d71d65f7dc30a59995e9ecd37ef201b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670050414, "uuid": "da69b64a-2731-4a06-89f8-1481e8b2695f", "comment": "Malware payload (Gh0stRAT)", "value": "2f078b605d9e2dd16326390f17589b87b8001415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670050414, "uuid": "33ffe044-03d1-46a0-a4df-9b21716d56ec", "comment": "Malware payload (Gh0stRAT)", "value": "ad530f831dbb4a8181d8b52799958edffd2c2ebab2f327e94e3b15193299970f1c592460311748bbd3c15603215eb248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670050414, "uuid": "6710832d-72fb-4d35-b6f4-c300e395dd81", "value": "T1F7E41B91F1987CE6C41320B29D79EA15615EBF990D2D4A0F3A73BA0E89721C37532E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670050414, "uuid": "a4ee61c4-98ce-4a62-beae-2a169ec34ed0", "value": "2b64cbe6771df319e38d838b55ee79a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670050414, "uuid": "d834d73c-bebf-403a-82b1-8da530a9e50b", "value": "6144:4DcOlaCsh0tdiAf52g7hMvF1XaKc+Z8Y/BwLcRcmIzmEyOXj:4DzaC+IdiAf9avF9RlZ8HmDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670050414, "uuid": "b11e961e-0081-47f3-bee8-4b2344b5e875", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670050414, "uuid": "55a1a390-22ed-40fc-9ba6-bec34ba21a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670050414, "uuid": "0185d3bf-7725-4a84-982c-4e53e6326c24", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7850ec7-72d5-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670049801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049801, "uuid": "ed801d36-6eed-4d7c-a55b-38eebe37c5be", "comment": "Malware payload (RedLineStealer)", "value": "925f9056f2605575da68cb913a010a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049801, "uuid": "95811661-00d4-4258-80cd-900552618a47", "comment": "Malware payload (RedLineStealer)", "value": "80a71a90b99f4518e5f98a419975d93caeefb87b8c76c3e42f59565174b5ca53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049801, "uuid": "069adbea-da92-455a-afd8-7decd8984a71", "comment": "Malware payload (RedLineStealer)", "value": "53d11c12df33c93d35d8f24c38be1c9d9f6b1143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049801, "uuid": "453d0487-c22c-4d5c-9603-bdb0d75273da", "comment": "Malware payload (RedLineStealer)", "value": "e72615fa4d48a62ee75a860170160b00af91546c3c339c455e446f9d6c9a57613bdc04605523d89ba049b2857303c817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049801, "uuid": "918bdd67-38fa-4245-a68b-aca8ba2ce026", "value": "T1A6A42381B3569351FE7A807734A7A62467B118D133EB8C79CAC4914336E0EF39B716B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049801, "uuid": "e034634f-23aa-47de-a1f0-82d981504158", "value": "12288:/U/A0h8Oq9P+M2UGAkXnkt594V9gtaTfQ:/xN+hVAYO5A9gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049801, "uuid": "001fb559-efae-43f8-94f6-12bcb334037e", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049801, "uuid": "622ba5bf-cf2b-4034-b7ac-cb95980cff37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049801, "uuid": "2f4a80b4-a5b9-4d35-baf4-d2314d072d30", "value": "gta5_mod_menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ec7120-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083241, "uuid": "8407f9db-01b3-46a6-94c9-94581efbade6", "comment": "Malware payload (Mirai)", "value": "b9de166a6c9fddb67b8dbcdb946c1504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083241, "uuid": "04f86729-6811-4545-9311-ed3b935de668", "comment": "Malware payload (Mirai)", "value": "80c5ad11e31e24f6435738d8ae6f93fbff7d53692e15924cdbfa39ef476a5ad8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083241, "uuid": "0e3ce924-810f-466e-a179-efb70685ad11", "comment": "Malware payload (Mirai)", "value": "15826e7e6a9fc75c0b549f6f0dd21539e320d325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083241, "uuid": "7048723e-ad49-4408-baf6-db52a1dde7e4", "comment": "Malware payload (Mirai)", "value": "e245e246ad0565ec2cc02f18abb23eeb0b986d556d76a3d0385dbd354371e43788bc3b5290631f23202a8cca5a8dc0db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083241, "uuid": "f3e1379e-8add-4e2e-9d86-2d5c4387243a", "value": "T1FCC2E03411DA5E51C535C636BB2999C4BF560BBCA3B360E77E81A378E4C3417EA3206B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083241, "uuid": "a011511a-9452-4e15-88cb-a9bcca923d79", "value": "768:tRYtLOjiI0iTehHr6qiLGOXQJYu5RZ0s3UozGw:tat9wALKGlYu5RZRzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083241, "uuid": "cec69eb7-af0d-435c-931f-7712cca8287f", "value": 26328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083241, "uuid": "8aca61a1-6acd-4c4f-8667-642f570b3afb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083241, "uuid": "337a2939-4c4d-454a-9c67-a7bde6eac6a9", "value": "b9de166a6c9fddb67b8dbcdb946c1504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a49cf7-730e-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670074355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074355, "uuid": "0a2de8e4-486f-420b-a3e9-7dad89de4445", "comment": "Malware payload (GCleaner)", "value": "235ce52421ee8e3899ab286b2c688cbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074355, "uuid": "575b73c6-791c-431c-8ed0-89ce94c1c909", "comment": "Malware payload (GCleaner)", "value": "80e422d64b4dbc2588ea72dd8d0efe831e54c3cb808ba7974c5c970a54f6cff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074355, "uuid": "464c01d0-be69-4ff0-9c28-28c8da535693", "comment": "Malware payload (GCleaner)", "value": "1676ec85a8c650e2add831866ec4450bcab6b18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670074355, "uuid": "5166b77c-a58c-4fe7-835d-62f5059d446f", "comment": "Malware payload (GCleaner)", "value": "c6703ad949b2cf5e3a5660288c90ffbbe25c5d520fffe1174aa0e943afabec94173ad60285a8c95e23f90733405f8a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074355, "uuid": "51f98702-9593-46b9-80df-c678c0eaba22", "value": "T193F53396FDA6423DC3A33C748DDBAA04D4336CEBF24DA60484BDBB640E6217558C9F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074355, "uuid": "4a63a671-f71f-4628-88f6-57d8db3fe7ef", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074355, "uuid": "50123ef7-006c-446c-96d1-171a73b85deb", "value": "49152:wTAmeme7z1GfSmBHYJ3CtiUx9pjLYNKgmWQ6qxx4BWoO9taY+Jk1jVAG5cyN:wTAm/e7z1S9lYLWQqWQ6qUBqyknXcyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670074355, "uuid": "779ed68f-cfe0-48aa-946c-3823b566b452", "value": 3597252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670074355, "uuid": "b6338927-7a0a-40c8-89b4-de182182fad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670074355, "uuid": "60213e35-8e11-4302-bb93-26c361aac635", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7579ee40-735a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670106787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106787, "uuid": "09ea1ad4-15f2-40bb-8132-30ae0d371c90", "comment": "Malware payload", "value": "c59d562b2194051053f981cc986e2c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106787, "uuid": "8c801474-5418-430e-9086-6b6ca467e477", "comment": "Malware payload", "value": "81bd4744776f8144797a834c7f90a49b7b89895ab3b899b53966c0062e446489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106787, "uuid": "150ebb43-e232-4ff7-9847-5a07a2262dfd", "comment": "Malware payload", "value": "7294a69b761ea21921cc8a17e641eb5900eae096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106787, "uuid": "824b71ae-ba9f-473b-b02d-5e9cdbc75b8d", "comment": "Malware payload", "value": "f4997ddc13725c41a343cb278a5e3eff4861ca0e939cc69fa43cbfb16a9c9479dd98b6f7b70648eb38251bd3a1369ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106787, "uuid": "a56eebb5-a924-48e3-ad0a-16ad7764447b", "value": "T12184E03032B0D87EC65315759CA2FAB06A7FBC3259B59AC73769266E1D303C28637342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106787, "uuid": "62e7c604-eee9-43e2-b7b2-e3cabf0a7d70", "value": "fabdd81d465096fc2ac5ac1410a7de25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106787, "uuid": "c4350e2d-94ee-49f6-8972-2429dddad1a3", "value": "6144:rjTwNWqX/1Z5cqCOysofQnMW2RqnnA5Y:rjTwWqX/1Z5iVWMW32Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670106787, "uuid": "237e43e0-9b71-40d4-89f3-66dab6ab3584", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670106787, "uuid": "08208d38-a5c4-4bba-999f-eee5e35a4cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106787, "uuid": "a18b5ec5-882e-447d-bf58-75be37a9d149", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4297cc12-7332-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670089522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089522, "uuid": "9298ee67-5cb2-4bc7-a997-736b9c780c15", "comment": "Malware payload (Amadey)", "value": "90a7817df941f4b39cb94a765c5332df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089522, "uuid": "2bf662cb-cd7b-4357-a1e7-c1af458a8f5e", "comment": "Malware payload (Amadey)", "value": "830a260196e880a40b7e9b5bbc386fb444091444e8108470794ea4d7353a982c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089522, "uuid": "4177c107-93f4-4910-a958-708b56f51383", "comment": "Malware payload (Amadey)", "value": "70d28a7c7f09bc107ea7c028d386d51596c855c1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089522, "uuid": "cc4a21fd-0dcc-4653-b029-2bfa24047bce", "comment": "Malware payload (Amadey)", "value": "9790ac8102ae6e10ee44509c5f07a082d881ce7a05b2fdc55e2afac773d7cd22e4c3bc2acd210537877f03ccbd30c300", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089522, "uuid": "085a86ae-8df0-4038-8303-33237375bf81", "value": "T15D84E030B2B0D8B2F59345308462DBA1AA7FB8325D619ACF3325266D9E707D19736337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089522, "uuid": "e8fa738b-80e3-4ada-a5ab-58629531a0a6", "value": "88f3452040e97f1dc959027eca7e915d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089522, "uuid": "43205cad-b52e-4504-a697-91a8655e509a", "value": "6144:nRaE/hze98KGR86mKfmegmJSK+0VtokmnMW2Rqn5RcYb:nRTp5lcepZPQMW35RcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670089522, "uuid": "8e8e0dfe-4ea9-4257-bbcb-7300664c2080", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670089522, "uuid": "54e56a7c-ce2a-4868-9538-858061990892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089522, "uuid": "4d45291d-3688-47dc-9abc-0067f6e24701", "value": "90a7817df941f4b39cb94a765c5332df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82644ec2-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091776, "uuid": "1fd8a6a2-1772-47f6-9b0b-b1e7fdc189f6", "comment": "Malware payload (Mirai)", "value": "17ed3ca972f7e48e0f9201114c13ea7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091776, "uuid": "4730b14f-4f0a-40f0-94f3-83d0718bbaf3", "comment": "Malware payload (Mirai)", "value": "835d627e3db2e396de4d018fa0d1ab5933c66ceb0eb2daf1323709fa7b589c7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091776, "uuid": "88e7d3cd-71ae-4845-bdde-279e32048917", "comment": "Malware payload (Mirai)", "value": "3008d62dc806795957254a34c0d0a59a15d217c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091776, "uuid": "b6e64890-3eeb-43ac-9424-bc8fde4913fb", "comment": "Malware payload (Mirai)", "value": "74ea51c00985022d8cb60c3d93a271d9f0f8fab94d9170a8008c3d9a27d95b623e227a9e5e07810395dd7bfb8721fcb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091776, "uuid": "d30d0dc3-35aa-405b-a252-c4483521e86f", "value": "T12243C8197E228FBDF65A527047F38E215E0837E62BE1D581E16CEA411E7028D341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091776, "uuid": "df9eadf6-fe56-4d3a-8f6c-4463945c9db2", "value": "768:Lu9flDFb+syMEfHk88UJPf0+Pb1+5Ug5ya4uWBB0EwbZ010U5MxU:iXMss50ob10zCB0lb+10WMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091776, "uuid": "73d4da33-e96a-4ca2-8ed7-9f2d09c34a8a", "value": 57316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091776, "uuid": "f5c6c556-2c29-45c6-b494-b7cccd863ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091776, "uuid": "14e86bf3-dbde-4a7f-8446-2ad5f9cff1de", "value": "17ed3ca972f7e48e0f9201114c13ea7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174be568-7311-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670075276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075276, "uuid": "a81fa667-472d-41d1-bcd2-a4bc7afb2ea4", "comment": "Malware payload", "value": "bf423f6fd0a20dfb08b9ce78c44b7e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075276, "uuid": "eb4817de-df58-48ed-8cf9-ce6efcd9b319", "comment": "Malware payload", "value": "83778325319291e908df27ba6ae91f5a51335db13ed1a14b54fe771772e7e586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075276, "uuid": "7d91a5b3-9667-4167-ac53-17267bd890d6", "comment": "Malware payload", "value": "538c149c4fac73bc21e2a5b364d4b6acb75eb793", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075276, "uuid": "967dcc84-9b85-49dd-b9e7-b5eb6e901da6", "comment": "Malware payload", "value": "159d719d46363532c92c06c23c0d205c19ba398b128336b5bf97dca843a45d30c17ba1e2c2ce193754496fdd41cdeaa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075276, "uuid": "776c98fa-0bf4-4f05-8ee2-a44a5971d2f6", "value": "T135D329D7ABC5ACA7DA11033559FA4319233AF7E02B878B171D34A5341E237D0BEC694A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075276, "uuid": "07b0b311-c44c-4f12-9322-beefc872be46", "value": "f6ad3a6658fd74fef9240a5ecb6d9168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075276, "uuid": "e0ed6c87-3e74-4ac3-9288-dcc31703e25c", "value": "1536:YhfJF09ymZmCtTcH+3/0tjtqPRRXsHdyrCZlt:MF09+w0twYOCbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670075276, "uuid": "7773b674-d5a3-4bea-81a0-eee2290283d0", "value": 140516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670075276, "uuid": "ab257550-0ac8-41ad-b5c6-d6c6cf989a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075276, "uuid": "7bddfdb9-e8dc-4e19-9833-ff7ecb8a5b30", "value": "justdo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c0f2ff-731c-11ed-9266-42010a9c0072", "comment": "Malware payload (njrat)", "timestamp": 1670080216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080216, "uuid": "80c37155-a1eb-4aa7-9eb7-edf409ccb294", "comment": "Malware payload (njrat)", "value": "84a39cb712de28760fc6a7740f674bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080216, "uuid": "bbff15e4-6681-4526-841e-9f300608b34b", "comment": "Malware payload (njrat)", "value": "8398ee25e1f67f866aeac9c0fd8fb22302839b6dbc48163b9778a744ade88ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080216, "uuid": "f8841583-d6bc-4637-b857-fa2c612fbb12", "comment": "Malware payload (njrat)", "value": "c152916eb9393c5d946dfc6f324423df39c94bbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670080216, "uuid": "475c50f1-ecfa-459e-8fb3-5ea4b60fcc44", "comment": "Malware payload (njrat)", "value": "bc44fb70cce2db541cdb6475da616ee6d6e6f202a03dec65b517a056e6f10dd29a114a5475002ce56f7d4a4b8fef3aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080216, "uuid": "966297fd-b6c2-488b-96cf-1be88c18dc82", "value": "T1BFE1E51197E08772CB9E03F709F356015B71E70CEAABAF5F7494A2764EA32484653B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080216, "uuid": "a686ee8b-9e72-44d9-89a8-38a4cdc4ab09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080216, "uuid": "745d7cdd-8222-4b24-832e-9ee416f21e08", "value": "96:CfpxK68Lh5TOsiBx9wRcE2TYlnlYJnLOL0Kff2W8K0ucuRXmmNFL930zNt:CSxqsiBx9nV2nlYJLOLT8n2pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670080216, "uuid": "60a5a071-662d-40e7-b62b-672b0ffd1160", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670080216, "uuid": "00491665-bd32-4ae6-a5ba-e8d775770e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670080216, "uuid": "d238c48a-5f5c-4b50-9aff-d794798168d3", "value": "84a39cb712de28760fc6a7740f674bd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93302f49-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670108984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108984, "uuid": "985f0fcb-d79b-4fd6-a1ba-399eebeec186", "comment": "Malware payload (Mirai)", "value": "d13c2b7f93dd58e9a54ba51941dfe8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108984, "uuid": "1feecb7a-ffd0-45a4-878a-bf984ab7a280", "comment": "Malware payload (Mirai)", "value": "84e844c2228237ff3f4b8e0dd655cb1f8179eaa59e3a0ac08004b9820a4fc244", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108984, "uuid": "9dc2fee7-b868-4a6d-95a1-d3ba56b536d0", "comment": "Malware payload (Mirai)", "value": "1856b1c697499472661cd8997991422ed8b4eb87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108984, "uuid": "3c86158b-22fa-4d50-9d9e-bb221dc7aa53", "comment": "Malware payload (Mirai)", "value": "157d67803af9f617defcda472436a6c1de124a697433e682a46b5e038d6093940a7841b3dfce7a76cc3ba1406a23330f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108984, "uuid": "c94151da-416a-488e-9405-e02428a065e6", "value": "T17F434A95F8828A13C1D1127BFA2E968D3B2563E8D2DF73039D301F51369B82B0E6BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108984, "uuid": "0e55fbac-fc75-471c-a88b-89819d4088a0", "value": "1536:75wmKQGZbpGaRWKC51It5XvCFmAb+10mg:75wr5gKGabXvCcAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108984, "uuid": "d40e71cd-c8a9-4b30-b0c5-7b9d7c6b798d", "value": 55688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108984, "uuid": "7229ce29-502b-4cf2-813e-0047970883d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108984, "uuid": "39ca4312-b603-44d1-9641-83bf90f1ea48", "value": "d13c2b7f93dd58e9a54ba51941dfe8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125da981-72f3-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670062382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062382, "uuid": "335bdbaf-eecc-499b-be1d-71216f602a0d", "comment": "Malware payload", "value": "d2132ef05d9f681fcae958439dff5f91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silverbullet", "colour": "#8A535A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062382, "uuid": "a2c06970-863b-42ab-b84e-cecaaf8beb72", "comment": "Malware payload", "value": "851e235c4e4ba69d6ba913dfee77638a12430e0848111934ba1211740c0396e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silverbullet", "colour": "#8A535A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062382, "uuid": "1624e9be-37b7-4715-b109-a740d5289c32", "comment": "Malware payload", "value": "5f0a30fcf2eb7583d0c272e1bcd21edaebad2a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silverbullet", "colour": "#8A535A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062382, "uuid": "3b7edb88-f675-400b-b73e-5dc7c19565b1", "comment": "Malware payload", "value": "17b77e70a7d4b81c7e0c2b0bf35b011b996876ca9e584cfb50ea5c517dc818fefdbece5db4bd32b3f614e6c3d6c6d947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Silverbullet", "colour": "#8A535A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062382, "uuid": "ea6b8310-0704-4e6f-95c5-7bc3c4fddc1b", "value": "T18DA5CF10377CC955D17B4FBCEC353280D636AE4A17E5C759E8BE38AED5A9B028A13213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062382, "uuid": "659ac994-c8e0-436b-aa74-5a37526eaf91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062382, "uuid": "f816ef1d-9bad-4546-810e-4bf038c18c79", "value": "24576:rgFepFRvh1TfFIH9gYRRcY+32oQRLwDQF4eaE2cZPeAgF7H2oQRLwDkn0HULOL4e:+2h/7DQB/FOLDQBZlT5QB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670062382, "uuid": "d644c392-15a3-4f61-8a66-2a9d00f16ef0", "value": 2188288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670062382, "uuid": "50bd503e-29bb-43f9-a511-06474ca75167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062382, "uuid": "459a646b-0c25-47aa-a2ca-f7bf431385ef", "value": "SilverBullet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642bc045-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670052641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052641, "uuid": "36c70134-0b1b-4cf7-bfa4-39620b6be35b", "comment": "Malware payload (GCleaner)", "value": "7bddd7b26ad64745e670fca100982b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052641, "uuid": "8c307614-88c8-4e58-ac42-26cc9b594314", "comment": "Malware payload (GCleaner)", "value": "86021f685ba523b563bc39997fe3dca575f0dc8c5b51e149ef3ecce4c22ff0e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052641, "uuid": "87c18111-00f3-4bef-b288-1b4f14c0ae10", "comment": "Malware payload (GCleaner)", "value": "f30db5b97de6ee4a2df3d59cfee17efc741cf121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052641, "uuid": "97685317-5a35-40cf-9d0c-89d50dcb7307", "comment": "Malware payload (GCleaner)", "value": "f32c702832615fd5f8bcef5a36e346d857fd501fc6cc5b6a1c082db4772347def1317bc4281c31a05d0a0f685e46843f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052641, "uuid": "9ba05b20-fe2f-42ac-8390-ba7dbedaec1b", "value": "T1510633BD35B1387ADCC589F62D5EC4848A6335350BF878401E6F2A4A791F599CE8F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052641, "uuid": "2717dafa-80e8-4db4-82c6-da5e46ebb5d8", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052641, "uuid": "4dad496c-56e2-4acd-9801-76c8ed8c753e", "value": "49152:ciqtpGezy0RwKFVxzsPYS9JV2IzmztkZLfCGERFI3rs00OnlGCtSFHb6f7AzOLFf:cioawyRwCs1RuA00GlGCe2UOLgFAXcyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052641, "uuid": "69e6eac5-ac80-4192-add0-d0a9d35bd442", "value": 3743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052641, "uuid": "d4e47c07-18fb-40d9-8279-5d54c2565552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052641, "uuid": "751449f3-b04f-4732-a9e9-de9dcdb14aac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc64383-7310-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670075045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075045, "uuid": "68af83a2-e15a-4783-8147-330f227d5464", "comment": "Malware payload", "value": "9ef9301b3ebf9b80b47dceb810187469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075045, "uuid": "db17e419-ac47-48fe-b8ca-d48b5f6800e0", "comment": "Malware payload", "value": "86138461131cdc2e31b773c4221f2fb0e6296f946ae904d92f6a0e17aa11f8ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075045, "uuid": "cda18e12-b258-4a83-9e65-1b6692ecc517", "comment": "Malware payload", "value": "ed4671795f1ffba3aa74d43363c3f03b16034384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075045, "uuid": "4b0e35ec-107c-4965-8dcb-6122ecb87e93", "comment": "Malware payload", "value": "f8030c748a1b25a14e5fd809b2e6a97c7e596b10667a4ef7fc5c4dc300e2704ea7e70d7294f104b45f92307b8f4d0425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075045, "uuid": "30b37d7a-7c6b-4d56-addb-4cd70afe4d7f", "value": "T11FD318D7ABC5ACA7DA11073559FB4319233AF7E02B878B171D30A5341E237D0AEC694A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075045, "uuid": "e16571d3-e521-44ea-a121-ef1acc328d84", "value": "f6ad3a6658fd74fef9240a5ecb6d9168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075045, "uuid": "e2d404c2-69c5-4ba7-8b41-c4cf3950ac08", "value": "1536:U4Jly0ymZ/uzH+zQN3/pDUtKvTeXsHvYECZeit:ply0hwpDRBfCPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670075045, "uuid": "23e40239-5595-4d01-9c4b-8148b6566e35", "value": 140516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670075045, "uuid": "96a3c122-8620-4ff8-a73b-11feb0607b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075045, "uuid": "05162710-3eeb-4ff4-a3af-26a1109427f5", "value": "onlyhit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b6e15-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1670052805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052805, "uuid": "08e7d765-f928-46d9-a7ea-fefe1cf7377f", "comment": "Malware payload (YellowCockatoo)", "value": "38b113bfc88e23b2f94d460ea6029198", "object_relation": "md5", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052805, "uuid": "34d4d2be-2147-443b-9088-69d9ebf0f1e2", "comment": "Malware payload (YellowCockatoo)", "value": "872f44ccb4c39f2da379c082ac4ad5acc06b363374a615929def47c18b0f9642", "object_relation": "sha256", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052805, "uuid": "7447c99e-0114-4173-aa42-6b2f1792e096", "comment": "Malware payload (YellowCockatoo)", "value": "be65264ff8b837325f8d229e6c90ccb926db76a5", "object_relation": "sha1", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052805, "uuid": "5d183d48-3509-4ab0-a97f-fed4aac815cf", "comment": "Malware payload (YellowCockatoo)", "value": "9198f1ecf263c322a1a00a7c84e97d3a67243e1b4ceb46f41a750e9ac47afa350c904e670ac1142242bf1994a1ac3b63", "object_relation": "sha3-384", "Tag": [ { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052805, "uuid": "6f4007d8-56ba-42be-b2e0-ef53a8dfb050", "value": "T1D01533300FF1FC7944A89E3DA43EAB3AAEF25B5A647A54974B305982EC4FB4011735E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052805, "uuid": "2ae89f86-cb1b-4cdb-88c7-b48102855b63", "value": "12288:XvWgC3zUCeYyqq3EijuUPWzGhrt8mCNDNTLFOicg3ZgUXy900wyimgJSLS6mGbG6:2z7Diju+PtKVNDB08Zi9wbJSLZmsYBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052805, "uuid": "7a6ce77f-4f86-4610-b788-5fb97e50b9ca", "value": 909076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052805, "uuid": "2e01fb21-f6b9-42a0-add9-35e942b27a91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052805, "uuid": "c855cab8-5cc0-4375-8e5e-16e3087cfcb5", "value": "jxz4qd40ulc99nv407l2gae9156tyqr5.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20da7425-72f1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670061548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061548, "uuid": "78ea63e4-8f72-4aa8-b8fb-38d17c8136c4", "comment": "Malware payload", "value": "d41c48709f03d3c1343cf52a7e5ff818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061548, "uuid": "043d086e-ba34-40e6-a56b-2a11962c067d", "comment": "Malware payload", "value": "87def89cd2a04088b017cd53616342cddc73f3c041b9cdf67ec72b366d140541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061548, "uuid": "49adf433-2327-4f34-a078-27c0d32efbc8", "comment": "Malware payload", "value": "59773f1119449a974675fac682d44fbf7298de50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061548, "uuid": "99d091ba-62c0-4dc0-b073-885c3fb01702", "comment": "Malware payload", "value": "a6a58c6ddfb6ef0ca9baafce2f6f4937ae8b158beab5383ee0b82cf86d8b36cea40869f3825e4e42c9322a29f8ab96f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061548, "uuid": "ee0564d0-b94e-4fe5-8deb-dbb87d6dda63", "value": "T1E176332334F3CA77D6918536839C7B3B54B691488E3E1C97537245BC6F3EE68263A818", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061548, "uuid": "77b85213-696d-49ce-bc3d-f3d9f9c28767", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061548, "uuid": "3d4a13fa-bdf5-46ec-a984-b58747c40329", "value": "196608:91O4D3P7I8oAmYj9pIfv/7VpvzVefgSJec+kH:3O4D/7IBJYYfvzHvzVefdEkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670061548, "uuid": "e2f1f0bf-9b09-4af1-88e6-47bec92933ef", "value": 7601455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670061548, "uuid": "4f161183-b113-4eed-a6f0-418b52d78a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061548, "uuid": "7eb226a8-99d3-4ac1-8b61-878720e138dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c0b1ef-7331-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670089232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089232, "uuid": "e92fdb43-9acb-4058-ac56-c9c872b4d6fd", "comment": "Malware payload (Smoke Loader)", "value": "a4738fbb574f502645403dae0eee4437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089232, "uuid": "d42250f4-a990-410d-bb35-76827b908f72", "comment": "Malware payload (Smoke Loader)", "value": "8a67f1827d024f2f2339926263a62eaeea0cbf7019d001abe46053cd40049773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089232, "uuid": "2116ab03-40ad-4f3f-bc35-5c8ed7c327a9", "comment": "Malware payload (Smoke Loader)", "value": "9dc70f826bf9911348858aaaa6b90aa99e2bd301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089232, "uuid": "a8dc7380-625d-4d3e-8432-11a3055f5596", "comment": "Malware payload (Smoke Loader)", "value": "153a34703fc75d45076a98edd89a1ec7c21f7aa288c4b0f1795d0a91e1fc69b20b4ba0ad14c9ef5afe65bc39199cbc07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089232, "uuid": "7100d183-6718-4b32-bf8b-8b349e06f333", "value": "T1D374D03032B4D831C75314718467DBA59B7FF83289A19AC737692B6E5E703E186B630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089232, "uuid": "e8664caa-b010-485a-aec3-a382c73603a4", "value": "88f3452040e97f1dc959027eca7e915d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089232, "uuid": "2a968f2c-3827-46fc-9107-4aff432901cf", "value": "6144:Ln7ojHEzjDorNI9NxeUBDg0QenMW2RqnfmV2cYb:LnukINQ75BQ4MW3fUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670089232, "uuid": "4cd5b36c-bd97-4198-a417-ae8d51afbfe3", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670089232, "uuid": "72ceddac-6510-4876-bc82-dec7eff6100b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089232, "uuid": "150c07f3-835c-4db8-9ad8-caa878057aa1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8268f5cf-733f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670095212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095212, "uuid": "dcfe816c-0d13-4cd8-b4af-4d238b907043", "comment": "Malware payload", "value": "c343783065d95c74afbf9864ce7ecace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095212, "uuid": "889b482e-9c32-45f4-bbdc-b061890dc815", "comment": "Malware payload", "value": "8ac56c809734e021cb0c5b2136e930ae2203c9788632a92f9b1a8dd1ed13dc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095212, "uuid": "00f23a41-ef2c-4eb6-9e2f-3e55f19fe085", "comment": "Malware payload", "value": "b03316667b92ad675486e5a43a10d570917cfd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095212, "uuid": "ef6424ff-d49b-458e-b482-e53564332f52", "comment": "Malware payload", "value": "5578be660b780c52696f4bcc1087c2d2f8520988637b6a029c66d9bc188c16c6b4ed73ebbd01edd36ca96995429eaace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095212, "uuid": "67e27ce2-17dd-4cb5-a447-19fc69a73fc8", "value": "T13976330236F0C4F4E94C86B45C29FFDABA68C6702B240467B732192A7B7975E835774E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095212, "uuid": "aabb30fd-0518-48b6-9048-b8f68a694628", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095212, "uuid": "07b99b26-64a3-4f93-aa75-47c1745d7c05", "value": "196608:91OVBDBgAFXFJKOIw3vX0n6fwoMN+3KPNHKyLk:3O/DBgAJF/Ir6K+aPNx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670095212, "uuid": "1f49e56a-c16d-4a25-9028-ac2ed655ffce", "value": 7622495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670095212, "uuid": "6bd9078f-91c1-4699-a1cd-40a633bdd73d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095212, "uuid": "13864b01-8d09-4d2e-8bbb-52c890786467", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b4c012-72db-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670052080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052080, "uuid": "280cd41d-12ba-4f98-90ae-4de2c2350fee", "comment": "Malware payload (Smoke Loader)", "value": "abad073f2d0958bc834eb8fe4c41d1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052080, "uuid": "b359b707-307f-4b96-923e-e1e135d3b396", "comment": "Malware payload (Smoke Loader)", "value": "8adce0133ce64b5cb3f1089d08682e9fb4f3b6ed1d9d2fef2e1d028dd51b2c2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052080, "uuid": "c1d23e66-ffeb-4f47-9454-ca906dcdd3a0", "comment": "Malware payload (Smoke Loader)", "value": "509481687239f675de75d12e0108c8fb32efc6b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052080, "uuid": "f69a3cc0-5938-49db-9738-624ffbb42971", "comment": "Malware payload (Smoke Loader)", "value": "a6cab07a4e53e4805102ce8f6118dcd3febe11a6ef28af71d6e67b1bbb70f2a48e6bf32bd6b1073871aa9d0ee6c51368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052080, "uuid": "a3225ade-6957-40cd-b793-f9e7eb630881", "value": "T1ED74D00CF690D876C54201F98825DBA89ABDA4316620D91F37993E6E9F333E197363C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052080, "uuid": "63d3ed77-5987-4f67-a180-6f886a89ade8", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052080, "uuid": "9d58bdcb-b4eb-48dc-bd0a-de8ef6948d86", "value": "6144:2x5IStLC8eLccRo3XAZ14vMQ5eUuR0Pjp:2fbtkLcXQZ140oeZR07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052080, "uuid": "8e4fee50-5756-4d54-8977-240c503fca59", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052080, "uuid": "2026ad85-b0eb-4ecb-9265-85ac1f92283a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052080, "uuid": "37880f7a-3adb-403e-bf94-045368c18dc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a8d5da-72f9-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670065123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670065123, "uuid": "5cdf7e2d-fa41-4c70-a3a0-af9ffac52597", "comment": "Malware payload (Smoke Loader)", "value": "dc07c7e00c088bc014a4cd322f689ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670065123, "uuid": "43819737-bd32-4e4c-b3b2-8250adce1ea5", "comment": "Malware payload (Smoke Loader)", "value": "8bb95292e5a2a9fbb169345646088cdad7426cb889595bcbea4ecea02984b2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670065123, "uuid": "bd75594d-e5e8-4178-bb97-5c8d7bda75b8", "comment": "Malware payload (Smoke Loader)", "value": "cc4d783e368095144c809f05913dc606bdcba7f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670065123, "uuid": "a0345d5b-6d4d-45e6-95fb-36c1572c4fcf", "comment": "Malware payload (Smoke Loader)", "value": "43e5ba9316b86cde762b5723e5d6437c76f8e6b3cdaf8dd32387fdd11e5ecbfeccb7b79fce016b3b0a4bdeb9a28b86dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670065123, "uuid": "d59acadd-8078-45c4-83b9-fc858194bb7b", "value": "T10374E07076B0D832C6A315319057FBA19E7FB9225DA0D9CB33652B6E5E303D18A76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670065123, "uuid": "3a45150d-c23c-4e87-8a0f-5bdd483958fb", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670065123, "uuid": "b427e38c-eceb-4101-90b5-657a69946621", "value": "3072:z98S+v9+DAr7C5JRme9JxlQFgnetThtwa6R1vYEk/g2ufKGnWNTC6NRMHnlX2evr:SS+vIDAPeZxGSeskvQnMW2Rqn0ePYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670065123, "uuid": "501fd715-7027-4883-9012-e8038b42ad6f", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670065123, "uuid": "dca6ef9d-7b70-483a-8578-fc042104a54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670065123, "uuid": "9fe37fb8-5b47-4823-8e0d-4ec086908273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8fb4e2-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091795, "uuid": "3085999e-815d-4c0f-a76a-49cd9af4d896", "comment": "Malware payload (Mirai)", "value": "66b899cf2873a2fff40c4c3203cf8eb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091795, "uuid": "666ecfb7-01b1-4ed4-baff-2eb004d560dd", "comment": "Malware payload (Mirai)", "value": "8be5af42c24100c1bea473b5d8e9613fdbbf810d81aabb71646ce7b3ee0808df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091795, "uuid": "6fc1b8d0-3840-4015-985b-b86ac799c407", "comment": "Malware payload (Mirai)", "value": "e376adadc249d6531d872fcb6e68deb91058e64f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091795, "uuid": "7b097af6-4566-40ca-a154-124bd32e25b8", "comment": "Malware payload (Mirai)", "value": "3fd4a4dfd253cba9f5583aadbc7d333a94550ae69e894e4f20abeaf3f42f0084bb1c502d2a2812bf1e06bac2e465821b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091795, "uuid": "55156901-5ff4-45b6-b7f0-4c5bd52d8e81", "value": "T1FD03F886F903CEB7D80315B012F6EF365E31F8FA1965D583E3A4EAA158924C2B503E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091795, "uuid": "fa3f1434-1ba3-419b-bf59-032e2c044583", "value": "768:XqBiY+cgYnUOXvjdU36Cy2QZUqeA9DsvKQLD9vZ:XqBiY+crUOfjq369pZU9A9o3LRvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091795, "uuid": "c1f6b0cc-57c1-4a2f-85a3-35c7ccc79db0", "value": 39696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091795, "uuid": "2ca4c6fc-26b6-44ff-a0f5-a435d94c00b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091795, "uuid": "d4540eac-47b2-48b6-b4d5-18f4d5b049c1", "value": "66b899cf2873a2fff40c4c3203cf8eb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3fe9fe-72c5-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670042830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042830, "uuid": "6e8d2da2-10b2-4398-b1a0-928d972caf6f", "comment": "Malware payload (GCleaner)", "value": "92d21b9207dde42c87165a24f41cf713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042830, "uuid": "45bc4e62-5379-4554-a090-bfbc2b4d96b1", "comment": "Malware payload (GCleaner)", "value": "8c01415e7b5299090789321ac15cfa3bf42358e691f104f6697da2aa7ddefd6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042830, "uuid": "25e6209c-1337-42f0-a33e-17dd27db76ab", "comment": "Malware payload (GCleaner)", "value": "50feaafdf59de4b1c20a4c4ad0d05f9fb8c880e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670042830, "uuid": "bc777336-9ed8-461b-9ee5-2e6020521b56", "comment": "Malware payload (GCleaner)", "value": "563bcdabbaa9369ab7b34d2abbc89cab7fda7f9460c1b32eafbb46e722f0dab07f9d60ee8fbb0969c8d8ebc56c54aa9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042830, "uuid": "bb82fa1c-cf8b-4730-b2bd-71b356abfb1a", "value": "T19D0633E4BAAE2D34D3828FB41CFD5818DD7F316718E5081A8314816BABB51E7A425F7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042830, "uuid": "a426573d-96b4-41ab-8c91-1ff5474c1186", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042830, "uuid": "74a1e09f-1ab7-4823-a579-b00a49054699", "value": "98304:Ym0L7mPJHK22yCQGTEgRtfAzlQHa40Xcyg:50L7uJq2TiJ6+Ha9Xcyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670042830, "uuid": "7a6b787b-e66c-42cc-bfb6-4232d2965b8b", "value": 3791413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670042830, "uuid": "6f194ba1-0ea9-420e-aeb0-0ba5ec693df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670042830, "uuid": "3f51d262-f66d-4e5b-9922-c8f48790c5fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a0b612-7319-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670078764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078764, "uuid": "9d968c4b-2b3f-4803-a6a9-4681a73b6a1e", "comment": "Malware payload", "value": "8a99ecf05b5285b228b60131c289b606", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078764, "uuid": "7b59fe1c-968d-4b57-9867-952a134ebb80", "comment": "Malware payload", "value": "8d0192f762385efbaced4fddc36228d67e8bdb06e41554dbefa508128f1fdc3a", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078764, "uuid": "7d87ad17-cd79-416d-ac75-1dafa58a0e05", "comment": "Malware payload", "value": "a4549ddcdb55d58c3ad6c69ebc82f53965c397ae", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078764, "uuid": "5ebc1d43-84cf-4d19-aeae-ea3eca680422", "comment": "Malware payload", "value": "acca52bf10f0f00b5e9b77bb5934a7a16f32c04841079ff534f719f3ad0255df61ca5d37c108d628bb71b2c9e394f488", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078764, "uuid": "44ee1a85-638b-4b14-8478-910b079cd1eb", "value": "T1A764B4D9B78C011E42323D6A992E91CDBB7FC1B1162054AAFD4D5B6C249482C43BBF7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078764, "uuid": "bec8e98a-5a21-4d32-9ec1-60dea714e8b3", "value": "6144:zJeV3fhXsZocf8Z5wPTdpM4mDoz1EsnFyyyHh3zOxPnS8kVLkIVfzYAK6k1PC:zJIEw4mDiTFyA6TVfMAKNZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078764, "uuid": "e1cca356-7502-446f-8945-eeb4343737aa", "value": 326488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078764, "uuid": "297c2647-024a-46ef-97b7-61b00bc14fd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078764, "uuid": "1ab7d8a7-ec09-43e8-a877-379eab051b28", "value": "lease agreement for illinois 88314.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752b0c70-7306-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670070709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070709, "uuid": "ae7e7232-13b3-4536-8a6d-0058f2495453", "comment": "Malware payload (Smoke Loader)", "value": "9df3a4118d29e4fbe2ba1ecf2dd826d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070709, "uuid": "e709c63f-b71e-4498-94ea-80b0d3000790", "comment": "Malware payload (Smoke Loader)", "value": "8ddee19166c60e1bbc1812a53aeb851a938cc7964f038da552e90a126f67b997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070709, "uuid": "b47b7f33-3884-4242-83a6-ed034ba83204", "comment": "Malware payload (Smoke Loader)", "value": "2936e45e71223763bc9a0b3ddb4ade08adb0f9c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070709, "uuid": "1b761685-e224-4426-bcc7-1c1853aa7ca1", "comment": "Malware payload (Smoke Loader)", "value": "062e9ba4cecf0db684c27a9048ce35940e6de5e5f9be8ecccb7e2c5d57a5964ca92bc39d9ca1d3e4397246c45be57b6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070709, "uuid": "da00e7e8-2dbc-4327-a324-fddf3e206f1e", "value": "T19374D13136B0D83EC25304718466DBA0AEBFB9325DA199C733952BAE5F303D18A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070709, "uuid": "4aee7999-9535-4ca5-82ec-fd80a967e5a7", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070709, "uuid": "c45b9cb2-155c-4615-aa32-b8e53ea1e388", "value": "6144:uqt4ZArK6KXroKEWLQb5VqnMW2RqnL6OdriY:uqiZArP6roKEcQkMW3XdGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670070709, "uuid": "12e06852-473c-4e88-a123-45c636f113bd", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670070709, "uuid": "bcd50337-0a76-4110-af4b-3f6520c9b1ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070709, "uuid": "b12e37ab-9874-4904-9269-ed4f079ae717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6ecc9f-7351-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670103097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670103097, "uuid": "e256d3f3-33aa-4de8-9c23-220488a2454c", "comment": "Malware payload", "value": "3c4f62e575eee7954b28d9195a1867b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670103097, "uuid": "d0f8280e-b484-4113-9aca-caf949abe2a0", "comment": "Malware payload", "value": "8e4d60fbedd0fda50ffe79d2ad1831790d0258d2d421acb942100e40d2ae0253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670103097, "uuid": "196a1474-57ac-4745-8d86-30dd96561d64", "comment": "Malware payload", "value": "74fe05ba5b7767e2df691cd5d8a8528cc860e724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670103097, "uuid": "47dae824-08fc-4ea3-9ce1-a2b1a106b5fd", "comment": "Malware payload", "value": "2528b88d32d80856964e9eca98b203f7363aae6f82e1f1e2275a917a766f14c320a4518b01f99b7be4d73772a09d35b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670103097, "uuid": "fd15c7a0-7bc8-457a-8a87-fc408b8efb9e", "value": "T194F53339DDBF757CC096C2B4AD71D6244C5133063C3DD752AEE96A383E332AA144B6A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670103097, "uuid": "cdb1b3b6-795e-42b5-9372-c9181c7aaf22", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670103097, "uuid": "71113aa7-9579-4a7e-8b30-8671ed9e8e7c", "value": "98304:IX3/na2FU1sDpkVZwEUtBmuJsWTftRozfJ2PAEqSldBv/yFXcy5:4fDcsDuwqRdU9qikFXcy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670103097, "uuid": "7c5c3b0d-98fb-4dd1-8a7d-cdd58bf98e5d", "value": 3593152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670103097, "uuid": "147032bc-e813-4517-b208-7ff90c88e319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670103097, "uuid": "142d6628-4dc0-4d2a-9c0c-7d512f6b528d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8827814e-7329-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670085773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085773, "uuid": "32ee3337-7660-4afa-8d85-4cb94f10d897", "comment": "Malware payload (Smoke Loader)", "value": "e350280cf08ca9be35b090f1d5e17c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085773, "uuid": "38e851f4-b287-4cd0-a1d3-0e34c57f2914", "comment": "Malware payload (Smoke Loader)", "value": "8e76280042c43a409b762b8df22319d8aac5cef2836d0d894915d4dfb3e7ffad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085773, "uuid": "af242417-d179-409c-94a2-2daf5fa2b3d3", "comment": "Malware payload (Smoke Loader)", "value": "11395c6a8732b0e318c8b43638e3e055d6a9bd94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085773, "uuid": "472297b2-6ef3-4fe9-8fa0-7c372af0502d", "comment": "Malware payload (Smoke Loader)", "value": "68157695be024f4888e55c3e7a579f476c99483db673d3f6c5d53a20bacbb893f0423f326983ef370c0b7cf0b584a407", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085773, "uuid": "4732e7af-13cb-46b3-93df-0027d97df39d", "value": "T11974E03176B0D471C69FC4368456DBA0DA3FB922ACA4A9C727792B6E5E303D1477230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085773, "uuid": "8deeebef-8970-4e7f-9a58-e5a9d88d833b", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085773, "uuid": "9357f24e-f014-464f-a446-205e9a71ad16", "value": "6144:B6+LAne2Rar5TZz6wYoy3bnnMW2RqnvNXcxY:B60AnlR8Zz5LonMW3vEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670085773, "uuid": "5cf3b910-9917-4a70-878a-8bb1ce7d1a39", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670085773, "uuid": "46571637-fc0b-4ff7-9096-77bc208e7264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085773, "uuid": "8ff6af10-8083-47c4-847f-cde187192c07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea1703a-72a8-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670030459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030459, "uuid": "95b437a8-a06b-4c4e-9cbe-1af320267e40", "comment": "Malware payload (Amadey)", "value": "df1e365d58ca7859bd2df4e0a3d59345", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030459, "uuid": "9f3b7232-eb18-4713-b045-3999f57afd3d", "comment": "Malware payload (Amadey)", "value": "8ed223a60faad53e4c22eb17e2bf485262e3758fc0543b589ee65fe736c9eaab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030459, "uuid": "76c8102b-0415-463d-af25-7c8a321eabae", "comment": "Malware payload (Amadey)", "value": "733ee27d95def31827d378a62cdbed153b52dad2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030459, "uuid": "9c84a5a4-ec4a-44d0-8be6-3b38d74ce6f7", "comment": "Malware payload (Amadey)", "value": "4559729c3df0bdfb9a6f74d44fccc9183dd4001279eb2e4b156ed1fe1d9c1e480ff2c4483d82dabc88580cfede935009", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030459, "uuid": "342d8f72-bee6-49a0-9da8-318e2eb32521", "value": "T1B784D010F7A0C876C18705FD8915EBA8AA3DA4325A21E94F37A42E5F5E332E156733C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030459, "uuid": "19a11e1a-5876-4caa-9fcd-a8abc50d9358", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030459, "uuid": "3e110a39-5d3b-46fd-8314-f85661babb0d", "value": "6144:cGOIjxLN8u5EcR6kW41BmHsEyd6l5tYGnq9juR1iejH:cH6xx5EwW41BmXyd6lG9iRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670030459, "uuid": "2c6dae74-f521-414e-b561-9f83d88abd1f", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670030459, "uuid": "f59d3c66-d346-430c-8a46-8bdbb522118f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030459, "uuid": "d059f125-59e0-4d40-b040-7eae48842c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523eddb8-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670044021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044021, "uuid": "547f453d-7d38-4733-a2c5-82e8deafe1a2", "comment": "Malware payload (Smoke Loader)", "value": "f9a9272b80382b2f1d24c8bcdbf5e8c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044021, "uuid": "04df1eef-f396-46c5-b1eb-38703aef3940", "comment": "Malware payload (Smoke Loader)", "value": "8f32ace2f9decc7c209d6d247cf16734173a4da2a0322cd11a6ac81744289a17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044021, "uuid": "6dd09964-49ff-4245-815f-41ce3e953e09", "comment": "Malware payload (Smoke Loader)", "value": "dd82a1fe23f26dc105e0d833b11a3781485329aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044021, "uuid": "d6f8061d-ebca-4851-9d6d-e88404629497", "comment": "Malware payload (Smoke Loader)", "value": "96e5bf04676b4bdae23caa421dfac85e77c8f3802d57d7cd19313416905d80ccb1f554cec5c860ec58a7219d4a147360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044021, "uuid": "06ed5bfe-8581-4267-859c-4047ce1ad961", "value": "T11074D010F990C836C58205FC4925DBACAA7EA8715665D64F33A83E2F9E332D196733C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044021, "uuid": "e6a15924-5356-4ff3-978e-90ea811a19fe", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044021, "uuid": "adcd87e2-ca33-45c1-a54a-edb0fac5f4c6", "value": "6144:NX8hIyKLv8L4BcROZczhMfBGodXl+wcuRy7CExjp:N+7K64BfZUoldc+RSrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044021, "uuid": "7aa17d20-3f3e-4545-b756-72efe1e817c9", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044021, "uuid": "249ab44d-7334-40ab-b8db-54ca53a633f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044021, "uuid": "8dd7ba1e-1e42-4c4c-99fd-f9c56b27dc65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c182f95-72f8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670064734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064734, "uuid": "a0ba6abc-ca71-442d-885e-e501ae95424f", "comment": "Malware payload", "value": "e68686b15d66406329d43944442f183e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064734, "uuid": "8e586117-effe-4aff-b8d9-bcd966627ebd", "comment": "Malware payload", "value": "8f7694019c035056f15897bfab4ea96134ce53f3003d62b1634732a9606504da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064734, "uuid": "a3cedce7-f697-41a2-99fd-e5901b146ad7", "comment": "Malware payload", "value": "adac653a21b72b016478c888bed6abad06db13bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670064734, "uuid": "3121100c-bbbb-4c94-8c0c-0ef413b4e209", "comment": "Malware payload", "value": "50ed184b175cb6183b703e0d38b4022dcf520f69c22b8b120b3c8d94ce2fdd4292a36ec905a94e3d95decec5f1ea777e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064734, "uuid": "54f36dc4-e10d-4e09-a475-82778852c9a6", "value": "T19276335279D18BF9DDC78031EE74AE68355AC73AC62094BB8B64E56E34FCA05B313603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064734, "uuid": "029f1095-bd3a-4aea-ad66-011f498372a3", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064734, "uuid": "e37ea19e-0182-45d3-bcc8-068248fe8024", "value": "196608:91OUH9EAzmDHAA3Nj7hKMIWd2+k+73ON0cYdFjbgrYD6NXbjf:3O+ZzQHA8dcMbCoRxbgrYeNrjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670064734, "uuid": "ca03f179-8909-4fca-8066-570ad140a451", "value": 7628415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670064734, "uuid": "a64ed983-6897-4525-b2ae-fc9c53418b2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670064734, "uuid": "66b6f3bb-2091-481c-bdc0-a9b3dc835737", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34c59ea-7329-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670085953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085953, "uuid": "eec4ceba-c52c-4143-8ea0-87228af88644", "comment": "Malware payload (Mirai)", "value": "2ddaf722da9c50b6321de21fe5efc1f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085953, "uuid": "353d9ad5-127c-41fa-a08d-37d00cd79908", "comment": "Malware payload (Mirai)", "value": "8f7e857b3ee0f63c4ddf1bd6fa31b3677c85e35f286a50a41d615a7a1e6f9461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085953, "uuid": "f5444ecf-7355-4178-affd-d6d87bb7885d", "comment": "Malware payload (Mirai)", "value": "69fb75cf705e2b0f57deffa4b4eda1386e3f8f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085953, "uuid": "0ea6f03c-fbf1-4604-a299-cd5d888f7295", "comment": "Malware payload (Mirai)", "value": "23df79e38acf489f66cd0f2f99961ba09ea79f04adfd63f72d18fdd32b2fc308277e88bc20c42f1591f2b674547db5c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085953, "uuid": "ee8b46bd-ed34-4eca-9ce5-eba74a7132c0", "value": "T178D2E17517448C71EE848639AC7C8345631765A2D1FD33622A400B1EE2931DCDEFFDAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085953, "uuid": "484bd3ab-b09d-4e5d-8a96-cd7dbd93b2b1", "value": "768:ItFPMu43+Knj412MjX2YNoTdv0Wt4B1lkrb6s3UozO:ID0uwqxkTN0l+rrzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670085953, "uuid": "bbb4e3d9-b820-41fd-be5c-90028e168ffd", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670085953, "uuid": "f817abd9-884d-4b93-846e-f1dbddea02a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085953, "uuid": "a39f56d4-7815-45f3-b3a7-eecfa39b78e3", "value": "2ddaf722da9c50b6321de21fe5efc1f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ee34f3-72ad-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670032406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032406, "uuid": "ae834da4-a8bd-4f92-888a-ac54e5ec9bf3", "comment": "Malware payload (Amadey)", "value": "0f55496aa73713b80ef1b60aa79a773e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032406, "uuid": "7db3dfcd-d5ab-40da-bfd0-e6fe9cfac581", "comment": "Malware payload (Amadey)", "value": "913ea954551a8fe340cc4c33c3d7b219ac53b9eb62f308cb2a9333dbc296def0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032406, "uuid": "05c2b3d4-1299-415a-9543-3cc63caaf4d2", "comment": "Malware payload (Amadey)", "value": "2138dcc5c303d5dc5ac0fbb2861f68ac8fbfc4c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032406, "uuid": "174639d6-3e7b-4e6c-80f8-f6d4e7bd69e3", "comment": "Malware payload (Amadey)", "value": "9a94850ebd10ef8bd8202449aca07dd2e90ec6379c3f91780281b25e64f3b41ce624e921445a3a2270854376129b0d69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032406, "uuid": "fd769386-1322-4ffb-99db-36127e97dcff", "value": "T14784E010F5F0C576C69205FC8866DBACAA3DA9326515C84F37A76E2E1E333D192263D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032406, "uuid": "67a89d73-a4e4-4663-8dc1-e08673eec261", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032406, "uuid": "408517ef-8fe3-4718-bb8e-0e6fd1624a96", "value": "6144:CGOIjxLN8u5EcRWNhZ/oGLcr3ap+SBrzo5H7xzuRdAjH:CH6xx5ElQG2ap+SZOH7MRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670032406, "uuid": "a96cc2e1-3891-4645-aa0f-e3b2d076fa1e", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670032406, "uuid": "4849170a-e400-4410-9460-3db6d1163a8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032406, "uuid": "58d7418c-d1f9-4832-9f54-ba55464585da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cda647-731f-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670081469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081469, "uuid": "1dc9e201-0b6a-4b00-9619-5404331ad18d", "comment": "Malware payload (GCleaner)", "value": "2cd0c08c4ae3a9d0b9a0479f54bb7866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081469, "uuid": "12dbd047-fee8-4659-b253-237a9bb207fb", "comment": "Malware payload (GCleaner)", "value": "914309fde7871041da22c8fd076e77ff95ee3f90633e720644273d890dfdc086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081469, "uuid": "6d3ef084-c2c0-496f-99c7-77f85b63ec63", "comment": "Malware payload (GCleaner)", "value": "e063d6de5d46dfb6d8d90f17d252a2540d53b20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670081469, "uuid": "52d2f162-1a16-4e90-a0ef-140ff3518a57", "comment": "Malware payload (GCleaner)", "value": "26769758ab315aec3183862e02ab3c493a13bef49ad0ffbb25c84ceb38e242b72ff91914deacf21fc15800029040531c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081469, "uuid": "5c99aadc-db2e-4e10-b281-08ae6802cbf0", "value": "T1E4F53363D1CE4836E48356BA5DE78478D95BB549AC89E4C630B30D10AB37DCF2885BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081469, "uuid": "2bfe5eab-e8d2-4a73-bb7f-ad8af3f91300", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081469, "uuid": "dcc96cea-538b-4082-901c-31dea050988b", "value": "98304:ofKAZdB9LbJig1qGgPbM7BDF1xsrCNXcy4:dADXJ11qGgPEpF1xsGNXcy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670081469, "uuid": "d3d2c280-5c77-425a-a9b4-50ea23ee86a8", "value": 3604029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670081469, "uuid": "8ebdeac4-2073-452f-b2e4-eeef984a43ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670081469, "uuid": "bfd6758a-adf7-44ab-885c-94264634d485", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0938ac1d-72d5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670049482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049482, "uuid": "9f9b980d-d0c8-43db-a00b-35fa7cb2b215", "comment": "Malware payload (Smoke Loader)", "value": "59eb8c37ccec98b2b1c319ea6d1dbbd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049482, "uuid": "8be8bf63-9919-49e6-b9f3-6aec591d21ce", "comment": "Malware payload (Smoke Loader)", "value": "9147979526a2bcdb89c4eef2a3e197c8e242a1cdc4552e9edc90fdf670f38a25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049482, "uuid": "40531437-489e-4656-ac90-fdc2f9d7b7fd", "comment": "Malware payload (Smoke Loader)", "value": "2c0f30b9ae9ac797fa9e5c3e15db35eeeadd009a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049482, "uuid": "6ae5523c-861a-46d0-ae0e-a58092e2d329", "comment": "Malware payload (Smoke Loader)", "value": "97e87125bf07e5273087af32290100915a9556aad61d312ac674b16845e66f01ee5d8b79b6aba84490f502072ea913d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049482, "uuid": "cad79e73-fa00-4777-a600-7223bd0165d7", "value": "T14E74D010F591C872C34201FD8816DBA9AA7DA9315625D90F37642F6EAE333F292733D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049482, "uuid": "accdd0f0-7106-4ef4-ba8d-01971a111124", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049482, "uuid": "9de52327-fe57-491e-b65d-776e4aec8bc5", "value": "6144:JvmIn8Ll82pUcRPGb9GPYq7IezqmmpBR4FnuRjk6Bj8:Jue8JpU+GQgq7tzqhPmuR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049482, "uuid": "e2b7fca9-6cba-4035-96b2-378bfe024302", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049482, "uuid": "c8b7e06c-8eb3-458b-bfd5-32af212bedad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049482, "uuid": "99472a94-7c57-453d-afb7-d8cad9786d6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1877c3-72cd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670046155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046155, "uuid": "69bfb41d-8d4c-478e-98b6-26340285be5b", "comment": "Malware payload (Amadey)", "value": "2e2e1e5ad4702fca8776181bbd6674f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046155, "uuid": "994675e5-2474-4557-a9cc-d118ffcc4213", "comment": "Malware payload (Amadey)", "value": "927e36f189be37924609af4b64090596df55e06cb73e6fac42f84340964d7992", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046155, "uuid": "abe091ea-6cfc-4ecc-98ab-83e715b1b143", "comment": "Malware payload (Amadey)", "value": "9ec6ce2ab926d3da3b23d9de1cd67dc979acbe5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670046155, "uuid": "985c123a-6d5f-4814-96bd-ed9e54b922ae", "comment": "Malware payload (Amadey)", "value": "cfc0319589c203e5a17553428126c7ae5862aec36302e4b768b9ae7b74f4bdbc23d346b5cb3226dfcd74c8f9018dcefe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046155, "uuid": "cf3fc398-02ec-4cc5-8791-6b524f9f87ca", "value": "T18D84E010F991D436C6850DFC8816DB68EA7DB8322665D80E37646F6E9E333E186723C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046155, "uuid": "8863e596-0911-4235-b6e7-741465c47535", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046155, "uuid": "1ae0652b-e56b-4223-9054-255aa0be1d87", "value": "6144:x8bI95Lb8mnIcR7/cvh1jteaKLdllj1zfuRDbykj8:x8M5HnImK1RxKL7lj1z2RL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670046155, "uuid": "0dd814f3-e5db-4296-8aa2-e3a3cd3f775a", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670046155, "uuid": "cf241971-aff4-4e05-bb81-132a00891024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670046155, "uuid": "dd6dd052-15b5-4476-924c-05bb71ccccd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5776ae40-7319-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670078819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078819, "uuid": "8234168c-f011-4bc3-8b3a-f99ab8745656", "comment": "Malware payload (Smoke Loader)", "value": "330014cea71c9c253dcb0af7edb3eb01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078819, "uuid": "839487be-3d35-4eb1-9096-dc4857439584", "comment": "Malware payload (Smoke Loader)", "value": "9339c29dc4ad5365ad08092016043074c019a9971be8144f4db7e864dd6dad11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078819, "uuid": "0053e099-38b3-4326-a632-6daee4b163f8", "comment": "Malware payload (Smoke Loader)", "value": "5e1167a9d0d6a2bbecaa2357b001cb20eb092784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078819, "uuid": "255e8ad3-a87b-4ddd-848a-b15021be7047", "comment": "Malware payload (Smoke Loader)", "value": "60e62d4e5f7495d7dbdb3f06dd73d107a9eb8bd12d41565de3564e2f6b5f7a9524ed057d968a0326ecc9df97e125bcd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078819, "uuid": "57e3212d-db1a-441a-96ec-d88580e516be", "value": "T1DC74D03036B1D476C563057094A6FBA19E7FF83159A09ACB336A275E9E303E18B72347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078819, "uuid": "a17dffc4-859a-442e-bb11-19f6cd25370b", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078819, "uuid": "c75b5052-2876-4922-994c-e543be519e53", "value": "6144:T/V+aAOKEMmIcG94r2vRLVdSnMW2RqnPFY:T/QaAOvMmIl4r2vRLIMW3NY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078819, "uuid": "0037e924-426c-4199-87d6-1c29f8a1838e", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078819, "uuid": "16f56f2d-db74-4a09-acd6-afe69631e3f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078819, "uuid": "d92cadc5-0938-4783-93e2-b42119944ee7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fb9da0-730c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670073128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073128, "uuid": "677ba22b-9bef-4c72-88a5-fcf8a6d32a5d", "comment": "Malware payload", "value": "2cdfed365b93cff694d4e09dc6fb2624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073128, "uuid": "c909face-124d-4360-8f94-6b042e6770f1", "comment": "Malware payload", "value": "93833f40ed30cfe9e8e07fd69a156ccacce1d642a8fa93fe36a695d0789975ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073128, "uuid": "67c6e861-b620-4bb1-8a88-bcacd206aa69", "comment": "Malware payload", "value": "7b35895249ec3acee5eabc162a4f39dd84c88351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073128, "uuid": "03c8d45c-4abf-46d4-ac5e-3bb988a7085b", "comment": "Malware payload", "value": "9cd4fea0df710d2ddaaea34298c2c4977ffdded5081595d9e11d54df2e221a078e7b0597d05b41fc59e3158114c8e646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073128, "uuid": "f71e4acf-b26d-4992-849a-e566c59c74c0", "value": "T1A2763333BED68070D1514631CEA83FD8C56B867809359C73979AC32D4DFF9B28B168A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073128, "uuid": "6bdfd054-abc6-4084-8d47-f46a1b0f98fc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073128, "uuid": "ec1af0bf-7996-404a-bf96-17f3a899a8a7", "value": "196608:91ObYZci/+7g9ITy4IOsrxO1Msz4uhV7e65vgB1:3O8ci/6gyTybOKxOOLo7j5vs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670073128, "uuid": "5919ff34-6ae7-4075-8808-bffe59f38000", "value": 7590447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670073128, "uuid": "813a1aae-f1a1-456f-8348-f525d2aae5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073128, "uuid": "6c667f9b-9823-427f-adb5-1850cec7b2b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a4021c-7318-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670078336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078336, "uuid": "c29f6e97-3876-4863-a97b-379b95e0ea2f", "comment": "Malware payload (CoinMiner)", "value": "8d2869ea08633e1625290032e36987e9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078336, "uuid": "4784500b-1b2d-4488-9a0a-45810c09d04a", "comment": "Malware payload (CoinMiner)", "value": "93d1f15549e14a86dcb8e887e9dd8dced9236cc8c3ff48af384374f98ff9eea7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078336, "uuid": "0bf46a33-5fce-4a7f-9d64-c683abb1e85f", "comment": "Malware payload (CoinMiner)", "value": "c2ef9793113ab8bb2185d918284148499acbfac5", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078336, "uuid": "c3ab5ae1-708a-46e1-95be-06625f337ffb", "comment": "Malware payload (CoinMiner)", "value": "74a3f669ffa53eab79cea4729de91424277d56f4f0307227f90ccbf74a346acd4b56643dd554de69af6f9be015e39cda", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078336, "uuid": "5c431a5c-1a50-4d56-b359-556862e075e9", "value": "T15F05C04076E9B618F0A739F44FA6C3A78633FCE44561861B3F38320B5A759424F6663E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078336, "uuid": "13d61fce-7d67-4370-8e95-1664931ab439", "value": "6191f8f4f204bb34405f930cbf742587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078336, "uuid": "97c5b7e0-b84e-4131-9dff-4e9b0c97081c", "value": "12288:er7EAxBmNzFLrWY5SWUWoLS+OpB+pAJobBgrNQ3kbO6PIqcSOt:QoBrWYlb4ujobBUakyyIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078336, "uuid": "7df178d8-50da-4e38-974b-b6dd784384b6", "value": 829720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078336, "uuid": "4a63d7ce-ae09-401f-9593-d9b50b29fe9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078336, "uuid": "7761301a-7912-4827-9e8b-01d28d137490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ab0f3d-7351-11ed-9266-42010a9c0072", "comment": "Malware payload (NetWire)", "timestamp": 1670102870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102870, "uuid": "1512523f-2431-4783-bb6c-b7b24cb9fe2b", "comment": "Malware payload (NetWire)", "value": "a2a0aa207be61aa7629ec65e93107316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102870, "uuid": "86dbe74f-afce-4030-b1cd-0a30f94ba5fe", "comment": "Malware payload (NetWire)", "value": "93e9e0b438bfaa0c8c140019adb0f683d7c9cf068b900fe9ce3ee319daa4071a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102870, "uuid": "a9d061b0-95f9-4447-b6f3-e3d23f3d353f", "comment": "Malware payload (NetWire)", "value": "f3a582a9aff6e53d7746d6a4ee91dfe7f7ccdb76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102870, "uuid": "1e776845-6a70-47fa-8053-7b830ff7962e", "comment": "Malware payload (NetWire)", "value": "6e4c92bdef904d17e2c528f7f333259bc70a34eb914536c31ead28b1c5abecb64397f9fcad220a09140f6099d02d4803", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102870, "uuid": "c5e504a9-4aab-407b-acf9-69cb936a820a", "value": "T1E7D4124C27D94754CCAA57B5F85050EC1F327C85AE02CADFAAC731A7693AB7CA211783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102870, "uuid": "27f255ad-1e9c-4d2e-aee3-f94c9df20873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102870, "uuid": "3daaf372-4728-441e-b0b3-a3d8009a6d79", "value": "12288:jwciJ0Bke2A0uI+87nj9UsG2P5xFfPtIgQQoz0hR2H9jq:60S5AdIvj91B5xF3aZ54hRE9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670102870, "uuid": "69b54a00-0c36-41d2-a536-508cdb2a510b", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670102870, "uuid": "81e3cdb4-441a-4c6c-ad25-a9a45a34c208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102870, "uuid": "229d1850-c983-4139-9019-b18608d34056", "value": "SecuriteInfo.com.Trojan.PackedNET.389.7639.31497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8710e1-734f-11ed-9266-42010a9c0072", "comment": "Malware payload (a310Logger)", "timestamp": 1670102287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102287, "uuid": "a60fd142-b7d4-4ea8-bd03-9544bc66b6f9", "comment": "Malware payload (a310Logger)", "value": "fea929b9b964865249f8d39f8b432a53", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102287, "uuid": "943b07cd-6357-4813-b000-5c26a2a6286d", "comment": "Malware payload (a310Logger)", "value": "949ce457953cd74abad14b375a79dd0d2d6f80d08868adc55b2ba40cd363cb80", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102287, "uuid": "b5e601a8-71e1-4811-aac0-c1397d64b059", "comment": "Malware payload (a310Logger)", "value": "74c96fc0fdda4654cd9cb482a136e72bc5e0d8a3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102287, "uuid": "5904c268-87af-4776-8cb3-4e497e1ec9f0", "comment": "Malware payload (a310Logger)", "value": "f1a5e3184101578ef5377d6545bc5683dc9f8f64f8d43dd24230bf70639e7163bc15560298c25d1a3fd6a41c2340fa95", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102287, "uuid": "89900d69-f976-4018-b905-18c43e79dfc9", "value": "T195459D62C7B1C906F93385FDA6EC5B5149A810C148A88849CC573EC05E78DABF5FC9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102287, "uuid": "ac56125e-cf4b-4b97-9e36-409286b059a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102287, "uuid": "7bc6ca79-7478-4439-b07a-eed9d81cbb95", "value": "24576:PDqZRqOIRqOTM4aLcUNoqDTStiyY1XV3IiSfLwcTiwAAgEEY4:PRMrZvT1XV4iS0cTQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670102287, "uuid": "b676a589-8388-48d7-bb3b-19aae1fd9bc1", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670102287, "uuid": "ff9b7699-a2c7-4e25-928a-fe2d7ee2c21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102287, "uuid": "3faf8400-858f-4a8a-aaeb-81fe275f47ac", "value": "ekstre_2212010064088700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc47f1c-72f3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670062722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062722, "uuid": "4890d257-b9f2-42d5-863d-4272c49af9a7", "comment": "Malware payload (Smoke Loader)", "value": "3a8476afa7540e1b712059b2d95a802e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062722, "uuid": "c7eecd83-ab32-4df1-a99f-c2bedb22754d", "comment": "Malware payload (Smoke Loader)", "value": "9514c23367d8432f72b33abc7e5fd67f1afa7fc503dbffa603b19e7473e0f4a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062722, "uuid": "66fcc750-d0fa-4678-9bd1-67179ed3721d", "comment": "Malware payload (Smoke Loader)", "value": "72d3d9d5179c9e585b0787451b24fa4633979c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670062722, "uuid": "10057b96-a68b-4f25-a496-22052687b1c7", "comment": "Malware payload (Smoke Loader)", "value": "b920ab184a95dd0e90891d27d2ca02ef994de37ee1cb1c7d294dab45b85eea84b80e6734a12ba76b9b7d1f53b882e342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062722, "uuid": "3c33e8ec-ae26-49d8-b501-60651500efae", "value": "T11874D03436B0E87AC55348718416EFA49E7FB9329EA18AC3336956EE5E303D18776307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062722, "uuid": "a2e60bfd-8bef-437d-8d24-c76f1b5c89f1", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062722, "uuid": "12e0e0ee-cfdd-4e4d-9f7a-bbcabb36cbfc", "value": "6144:Os62jAretrccVrOwcanG2nMW2Rqnp1jYo:Os9jArAAKOwagMW3p1jYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670062722, "uuid": "f735ede2-2bf8-4baf-b359-e813653cecf8", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670062722, "uuid": "14c1f6e8-493c-4917-a380-6b91264a7429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670062722, "uuid": "8a261a28-21cf-4da1-b51f-13ad136b8dfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8521089f-72c9-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670044536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044536, "uuid": "7c3fad22-6426-4054-b582-09b26795d5d4", "comment": "Malware payload (Smoke Loader)", "value": "5cd966eae2ae96635b31169efbf801f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044536, "uuid": "b8f31025-8a70-4316-88e9-12728651db80", "comment": "Malware payload (Smoke Loader)", "value": "9681cda5295527ec0fd75d27f49f484d864d2c884134f30d297958a013c10d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044536, "uuid": "21b87e53-aaa4-4c7f-9c51-04351e12e1b3", "comment": "Malware payload (Smoke Loader)", "value": "77965ee4b6f0260ef5d28ef62d0935b633e87ea9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044536, "uuid": "1044143a-e26d-4b36-8d1f-6d3cac37b3e3", "comment": "Malware payload (Smoke Loader)", "value": "cf7141b842aba73a49059164597220833488f0ed8fe1bd617fcd98a7e7f5f536a76405aed9ad03089ca3693721d38f96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044536, "uuid": "b615e6bb-585a-4866-8e81-d30ed7e556d4", "value": "T1EC74E051F691C972C55304F88866DBA8AB6DA8715A20D90F37682E3E5F333D1923B3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044536, "uuid": "b5421131-d608-4f35-bbfa-d2fc5da1ed54", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044536, "uuid": "ce234edb-85f5-48ba-84ff-748f3fdc90b5", "value": "6144:1x5IStLC8eLccRDv9v3Mi+sc153NuINmuR4RkZj8:1fbtkLcIVci+scQM3R4k5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044536, "uuid": "b4228cbe-8579-49df-ad47-77dd7df60e49", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044536, "uuid": "d42a508f-8a55-45ac-8a44-6ca7e80c3d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044536, "uuid": "2ce16fba-b174-468d-92fe-1ffe9ae3b271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960d3be2-72fc-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670066469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066469, "uuid": "6dad9596-f770-4afc-8dc9-28876497c55e", "comment": "Malware payload (Smoke Loader)", "value": "9cc374d3a5ca21b731285faa3cd1e73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066469, "uuid": "d029196c-ce32-4f21-a0b4-5c4f539c76a3", "comment": "Malware payload (Smoke Loader)", "value": "969941b6a2d44a835a18728a924859472cd4b81e485d48b4568110a89d91dd7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066469, "uuid": "3935c253-0c06-4057-8297-236fd9b0d9d1", "comment": "Malware payload (Smoke Loader)", "value": "fd753bb1cb6f19bac74cb4e2ebd39ab575f59f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670066469, "uuid": "5e7596c7-3745-4f18-a6df-6609fcc512d9", "comment": "Malware payload (Smoke Loader)", "value": "5c1ae90131816564baef144e885eadee6789766700ae4db608afcb9d6556bf9a61e4372e32e77b30933604df0cc9957b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066469, "uuid": "32090983-28ac-4889-9b52-598614eb0889", "value": "T1CD74DF3176B0D872C59304704466EBA0AE3FF83259B4D9C337692B6E5E30BD29B66347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066469, "uuid": "1e98bdff-1b0b-4bf6-9156-01f4cb5b1529", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066469, "uuid": "686a7c40-d41b-47ef-a936-049229c032e1", "value": "6144:v+ixgA+eqfTuRbOxzxySQqynMW2RqnuDEOyiYo:v+ygA+zu5Ox1lQqUMW3uKiYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670066469, "uuid": "85a3cd66-6a97-4fad-9164-3c8df5101bde", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670066469, "uuid": "a3abf9a1-58ed-4d14-a01c-dab19c8b9cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670066469, "uuid": "b878ecac-b083-4263-b39b-51364a9653ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29076733-7332-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670089479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089479, "uuid": "f126efc3-d724-42cf-9b4d-5519d5456cfd", "comment": "Malware payload (Smoke Loader)", "value": "f5c288d46b24ede2f47a7e03f28be4f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089479, "uuid": "03b0a479-4d33-4f4f-a422-27eba8a3914b", "comment": "Malware payload (Smoke Loader)", "value": "9786cace7f090e33f0cecfcf58449954ffca97a9279d7ce3e0d86eb536539233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089479, "uuid": "5439b050-8a0b-4175-91c5-3645c856fa85", "comment": "Malware payload (Smoke Loader)", "value": "d76c725769759efdd3c65d681ee77852a33cd0f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089479, "uuid": "b8787b53-ceea-47ec-bc43-38eb80b38ff6", "comment": "Malware payload (Smoke Loader)", "value": "559fdac67090c583a984b098981f8bed5efcc25f9710d8ef12a4636705acb02693c36dea3f5b929600f2c55a7058281b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089479, "uuid": "1e0d9949-41ce-4f37-9f7a-e23baff9103e", "value": "T1E374D03535B4D472C6520B70587ADFA0AE7FB93258A099CB27652B2E5F303C29B36347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089479, "uuid": "9e64d98d-af63-44ca-b86d-9cff05070080", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089479, "uuid": "a7a719e1-6ed5-4cbc-b274-a87b9396dc5f", "value": "3072:0wFjrD5nfI5Aeigazv9ukTWf/Ca2seEE0WkGnWNTC6NRMHnlXptFhQ3HYDrEmU:5rtnf5/Z9ub/Zd3E0InMW2RqnCXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670089479, "uuid": "f716d30e-b9f1-448b-8484-02f487642b7b", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670089479, "uuid": "43eccfd9-d4ae-43e5-be98-e04eae151df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089479, "uuid": "49b4fc9d-1219-497f-93f2-fcb5cf865291", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea136257-72b0-11ed-9266-42010a9c0072", "comment": "Malware payload (AgentTesla)", "timestamp": 1670033968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033968, "uuid": "762f8daf-694b-485c-9246-aa788d7c43f6", "comment": "Malware payload (AgentTesla)", "value": "463a81fbfbca4cf281d7f58730a8067b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033968, "uuid": "23544950-bdbe-49d7-b960-6a4c7c8079de", "comment": "Malware payload (AgentTesla)", "value": "9796b66297042ac5d8a1610afa233c9dd98ac5e6d514015a8a917a85a4474de0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033968, "uuid": "d3eed643-986f-40ae-835d-89dadf992a48", "comment": "Malware payload (AgentTesla)", "value": "ee47e681f71f612885d84a72e4cd7ef7dca86606", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033968, "uuid": "6b697d7e-18eb-4d7b-9561-9753d82ed8d6", "comment": "Malware payload (AgentTesla)", "value": "59122b429729b63edd83bef0cc2ff2fed41bcdc6ca2a5cc3e06eb588df569d6898c483dae087d439f12e6f0dab528155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033968, "uuid": "296daf9f-d79d-49af-a104-a17133443ef8", "value": "T149158D9533728873F58F01358095768D6EBCA143A2E6F2076B763A8156027FFFA9CE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033968, "uuid": "4be742a9-e267-4d41-887b-d6aaa01e821f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033968, "uuid": "e2064af2-e5ac-4f7c-9bc0-d00a65a38602", "value": "24576:X6Ls156Up2vLU9/L1tI8vQy/BkRQepAIn:Xus15d/L1tIIQk3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670033968, "uuid": "2ad65e06-1cb0-41d4-b94f-25f6801ac8f6", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670033968, "uuid": "864964b1-37b5-44d8-a011-10b103c87b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033968, "uuid": "c72f0fb4-e8da-45af-8d65-1442b6d41229", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8f59ca-72a7-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670030110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030110, "uuid": "f4c9d321-7140-4c9d-8034-12c707b81722", "comment": "Malware payload (Smoke Loader)", "value": "20842eae6f7a98f5e4987a27b05c9c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030110, "uuid": "81357581-7960-4f33-a600-587af634b45f", "comment": "Malware payload (Smoke Loader)", "value": "982ce844285349ed672a22af69e1122d2093f4498d3d41e2776d8a4f79a0bbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030110, "uuid": "5aac1390-9b89-4364-b36f-4e03bdf1e6d2", "comment": "Malware payload (Smoke Loader)", "value": "6cd15b802551cc353fad0b113a2c74d6b3af26cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030110, "uuid": "3c10f315-20e0-4f38-964b-9892ab217df3", "comment": "Malware payload (Smoke Loader)", "value": "35be6d827cd4e2e5d8e0df4e9c18f4dbbaa64d69b6a5df81ec6b65bf6927af71c7c78f268ff6fb638568d47e5e63c392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030110, "uuid": "6f4d33b7-bd01-45db-bc9a-102918cb6695", "value": "T15F74D001F5A0CC76C5D204FC8912EBA89E7DA8315A67C58F33686E5E7E332D196723C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030110, "uuid": "c9fd668c-7cba-47cb-b00d-579434b03a56", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030110, "uuid": "3f15e7ec-be85-4023-8744-33270fca4a07", "value": "6144:JDzI5jL/8inYcR/NrxCpsMGNqPT/YxuRCPJMjH:JX4jDnYoNlCpEsR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670030110, "uuid": "f0c9162c-9b85-45d6-9ed5-8a9e56629ee3", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670030110, "uuid": "2222a5a0-19c6-4d9c-8987-14d91b7344d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030110, "uuid": "4fac0243-7f04-4f90-b68b-eee9d7547bfc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f04815-7318-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670078302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078302, "uuid": "05a9f5a9-cce6-46ac-8ac0-a842ba8c6f46", "comment": "Malware payload (Smoke Loader)", "value": "aa58c775a103ccc83214877fed5eadb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078302, "uuid": "e07d8bf8-006f-4a4f-abc8-862cf2b29d2c", "comment": "Malware payload (Smoke Loader)", "value": "98929bda228213f3b42fda028c3dfe9abb32ed47ea0b77b3b48bb98271cdbf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078302, "uuid": "d9a337b9-ad15-43af-b01c-6831109b01ad", "comment": "Malware payload (Smoke Loader)", "value": "5ea72c34b417e5ceb4d2c55793c4f219660b4931", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078302, "uuid": "b4e7a8cf-6e4a-439b-b0dc-f133feacc798", "comment": "Malware payload (Smoke Loader)", "value": "9d0c5894e79c5dd3ed86fd8813121141de6eac11100271f5ba58e53ce268b6512f2d3bab1a592a23e74ffa4774a42d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078302, "uuid": "8e2f7267-fc87-4437-8432-1ff96ae56d27", "value": "T18274DF357A70E872C55315308466EFB0AE7FF93298A49AC733596B5E9E303D18A32347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078302, "uuid": "15b1fa9d-85a5-463a-89ac-5a137a46a627", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078302, "uuid": "98a98445-dff9-44d1-b3cc-5e154de407e6", "value": "6144:vtTd5GAaKD5ugCqtzYSTWsMzDnMW2RqnC+1nY:vtJ5GAaxwaLMW3CcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078302, "uuid": "d0e04d44-7348-4fed-ac81-a63111166019", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078302, "uuid": "6a550983-3917-40bc-83c7-37040e337410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078302, "uuid": "9545030d-1981-472b-8ac7-6c9d76a8a8da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05c18c-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670056577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056577, "uuid": "a0b27b34-1e04-4589-8965-e7288b877baf", "comment": "Malware payload (Smoke Loader)", "value": "89f45ad2949ecc9e6f561e83b0dabb6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056577, "uuid": "8e65ceef-c77d-4d42-b308-8ac3a12ee05d", "comment": "Malware payload (Smoke Loader)", "value": "9bf15a2d83b557dbd15cd9632d0b195159692d2b7a9e8171ab3828457c1c19a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056577, "uuid": "aebac12a-1a61-443e-993b-539e60e9f7a6", "comment": "Malware payload (Smoke Loader)", "value": "ba04be6764f4013edae2001816bc85a0443208d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056577, "uuid": "376101bb-a063-4d0c-bc7a-6e9ad7e11853", "comment": "Malware payload (Smoke Loader)", "value": "114d281e2113db1d0eb978ef2a0572212f00b3bd19103f4ea9d6ef7a79386d52e29e8b401e41bbc4cc84e90b29d42ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056577, "uuid": "8c1a87bc-18ef-4837-9492-1bdabf1c6157", "value": "T1A874DF7076B0E472C1A304748467EBA0AA7BB5325DBCC9C73768976E9E303D1976630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056577, "uuid": "f9ac0fde-9d5d-4425-a56f-ac4574190830", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056577, "uuid": "446add87-44aa-454c-9d3b-ab98d5fd8841", "value": "6144:+8wT9h2XYhp7CN3roYmCnMW2RqnqMxYi:+8ih2XECNbakMW3txY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056577, "uuid": "a97d4df2-8411-4689-a35b-609212658b04", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056577, "uuid": "9a0754f0-b3f2-4632-a2a4-f892ec419f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056577, "uuid": "81fbd47d-39b7-4114-9f4b-37010750a5c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b991b5-7329-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670085960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085960, "uuid": "fcd93dc9-5ecb-44c0-ba08-ce4e32860846", "comment": "Malware payload (Amadey)", "value": "339aaf5da09bf00d3ead836d98be1e32", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085960, "uuid": "fe039748-7903-4d16-877c-b4e0f2a95bb2", "comment": "Malware payload (Amadey)", "value": "9bfc109195c0748916ef828420c3650e2c9644c4d39fd18c2d69bd36fa42ebba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085960, "uuid": "00f547d3-4eb6-4359-a9f1-e5d7e25f383c", "comment": "Malware payload (Amadey)", "value": "b501fd44f4e5ecb769c292ac3f31b079defb4890", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085960, "uuid": "0cf592c9-9e7e-42a3-8ea0-b821b4c28eed", "comment": "Malware payload (Amadey)", "value": "ddee36a58f4aee47f40bbddf09822d926064035b10f0671eca15ee473b18bc9e46f2ac31cf7b87fd9e65e30094d9c55c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085960, "uuid": "795d0054-6eb0-460e-bb19-d8ba1b76d5ee", "value": "T10384E030BAB0F832D59325718166DBA1BA3FF8219E6459C733652B6E8D303D18B72317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085960, "uuid": "f232777a-b194-4fb3-805b-a19269e27942", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085960, "uuid": "1b3d09ee-e269-4411-bfc5-b389bf795009", "value": "6144:g05zgPbAreZ0xRq4mudXX1vgr5m3dgnMW2RqnL7Y:g05z6Ar60xRq3a1vgdogMW3L7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670085960, "uuid": "b5ac14ea-ba1d-491a-a7f1-fc6c20d5d64f", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670085960, "uuid": "1eec7569-1211-4405-974e-29821e543bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085960, "uuid": "4cded605-e985-4139-99d4-f8d401379aa1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c076fb47-72a3-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670028315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028315, "uuid": "0c263d35-3186-47ee-8bf5-9a4fae8f5fc7", "comment": "Malware payload (RedLineStealer)", "value": "520c30a8b36a7b122b2b9b631d7e5f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028315, "uuid": "9d277d82-40bc-47f5-adca-0100c45e9530", "comment": "Malware payload (RedLineStealer)", "value": "9d5ebf928258a2e9da500459de8bd2f650ef10bef03929bc0863f6b9d24481d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028315, "uuid": "1771c05f-7ebd-4f63-9b40-89de75b53497", "comment": "Malware payload (RedLineStealer)", "value": "41cdda1133478d045ec4773908a9fa96fd763cc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028315, "uuid": "4f1d1751-1176-4bd4-9106-b643d67da6c9", "comment": "Malware payload (RedLineStealer)", "value": "3d87fc009f950389d16875402ab42cac9a6a427e5a540795c5ac5ac9306f6ec0e9d3fa327be81e82afa63dfaa675287c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028315, "uuid": "140d263a-8178-4862-b002-058ff594c16c", "value": "T1C5F4AF3134F08436DE7324720AA4FA7459BDB8312B12A6EF579C163A6F317E06F62527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028315, "uuid": "408bde92-b527-4f8c-b5e7-c38ebbae997b", "value": "8171d3b5c355b63535e1aa2a7227f5a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028315, "uuid": "f8a03eec-54ec-48b8-9086-f7b70e14c0de", "value": "12288:wsyl9DOkiXH17f0ynSzbITmGiBEswKK31Ot5kPj8Niru4IdmLxuaTtY6WQ46miql:Zyl9akiXH17f00SIZ31ObkPj8NEJf46S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670028315, "uuid": "fb396efa-10b9-4892-88d7-36a79fd786ca", "value": 750608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670028315, "uuid": "646bfbaf-8d2c-4852-9753-3623c109ff9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028315, "uuid": "ada11add-5d01-40cd-95aa-3de7c597d715", "value": "520c30a8b36a7b122b2b9b631d7e5f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54ff84b-7310-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670075219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075219, "uuid": "02890cde-1fbc-432c-9b80-f210b7646d14", "comment": "Malware payload", "value": "13a13ec836cfbe1063ca95a2f8c52813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075219, "uuid": "f7746769-7064-4692-a981-6f1fb3e04768", "comment": "Malware payload", "value": "9decea735b00c1885b133ce7b7350ae65ec33a1c9663ec22d34216e425b18168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075219, "uuid": "ad5c05cd-de5c-4223-bd4c-36b5e59a3daa", "comment": "Malware payload", "value": "02fb12cb729d3821e28e57481c9579e49e340703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075219, "uuid": "c476d34a-9ea4-4b21-8be4-97d5040f201f", "comment": "Malware payload", "value": "e6e9370d45e0588ec948fa087d750b2f86807d57e3fc89f0897b2dcfb9e800ad01c75112b6bf0646082f742a62ee6e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075219, "uuid": "1a7d1f85-1889-4935-a929-ff5c2ba64f41", "value": "T1437523082B928AB7F9124730156E6736477ABE30B735CA87A384B73E9E312F14139757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075219, "uuid": "fc548725-7193-437a-bed7-dc57dd365c55", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075219, "uuid": "f41d1349-c9c5-4e6c-8f3b-d93593ee89a7", "value": "24576:DoBkrIm9azMBhmqMGjiv9j/LHeo+hWDvqXtG66idtWvKZEUeS:DRIu5giiv9zL+o+hWDvq9G66vSZEUeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670075219, "uuid": "43ae4e5e-1eed-4008-a951-6076e523cd55", "value": 1562080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670075219, "uuid": "461d5063-5ce7-4dff-b0cd-41489cc10800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075219, "uuid": "e9270a76-18e4-46f1-b0d7-34f0846ddfe0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ef6fc7-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670052589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052589, "uuid": "696f7825-94d3-4678-a3e7-2b5757f61ea5", "comment": "Malware payload (Smoke Loader)", "value": "abd5bb0cb00bd03d9d131845bcaa41c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052589, "uuid": "bcd3ba3d-b9fa-4f73-8784-b9465616b681", "comment": "Malware payload (Smoke Loader)", "value": "9f4741a24fcebd8671855e6fb2d623e48900ef3c5cf389b4cc6a8be8f2cc1f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052589, "uuid": "f25e28d6-098d-4bf2-91c2-e432e599b492", "comment": "Malware payload (Smoke Loader)", "value": "01ee9e0952f82a954f38b3b93e8d99c78aca74cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052589, "uuid": "f3a0f04c-cca1-468b-a543-16e42175d39c", "comment": "Malware payload (Smoke Loader)", "value": "31b333ba789a9adad9bd667fef02cc8ea75407ca998084bae51fef13da02c8e1cc1621d00c4ea1487318b0f1a0d9becb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052589, "uuid": "b605ed85-44aa-4196-a559-f89a7c4b2b92", "value": "T1DA74CF00F6E1C976C54205FC8926DBACAA7DB8717A24C64F23646F5E6E333D186723C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052589, "uuid": "ccbc0ca0-0c43-40c8-93e4-326f2375735a", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052589, "uuid": "28df4d06-d3ae-4d0e-9adf-03d839c173d0", "value": "3072:Dw833jMyCdHh5QRKYRJdrCqWEWwKiSz67gDAMIZgWK5uhIh3p2dIYfjZq:hnjMyMHcRLdrC3wKLjMTaN5uuREKej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052589, "uuid": "5f93cc4d-6004-4f87-9142-8117de5491b4", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052589, "uuid": "18f1e7dd-9477-47f3-866a-3046ed5e2a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052589, "uuid": "a082e0b3-5bee-42a4-a01f-85cc4e010f0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09efca57-72a6-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670029297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029297, "uuid": "33f2208f-6a43-415e-b3f9-400db2143fe9", "comment": "Malware payload (GCleaner)", "value": "8374f9fe601b46db0caadbbca8c055fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029297, "uuid": "23d25940-9609-4baa-9f60-d05e838cb914", "comment": "Malware payload (GCleaner)", "value": "a10e016227046303066d4ee8f3dabcbf4991263f0a0b77e8f169c98e705c53de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029297, "uuid": "2a17b503-6351-4910-9c87-2aee00009b73", "comment": "Malware payload (GCleaner)", "value": "82535fff1587fca76ee35f34e42e1e76f979162c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670029297, "uuid": "15529cb2-fd4d-4538-912f-e2484d758b9a", "comment": "Malware payload (GCleaner)", "value": "afda74b14fec9b11353efd2b622c70208f70ae9e176aef40c6e35ac1239a168c67772dceedc4ad32c0aa6123b491d2f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029297, "uuid": "1baad5ec-8b65-4f41-b79d-4f6e23614e42", "value": "T100B533467BA00DF8E26149FD6E96873284677E763D65C612FBD46C9B2FB30CE005224B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029297, "uuid": "ce54f244-a4d8-4a8d-88ac-ee211d7edfd0", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029297, "uuid": "b818a463-3739-4e03-980a-256bbb4a31cf", "value": "49152:4/lAptvIfcE8uIL9PR3C2KsbP55DNahJ5DiCqxu67AG5cy5:492vIfcEFe9J3gS55Dwz5uCZ67Xcy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670029297, "uuid": "cb791c3b-a21f-4f2f-a102-72e3dc9730f3", "value": 2359834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670029297, "uuid": "25db4bca-1b19-4152-98a8-4eead28ba63a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670029297, "uuid": "1d5ebe66-0329-4d85-b4bc-6d32c2e9e0bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31d0e9e-7312-11ed-9266-42010a9c0072", "comment": "Malware payload (RecordBreaker)", "timestamp": 1670076020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076020, "uuid": "3c580a73-ec98-45e9-92b4-e14121307899", "comment": "Malware payload (RecordBreaker)", "value": "75936877ffb42dc4491e62f7b61ae506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076020, "uuid": "502dc0f3-e3d8-4cef-8424-784c830a9ea7", "comment": "Malware payload (RecordBreaker)", "value": "a136389dbe73d7c7860eca13711b7827f6aa7aab663148515cdd52536bb4e668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076020, "uuid": "80d7990b-bc5f-4eaa-81fe-a8a9d635f140", "comment": "Malware payload (RecordBreaker)", "value": "af3d88f2d36cf771410031e8a7103a4011958651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076020, "uuid": "b314b9cc-743f-4ec5-9f51-1d030e13b914", "comment": "Malware payload (RecordBreaker)", "value": "5c042f8454549a533e168ee9a28ff378edf1083963cec6874dec953a2fbab59940d3c2437480c9dfa4a9a3e4a6eb1e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076020, "uuid": "012cb1ac-6dc3-4c6a-a9d9-d08cd006b0f4", "value": "T16D54BE103AD9FB62C0DD9330482DBBA46DBABC315925597B3774376E6D31281A62333E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076020, "uuid": "e59f54f7-d5a1-4cf6-8c30-ff3a079725ac", "value": "20d0a6050daabe2704c95b6dd23a806a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076020, "uuid": "8980ceec-8657-404d-bd47-a8a223c75ecd", "value": "3072:mXOaz7dLZLKBmEWOwuPjBvmSxukyZndn3ZGdeuk9qgmbx5RF+S03tNEhCodZnI6e:O39FL8WOwKJlyZJZGyqgmbPnCNEndTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670076020, "uuid": "6127c4de-781e-47ea-908d-4c4f5d276b0c", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670076020, "uuid": "acfda332-1349-4ccc-9471-c17cf371689f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076020, "uuid": "4a139820-5c1c-4467-88d3-577c3daf24df", "value": "75936877ffb42dc4491e62f7b61ae506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3866e075-72db-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1670052138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052138, "uuid": "13f358d7-1a36-45b8-a0c4-a85baf554cea", "comment": "Malware payload (SnakeKeylogger)", "value": "a07c5b8e7e7c3708ee38f900bb0899f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052138, "uuid": "9ce32b43-b32c-42b7-840c-95bfa745e2fb", "comment": "Malware payload (SnakeKeylogger)", "value": "a1b9732cd03a120bc68fd88cc42ed1a138f0c3012eac4222b108ca1740b682fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052138, "uuid": "b9ebb5e0-a876-4141-a2f5-58d819e4d2bf", "comment": "Malware payload (SnakeKeylogger)", "value": "c6a6f832b9f2b7b7ecd3c0f3501a4935b63e72b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052138, "uuid": "f5917ce1-3ca2-4dfb-a5a1-80faacd2681f", "comment": "Malware payload (SnakeKeylogger)", "value": "2b6178831e9f90b1dbedd7752dcac53932a692b832c9bbc110eef33c62668f242351766bf02f0cd1352e7098f69aa48e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052138, "uuid": "0c568b2c-b3b8-4571-aeef-c5448d0163f2", "value": "T1AF32D50193C04372E1B542B72DB757828B3096675947CFAE7C8CCA1EBF5265583A3394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052138, "uuid": "a08c1d41-da4d-4975-9419-602b1cb469d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052138, "uuid": "6a73b030-f60b-4cf3-9020-2b383d958e64", "value": "192:ROnlULSqepXH5Sg6dbgxJ25d/tN8stYcFmVc03KY:gnlUeqU5SgSbgx85d/tNptYcFmVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052138, "uuid": "316f246f-7478-41fa-8fc9-c4fe48c5c65a", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052138, "uuid": "bf39eb57-aa88-4f59-a251-7f202ce9ccf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052138, "uuid": "5acb3002-964a-4025-9587-b46815b1f9e8", "value": "RefTT011222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93250389-72a4-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670028668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028668, "uuid": "ac6395c7-6270-41cd-8c6c-1277ddbabbf5", "comment": "Malware payload", "value": "e2e98feb10faa3871c33ddd1443d885c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028668, "uuid": "873a0a30-0385-4fbf-9944-4a1c9c28cade", "comment": "Malware payload", "value": "a23a2731a53988da99bd7c70292281b7e5c8a8f7587aaffbdf7a5e6547fac666", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028668, "uuid": "b81888f7-69d7-450c-9076-ef0d03d96ec7", "comment": "Malware payload", "value": "6462615f038b0a83ce2e5a5a50b11f8978cb23f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028668, "uuid": "d9012448-29c0-44d9-b2f2-5c352dadbb13", "comment": "Malware payload", "value": "31f5fdd7a760fbf865089a8b056c8e29c58df435736f9f01d5fb092cd756f2da7db6c980c8f6bdbf87d96d13bf3dace5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028668, "uuid": "f86d0dc9-d5b4-4c6d-bdd1-826f634f5887", "value": "T168E2E1847611EF92E71105732D9C6A9C4AAAB75A0B7F3172CCF5ED8EC34A157088F385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028668, "uuid": "85214e6b-d9e0-46da-b948-11d8217f3e90", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4kjNBrHKuxTnxl/KEuBmskU:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670028668, "uuid": "ddd76c5b-21b8-4d1a-ad40-622ceb29b3b3", "value": 31856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670028668, "uuid": "92e3d853-f5e5-4c59-8a9e-b014a0fe0be9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028668, "uuid": "3b2f7486-e7cf-4fcb-8d86-2921e72d6884", "value": "SecuriteInfo.com.Linux.Siggen.4218.18557.19214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f7fad5-72d5-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670049790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049790, "uuid": "f7b2142d-edd1-4e5d-9476-e1ddf2a6a341", "comment": "Malware payload (Amadey)", "value": "7d0e3462a75ce00a696e961e9b70effb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049790, "uuid": "615055fe-76c9-408c-8493-3bf0d7dd06f7", "comment": "Malware payload (Amadey)", "value": "a40ca1799d213fd00ae20f5460456bbad0d9f5c8bf19d7a6013d2a54dd3bd150", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049790, "uuid": "4bb65911-042a-40fc-a25d-ffc85f52329f", "comment": "Malware payload (Amadey)", "value": "9e5b1c32a978f9cf6ee14de90e49d190b944b32c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049790, "uuid": "51efb0fc-2f07-413d-974d-ac720dc3fb8d", "comment": "Malware payload (Amadey)", "value": "d2b7e8a1fff9b2e3b635c6e9e44766e7f1b84b249edad38473777b8964bf648208751fe0d711462ba4ce3aec242a0f8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049790, "uuid": "f232a328-062e-4d54-80f6-7cbabd29b1a1", "value": "T1B0E523027A46DB12D49C3D7126ED74593FEEFCC74A7E600EEF123A751EB9880985720A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049790, "uuid": "46284905-dcf9-4e94-81c5-28cd316eb41d", "value": "98304:lp/262qMObXa0z2WLEO1gcdB9w2CAPHyVuTF:lpFau2SE8h9nnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049790, "uuid": "7a57d40f-60c8-427d-9df4-ee77ac8e17be", "value": 3256832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049790, "uuid": "9c00a7e7-de08-45c0-a87d-ec030e1db758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049790, "uuid": "43ac05ed-20dc-420b-99c3-efa25c46f45e", "value": "SoftwareSetupFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbe0d71-7365-11ed-9db1-42010a9c0080", "comment": "Malware payload (Pony)", "timestamp": 1670111418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111418, "uuid": "2ea1c721-e720-4381-977d-6ae043709491", "comment": "Malware payload (Pony)", "value": "1bee3cea66bd66a0f3cb904f62b869d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111418, "uuid": "1331cfe6-cde7-4da1-965e-f8ed9928fb4e", "comment": "Malware payload (Pony)", "value": "a455e8692d017a220578feb1735d22df8ba6480321f64b3e5367bca8bca4ce41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111418, "uuid": "69bf83da-e83d-4761-a2b5-93a423cf8a5f", "comment": "Malware payload (Pony)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670111418, "uuid": "2dd9a4ea-4fc9-4ebe-b8f3-801fe5d334c0", "comment": "Malware payload (Pony)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670111418, "uuid": "fa829771-94b1-4e65-9187-7cb5b2405c70", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670111418, "uuid": "c6696d85-cac0-4b72-8d13-68c7cc216a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670111418, "uuid": "f2ccb0b5-b59f-42f4-88d9-f14f657c4793", "value": "1bee3cea66bd66a0f3cb904f62b869d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d69389-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051839, "uuid": "d4f00ec0-ce19-4d59-b893-61209e659223", "comment": "Malware payload (Mirai)", "value": "40c75270fb3eb645a45e0d538f0443ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051839, "uuid": "f077810b-bec8-477e-92c4-51d78239ca13", "comment": "Malware payload (Mirai)", "value": "a4a2dd9e348c06a0937678938c63fadb7b0c99c1ac1a2336c4764d5e1948d080", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051839, "uuid": "0fa2b371-76fa-4999-82da-4e111261ea5b", "comment": "Malware payload (Mirai)", "value": "8f37fe50c490229cfc9bc3823dc22671cc14d345", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051839, "uuid": "e9d64d10-70c0-49bd-8f37-92dc0bb0fd84", "comment": "Malware payload (Mirai)", "value": "f48d6e7c106398d0e613d3ac186f230c62aa713b7a5fd2ee35c2942e90a578450822a48c4b30333cd32e7101bbe46833", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051839, "uuid": "94a84e60-e261-404b-b591-01f53148b8f4", "value": "T1C6933A33B71D0F47C1DB59B029AB2BF18F69F6E312936181A91BAE805733A742553F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051839, "uuid": "754c7756-b18d-4bbc-a689-65cb9354bd1d", "value": "1536:h3WZSy4GHHBt3+J6LI0pCov6CpBI5iK9Aq/lYZC5hFCVR928OFt4QVJqDjjafcee:hmcyd2JOLl3I5ig//5hgVNOFaQVJqDvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051839, "uuid": "b3c4b6a6-df17-49d8-a64c-6f74d41a18d9", "value": 97187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051839, "uuid": "db504661-d885-45a7-8773-5543f19c0a5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051839, "uuid": "b297fa3e-1f5e-45a3-88ad-c4944acfe77a", "value": "40c75270fb3eb645a45e0d538f0443ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfd6a7a-72ed-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670060171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060171, "uuid": "5019e83c-19cb-4b7c-836d-54dd03c1f0d0", "comment": "Malware payload (Smoke Loader)", "value": "2217456eefc85f3a1ad53bf3c09f5cf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060171, "uuid": "df528114-dd80-4f07-815a-baec5d24d043", "comment": "Malware payload (Smoke Loader)", "value": "a680baabcfe908dfe5086589c3eb1d02cfaf03fe665a065cf5a6625bab9dbedf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060171, "uuid": "5411fa70-d052-41e6-94be-a5ef11e1dae1", "comment": "Malware payload (Smoke Loader)", "value": "813977a7b6ee1ed801dfa915ddf94f8e4db6f969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670060171, "uuid": "f985b16a-aa62-4c4a-a6d9-5a7bd9aa9ede", "comment": "Malware payload (Smoke Loader)", "value": "35ab7904ac1d7a0b307155dff35a3dcfd16108a36977218b2c080f1ada898736c6c71bd6d1f5237a1e8ee6ce1d00c55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060171, "uuid": "c7b40444-dd96-42fc-9f8d-290c22a0a0a6", "value": "T1A374D03176B0D432C5B304748566DBA1AF7BB9325DA499CB3368276E6F303C28A76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060171, "uuid": "81afb105-f788-4f03-a595-3662342c89ab", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060171, "uuid": "1a4b2b4c-c5b4-4f0f-9ce0-ca85b984b486", "value": "6144:+j1C0AAaeJyNPCmQqjmn7eeGnMW2Rqn8Yo:+jw0AAaO2PCHcgrwMW38Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670060171, "uuid": "4eaadfa1-a405-4876-9795-c586ad192091", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670060171, "uuid": "3f5c1942-71fc-4974-b473-b1f9674e61f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670060171, "uuid": "7b729708-918d-4f14-b05f-bfaa859731d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5c345a-7321-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670082320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082320, "uuid": "5556a734-deba-48f4-8a1b-b14eb814d17b", "comment": "Malware payload (Smoke Loader)", "value": "0e5fe53331dcf72fee23f1b84a120203", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082320, "uuid": "cf4932be-695f-46e1-a3d1-942b04b85dc4", "comment": "Malware payload (Smoke Loader)", "value": "a76007459f2794d5e72a17b06ec0570290647962d7a050cb88f385aff130f2cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082320, "uuid": "cd51ce97-b4af-40ff-bd7d-a6cdc4605895", "comment": "Malware payload (Smoke Loader)", "value": "2b2a224e84a1167f19669b78cb7685bc6154e147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082320, "uuid": "599146e5-bf22-47a9-a5cb-7a1a38253fe9", "comment": "Malware payload (Smoke Loader)", "value": "05fb9cc3389a8ea6b3c3d61d676f4ec101901f3781e6e502d543fd25ab89ca737c6ca46c3567f786dbde2acb18e0ee8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082320, "uuid": "e79390b9-021b-45e9-a313-571895268003", "value": "T18374CF3036B0D472C19205318966FBA19B7FF93219A3D9C737296A6E9E303E14776347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082320, "uuid": "a78172f7-2f17-4e4e-aa44-cafad0826ceb", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082320, "uuid": "7d239770-8a75-4c32-a339-9b893d230355", "value": "6144:xqJZtATKkj+qLlgSuQ1SjRjdnMW2Rqnqlc1Y:xqDtAT/3gS/6jpMW3q+1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082320, "uuid": "ce7396db-f27f-44ae-9d11-aacc30ad959b", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082320, "uuid": "5963b7ea-16ad-439f-a020-551a2442950c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082320, "uuid": "1cef06e3-7697-4a6f-a862-ff9cd2b14eb9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa878067-72b0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670033861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033861, "uuid": "1e8cf50b-22d8-474a-aa2c-d702e660dda7", "comment": "Malware payload", "value": "1f248e4337931221f25f80673e42d29f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033861, "uuid": "d6a4ce35-12ef-4241-9291-7ba32de6d21c", "comment": "Malware payload", "value": "a849b9de3f8a775e561085468722341efe831664f1f652b788ef50888a95e540", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033861, "uuid": "4c6fa7d5-eb7d-498e-8203-5d74f1a956e4", "comment": "Malware payload", "value": "0797fc29bec5e583361b08778c09fcc1e4886caa", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033861, "uuid": "694c5834-7d30-4e84-98b3-cc98e1a69849", "comment": "Malware payload", "value": "bf6ec08929c0714d5261cc53e0c63c900b363576a650364c4d86f4dec5c8a38878dfca40f84892623be9702a3d01fce1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033861, "uuid": "d63f29fe-64ef-4535-bee0-aa6ded6be695", "value": "T1BD2733A31C06A9DAC03164355A3E53895874CB2E3EE32A622454EFB7C5F34A5CDD9FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033861, "uuid": "17199b5a-a66c-445c-9423-6f11329b5233", "value": "393216:+p03EVRcOzsJA35z7A79L+24z1mbgafiubcYZXbLT9i/zVN2I+TXgBiKpPbNiRSz:+u3BXJA35z7c5MZmbBffcSXhi/zVN2Iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670033861, "uuid": "c7504bff-22d7-4dba-a4ff-2f6d377262d4", "value": 21470178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670033861, "uuid": "6ded41d6-f5c6-4dc5-a265-578472d24ed1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033861, "uuid": "739ceb63-31ad-433e-9962-d72a63475db1", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5b034c-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051875, "uuid": "41e27aed-a1b2-4a75-927d-3444cd3f078c", "comment": "Malware payload (Mirai)", "value": "0dfe813a7f5e5e093624b6f01da23229", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051875, "uuid": "5989d987-7de0-4886-9729-96f47dccc18a", "comment": "Malware payload (Mirai)", "value": "a8e9fa2c2edf329933ce6b7718b5ec92e9aaf8670a1258e7c8d4187182273353", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051875, "uuid": "7b802be9-a393-4a4c-9a48-c3429f3d4a1b", "comment": "Malware payload (Mirai)", "value": "dfa75458197160353f45dfcfcbc8852a5287faae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051875, "uuid": "ed12fa3c-fa31-4656-8406-a41ea45ec967", "comment": "Malware payload (Mirai)", "value": "8b4bfd831a76ac052cb500ebb003d94b969928affb1af59a16e8225e7c1d99062519a57d2aa0de03ea0b634ec91ffe51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051875, "uuid": "2ae3309a-a100-4f35-a24f-d1e5a6ab8bfe", "value": "T1B4A30832F8104763C2C327B6B68F474A3F3666EB57DB33126A345EB42BC27991D26950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051875, "uuid": "7f28a51d-e3a3-4689-9760-f1bdacbde939", "value": "3072:uz7LiHM4p05hRzgCOT7qj3ZqQLqn93XMPe:+Lorp05hiCOnqj3ZqQLqn93XMPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051875, "uuid": "6cf5f097-a853-4094-9ff2-8488e956b8c6", "value": 101955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051875, "uuid": "48bbcfb4-6c1b-4d6f-89af-e17ebb450948", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051875, "uuid": "51c2a527-fdde-49f7-a11a-19dd5dc29b29", "value": "0dfe813a7f5e5e093624b6f01da23229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c8d23b-7317-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670078222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078222, "uuid": "c9589c38-ae7a-4bd4-867a-148dcd6d741c", "comment": "Malware payload (Smoke Loader)", "value": "3a086fbfacd6ad88b575b3fca6a8e9dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078222, "uuid": "11180d11-83ac-47fc-94b9-f30cda6610e0", "comment": "Malware payload (Smoke Loader)", "value": "aa157de3a33597398c5dc31f14cb9bbbe5726d3e2fe51d2c1999959a65c1c7b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078222, "uuid": "6536f659-17d3-40ab-9f9a-e29e0dac45c8", "comment": "Malware payload (Smoke Loader)", "value": "057ac0ecc91be5136e4c9a12acdcb30450924af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078222, "uuid": "dbe58a23-2a46-4e7b-8e36-1d9d761173f6", "comment": "Malware payload (Smoke Loader)", "value": "5477a370cdd2b9a97df716d2481aed161811a81888b296ddcfacdddf3935279f51f6d4181616f963d0b74c9b51fcb9e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078222, "uuid": "8897e1e2-848a-4b52-9c4d-91e128597ad3", "value": "T12674DF3272B1D531D6A305308067EBB1AB7FF8225FA499FB77152B6E9E303D15622306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078222, "uuid": "1e5feb7a-501f-436c-9a34-9fb962f0c366", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078222, "uuid": "9de099a8-1f12-4aa2-a03c-58622c5f3e5e", "value": "6144:V6BFw3AmlUILY99qEQtfJSaoljFnMW2Rqn3FK5Yb:VKK3Amid9qHtfA3MW33FK5Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078222, "uuid": "3dd07b94-30d5-4c18-95ff-78c677eb016e", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078222, "uuid": "10d41966-9eaf-4f97-9303-cf7810962815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078222, "uuid": "6c498217-6d95-42a2-95b0-72c1c1a701a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745cffaa-735f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108932, "uuid": "42135ed3-b422-4684-be87-b91ffffa47d3", "comment": "Malware payload", "value": "f7fbe9f2c6867d17c2af8f2fe4a70ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108932, "uuid": "0773977c-3b68-48da-a53a-fffda9a0ca12", "comment": "Malware payload", "value": "aa29b5fec8025ec05435212828cb2774139156dc891586127a29a893f87f6d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108932, "uuid": "6cdfdd21-35f3-4c89-ba9c-b3a46f0e2256", "comment": "Malware payload", "value": "f9d0f31b9425f5565bdadd53dff50702a97f38f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108932, "uuid": "4cd15d67-fa62-4189-97b8-8f2b0faded82", "comment": "Malware payload", "value": "ec752520f9d144af436f276b441f322d14b6408021cd983220e960e0c74f6b9c2ffc125ca5383223e7d47930bda2efaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108932, "uuid": "173338c8-7a9f-47e0-a89a-44adb03d2266", "value": "T19B84E07032B0E8B2D9C75531846AFFA05A7FB8311EE099C73369275E1E303C09A76746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108932, "uuid": "1536a9cc-305d-4007-8ba9-d0d5af4862e5", "value": "232a88a68cd6cc5c1194cb5ecddf784e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108932, "uuid": "6dbf3adc-56c1-4aef-b4d1-fceafb099345", "value": "3072:0hVqorQEKv5maOpo2EBm2m2rzxeuJ8KCTJY3GnWNTC6NRMHnlXbaeZACHYDrE:gqoKwdQU2Pp56KCTJYWnMW2RqnwDaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108932, "uuid": "985ca8a2-8df6-4f44-9d41-9fa76ebc8e55", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108932, "uuid": "7f847aa4-6b22-46b0-a660-cd85f3025f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108932, "uuid": "c6acfe5c-13f0-4c04-9217-95b85ccb273d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ea5e7d-7304-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670069831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069831, "uuid": "a7e35ec5-eb07-493e-b746-cdf531cffc1d", "comment": "Malware payload (GCleaner)", "value": "fd7e2fbd23471469b8cf3c5ca070e8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069831, "uuid": "ce1e284f-1910-4c6e-a621-47b7b40c07ba", "comment": "Malware payload (GCleaner)", "value": "aab23925be2b6cefd0765351140d2ae016b066a70452b7b8c3c60e4398737b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069831, "uuid": "c7d4bdd4-0db5-42a2-9094-30e9716d2567", "comment": "Malware payload (GCleaner)", "value": "7563343f61e2a7f3b83d91a0d03fbdedc872d6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069831, "uuid": "4bf1cbbb-708d-4ec5-9b85-c111378983e1", "comment": "Malware payload (GCleaner)", "value": "a6681d50f303b355976beec28012846f204f73f564f95d8458c8356a314c156b6127fb332bbb15452efb8f2ab0df271f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069831, "uuid": "65fcda3b-7790-4747-a030-755b14ccf4a2", "value": "T15FF533B9EF668E34D6C3D6BB298E483499173E3074C1B1C4607D0A66EF59E86FC5C224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069831, "uuid": "86e17d48-382b-4d06-9f7c-16c928f1b3a9", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069831, "uuid": "d84e27ad-ee5c-4a28-8f69-0339a40ee94d", "value": "98304:IAgZObILIrkqFmyOEIXEhc2bBnkIL/y9e/3sFfYUWXXcyQ:j4OuOFmsmscYDjgus1fWXXcyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670069831, "uuid": "fa49a745-517a-4893-851b-57585e73a9ba", "value": 3578573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670069831, "uuid": "4cfa62d8-2c2d-4f6c-9ea5-5086889b7a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069831, "uuid": "86769b50-459e-445d-941b-f53b84859e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd927335-7305-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670070508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070508, "uuid": "0c38f846-fae2-481a-b316-640149f3fa51", "comment": "Malware payload", "value": "34f65a4e4510e711260b27a9f93aaa53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070508, "uuid": "79662116-b9d8-49b0-83fa-92ab9810f5e1", "comment": "Malware payload", "value": "ad098466468f0cadef0032c415e1657de4a11faf0dc73424898852fef238eee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070508, "uuid": "c178ef70-e709-4a45-9937-48df044ace8c", "comment": "Malware payload", "value": "2065ecc6feb8f20d0fecd1122aee39732fbe27fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070508, "uuid": "2b668434-c5c0-4b1c-a41c-5517ea0ef67a", "comment": "Malware payload", "value": "9781831669956ca48870257c84c6de8a898bfb66557cde5e1e9ef6795afc5dda21df4ebaf82b0bffa5eae1a83b0e590e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070508, "uuid": "799d7fd9-b07d-4015-9e81-726db55e3f46", "value": "T142F4A33D7D4D30EEC3D5DBF179EB8916FA14A75AA112252932C22B097FD02817A0E61F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070508, "uuid": "2271ea65-c954-4c6d-bb4b-4ffb870e3fce", "value": "f2f6f46cc7bf42f42fa50db9bf6aed71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070508, "uuid": "7b7b1da9-b23e-48d8-b2b1-ca0cba65634c", "value": "12288:lofinLXvDndhigtjZXXXXmg8g8g8g8gerrrrpCl:yOLfDnd6rrrrpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670070508, "uuid": "6ed36d7d-839b-48d4-9335-a44301de38db", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670070508, "uuid": "221e8702-ebed-465f-9037-fdfeb225c6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070508, "uuid": "ce9aea9c-58f5-45b2-ba15-125cf1b45bea", "value": "3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e491d62f-72ea-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670058870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058870, "uuid": "4bd1c12a-313c-45e8-bf9b-f00d235558c2", "comment": "Malware payload (Smoke Loader)", "value": "4527064e05020301726b83f052dc4401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058870, "uuid": "7a1cc5a9-e9ec-4cac-8612-9e79749d1157", "comment": "Malware payload (Smoke Loader)", "value": "aefddcddd670c8153ecae6699894e035e885a98b958a8bc5555855c7d3ac3f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058870, "uuid": "704afdc8-82ac-43f8-86b8-42043e76caa3", "comment": "Malware payload (Smoke Loader)", "value": "914f2091957682d6ecac8d2ff35402060d5394ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670058870, "uuid": "d1988985-af4c-44e1-9eac-374a74fec5b1", "comment": "Malware payload (Smoke Loader)", "value": "e7378b6ce938e690b31df172b7a0e85d142ee927d0c9b1d329d683c1bd7d9e89e7e9b175d8e219558acd59afa01b4d96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058870, "uuid": "1bfad21e-8585-463d-9195-dd9aa9efdd1c", "value": "T1B274D03036B0C476D55324318466DFA1AA7FB8329DA49ACF375A2B6E5F303D18A76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058870, "uuid": "a1ee74e4-fa50-4e20-b0d2-a44635590b89", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058870, "uuid": "073e610b-29a0-4268-9863-7bb70f5c1082", "value": "6144:QHuRHsnYhUQh1/vL47ocyLnMW2Rqn5WjYC:QuHsnzsvskcyjMW3kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670058870, "uuid": "3265c333-5bc8-4ecf-ad7e-c78a6e8d3b6b", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670058870, "uuid": "56c56ad5-b829-4a7c-85e3-a0cdcd32e655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670058870, "uuid": "1b3a3d7f-ffa3-4b84-a2ed-f4c8acfb3a43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ecdfb8-729e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670025913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025913, "uuid": "4fddf793-ab42-475f-819f-922c319c7002", "comment": "Malware payload", "value": "e66ed67c17d478c0faefe3d2f45547fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025913, "uuid": "db5389c6-0215-4b83-8fb7-bb4b5ac93234", "comment": "Malware payload", "value": "af58435017059bce41aa54c9d86a7ffcc75b3bd1503415ba875e2963902c3707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025913, "uuid": "46b3a7fa-0f9f-422d-9f63-b005983f4f33", "comment": "Malware payload", "value": "ef4002ffcbfca1060418a326ea10dc0213c5bca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025913, "uuid": "e56ea6ce-ad81-4e30-824c-72083c1789ff", "comment": "Malware payload", "value": "7c66d928e7ca79c6fc0c645ab5f1b551bd2d935ef4a8f87e72ce7b6e041c7ca6fb3ae78ae75adea9907835fd207ebec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025913, "uuid": "0291439f-651f-4430-b84b-63a819844acc", "value": "T1DD76339BB9E4C27DE1C598364D708FF0A5D6D9C003B056076B8D0B3864B7558E22EBBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025913, "uuid": "d04bd062-7535-452b-863a-fc07365e9914", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025913, "uuid": "52a304d8-7563-4a4a-85c0-4f518af579fa", "value": "98304:91OO4A1CIsqiW4yVArEBRdExLDGZvO1c1mWNDUCoDCAXp8iX1K8S4wG+O/kAxN0S:91OOrEOxVzBuDUtuDCAXlS/G+9Amm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670025913, "uuid": "838cecc4-8dee-4f23-a42a-e465cd0c053d", "value": 7632848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670025913, "uuid": "6fd89b90-e783-4bb1-a414-33f762dfeea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025913, "uuid": "94ca3908-d109-4f7c-a9b5-f78182ed4411", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008d9847-7359-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670106161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106161, "uuid": "1d1fa557-8e64-4a07-898a-0bb025c520a2", "comment": "Malware payload", "value": "8ecc522f8617adaf469f173400806dcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106161, "uuid": "573ce17c-1ee3-4427-82a9-a70c43d825c1", "comment": "Malware payload", "value": "b0e5e12bea8386e6e06c82e4e25257b22649a608b2ef2a599332879983a000b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106161, "uuid": "81a884ae-c18f-4e4c-ab61-5ba90114e91e", "comment": "Malware payload", "value": "19aff3a1b435064dade4cc095f9d10a5b6ba9859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106161, "uuid": "cb62f4c9-771e-4eda-8672-8bec2f3866a7", "comment": "Malware payload", "value": "4482e7574e84667d73e359830a1703b1eedf6ed2643535a2910ef82d9811b4993bfae9bdb520e2b17f5ce7ebe320502b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106161, "uuid": "d340bcf9-f0b7-4968-ad84-b4e96d2f68d9", "value": "T135256B62D7B1C906F93388EEA2DC5B551CA851C148B84849CD133E905E78CABF5FC9FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106161, "uuid": "9eda349e-6fe8-46e2-b433-09ebc3c02cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106161, "uuid": "e04df259-5ede-4137-a34f-432bb062bacf", "value": "24576:ukqTTiwAAgEEY4olXoFZ6toHqwjwv0E6:ITQpo9aUvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670106161, "uuid": "27c68c13-b020-4842-908a-dea746916c94", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670106161, "uuid": "b64e80ad-f80f-4512-b9e2-ab0974cc7969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106161, "uuid": "0f502904-f816-4fef-97f0-9b9ec35fa566", "value": "Confirmation transfer Ref No_00101334632192.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5a3790-72b1-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670034245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034245, "uuid": "21508ea3-37d3-479f-aaf0-e0fbe9b73b02", "comment": "Malware payload", "value": "1e017c8c887e11fd0fc20ebda75a9c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034245, "uuid": "66658d8d-94e1-48d5-b2e5-1a7459f6ff27", "comment": "Malware payload", "value": "b21bbeadf83d6a9402d003b2eab2613dff6e90ad6f735dd0ba3040c3e5b0ab3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034245, "uuid": "aebbd0d1-9bc3-45d1-967a-c03207c20838", "comment": "Malware payload", "value": "fd5e0a9bdbf8dfc6d5d548a9451c6b0ec2cd2294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670034245, "uuid": "5cbfea85-47a1-45be-adc8-55ba7714c0bc", "comment": "Malware payload", "value": "7bce5e22401a7cab92876f016600ca211d0e032f8a5eebb27ff199b7b7f58c20e76ce77e1009287afdaa8089751351fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034245, "uuid": "c7738b77-4792-4f2a-a2b3-dc5b7a528224", "value": "T16C44E0167990C032C19B10B04865CF65EFBAA93266B5CA4B3B681B7DAF703D1573B31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034245, "uuid": "8b32957a-6352-48bc-9f52-fc16c31ca680", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034245, "uuid": "5cd84151-90c4-45b3-8e1d-734e74fc18c4", "value": "3072:aQ8zV5IStLC86rJLh9aZ5YRxelrdHiK+KfwJuh1w3MHtLbNB:6x5IStLC8eLccRurdOKSSQMHtLbNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670034245, "uuid": "7145f891-6e76-476d-8695-32c5addbfa75", "value": 265840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670034245, "uuid": "d204f827-9d49-4d3c-baf3-89b61875243e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670034245, "uuid": "40293e4d-2f65-4697-9778-9602c46d4ba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebed5155-7325-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670084222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084222, "uuid": "91059ccb-8784-47f9-b100-187e17396e74", "comment": "Malware payload (GCleaner)", "value": "465b734a3802c865d23071d6f998c3a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084222, "uuid": "a7346ff0-7c9b-4d1b-814d-d81d732225ab", "comment": "Malware payload (GCleaner)", "value": "b3f3628cfaa89d530a01bc1ad64dbf692bd859101e747df3fde412e64b2e46b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084222, "uuid": "8d48e44d-b29f-466f-ad91-337d305c7471", "comment": "Malware payload (GCleaner)", "value": "67b5c32df4677f894ecf569e4724c4c69d73d81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084222, "uuid": "a47f1b3b-b070-4e89-a362-2c018e0c18da", "comment": "Malware payload (GCleaner)", "value": "532e7f5bfee2081c34817976ca6d6cfe9d74816fa3ca4d712a04e89214810dd98b3f6dcba26bf841b9e512574340ca2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084222, "uuid": "f66490e8-e205-40ba-b976-c7a4c542e84c", "value": "T157063319DE526BBFD46057708FAC88CC0E37261926F8180E31A947DD9E5F18CE8613EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084222, "uuid": "395f4a4d-ebbc-4023-a1b4-1ad0a994575d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084222, "uuid": "79277367-a4e4-4b44-87f5-2c0bcc7f961a", "value": "98304:MoRpWKYQ8krxUKabMVlj+KGSvL5SEUE+oogf48Xcy9:LR/YQfq0HwSzGFohf48Xcy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084222, "uuid": "f47bcf12-aaba-46f7-a195-17a28d89e09c", "value": 3760138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084222, "uuid": "924d53ac-7010-46d6-a89d-b39969b1d85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084222, "uuid": "41d233ea-f188-4812-8ed6-11957fb898b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7a040e-735f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108971, "uuid": "3628a1d4-943d-498a-ab94-d928456ee314", "comment": "Malware payload", "value": "523344b0917148b6d0ccaa693eef250a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108971, "uuid": "322a9e0a-413a-4774-b77c-ec322472fd98", "comment": "Malware payload", "value": "b46825652db4b0c651ee6f74b3494c3d8c4161b83df5875829a70bccf81732c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108971, "uuid": "7eae9ca3-0c71-4db4-8d91-b6e735eb578d", "comment": "Malware payload", "value": "c43ca378c329f92b534845c1c4ea8bceee23dc80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108971, "uuid": "43c34955-0ece-4601-9a12-8f9bc54c37e7", "comment": "Malware payload", "value": "5b392eff567adc6544289c4f07cabfe556bae90ceae0cde3fcfd75dbb3731330697784fd2be3b538b7c32b67a207f2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108971, "uuid": "aeca0e62-48df-4147-82b6-c57ff56ed6ca", "value": "T19274DF3076B0D872C5939535B56FEB912A7BB8210FA496C7333426AE5E703D09B36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108971, "uuid": "2b6eae29-bf43-4876-a671-5e7af69954d3", "value": "232a88a68cd6cc5c1194cb5ecddf784e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108971, "uuid": "593286c2-111f-491c-96d1-e7d8fae26675", "value": "3072:OJgDRo3W+1i5m9hAn0ab/g4P8OFV+IonLJEnr4GfOWefGnWNTC6NRMHnlXETWeHX:ksRotB9m3VdFV+ZG2We+nMW2RqnCWeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108971, "uuid": "ba8d0ab7-da43-4806-a036-1cde919af4ff", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108971, "uuid": "982dc306-3073-4768-99cc-5f07e0b1533f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108971, "uuid": "aeef1b79-415b-4cbd-a479-7dbadc98ae6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ceffb0-7327-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670084806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084806, "uuid": "e1b9e8f3-323b-4e60-86fe-65ed00e4074d", "comment": "Malware payload (Smoke Loader)", "value": "9efde796a642465e04d129b9f6273f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084806, "uuid": "eadef2e8-d590-4e72-8a9c-5ec6a248c152", "comment": "Malware payload (Smoke Loader)", "value": "b4a77929841d80684197645891c84a757b50be6a07d0f6119f34e04dcd385b3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084806, "uuid": "6357a313-0b5f-4c01-84d0-bb5869296302", "comment": "Malware payload (Smoke Loader)", "value": "592d6260acc2a733e8d420624a4c475e4eaa9253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084806, "uuid": "941bfa94-130f-4afb-81b7-42e83170e935", "comment": "Malware payload (Smoke Loader)", "value": "389499cca79ebe7503edc79ce0667a99d79c3d34ccf6fce45d7acbb644b3db29aec24ffe13983e40728a56db31746edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084806, "uuid": "d6dca469-fe7f-4fa6-bbf2-1a041445c0f8", "value": "T17374DF3136B0D832D1A2053D8166DBA19F7FF9325E6099CB276D676E5E303D18A7230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084806, "uuid": "677b025d-1524-4b39-97ca-f51854317c76", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084806, "uuid": "78388abe-5ccd-4abf-b417-d884423aefd8", "value": "6144:o8+r3AveDwWKSoUZ9HTGYNnMW2RqncbY:o8qAvbWoUZ9iYZMW3cbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084806, "uuid": "f5f3b86e-2f29-49d9-88ac-0137c0a652f0", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084806, "uuid": "89463012-5947-48c7-9dc6-316a0296807b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084806, "uuid": "43e8bde2-becb-40e6-85db-02c22bcbd7c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe39028b-72ff-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670067932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067932, "uuid": "c8ed2187-2384-4127-a6ae-89fe04d595c6", "comment": "Malware payload (GCleaner)", "value": "fecdaebf9020c9761d7826ffc4c7b106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067932, "uuid": "73b1e3e6-1ff1-4589-ad99-ec73bd0465b8", "comment": "Malware payload (GCleaner)", "value": "b567ca13681a6e3bfe04781ca7e266a26a24a29c2dff05e3d99adb1cfcd7acf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067932, "uuid": "53951b09-26f2-4551-994c-fc5cc8528a81", "comment": "Malware payload (GCleaner)", "value": "620779087a44052557ee84287e8dc5eb393b3295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670067932, "uuid": "280fccef-ea55-47d8-bdb0-aafcd187c485", "comment": "Malware payload (GCleaner)", "value": "3f7ba76d45573a0611f3f4ebd36ae23d30b77d62ef799fa309f8f71df603d747770f1df9cb9a2f2d281027a7c98cfb4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067932, "uuid": "06f52b39-1248-45b6-9c06-a3dc5e029bf5", "value": "T1CE0633217D6296FCC0B05EF22C7BCFC0593C396798AF965326241B4D9B752CAB289F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067932, "uuid": "f9602499-244e-49ba-99a7-0f87870be332", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067932, "uuid": "bcbad28b-c686-4900-bf59-7c63af82f716", "value": "98304:MFBp2/zNzoEzD26nzrU4lfwjyA3Q07D7p9CXcyM:2grNzZbM4lw/Q07uXcyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670067932, "uuid": "af3b5b64-8e69-442b-954b-20eaf07c4a06", "value": 3743930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670067932, "uuid": "d48a6461-c301-4d45-bf63-5a5dd7fda8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670067932, "uuid": "75ae52e0-2874-4bba-b4b6-5336151efab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9192e8de-733d-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670094379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094379, "uuid": "71a5c22f-affc-4fed-8041-b98c6dab75a1", "comment": "Malware payload", "value": "eda2e0b7299d35736c59b15329b7dd7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094379, "uuid": "9be886fd-afce-41af-80b7-531a0759bce6", "comment": "Malware payload", "value": "b6341c0052b0ea2a05bf000d623edadd6ad1b296e5f9d4605f57d1b98f53c32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094379, "uuid": "5d21eb7b-9e42-477d-a0ad-08f3cce40660", "comment": "Malware payload", "value": "3584366c4036e5b1904d4406d45c28b59773cd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670094379, "uuid": "cf2caf85-828e-421c-955b-1c3c0ac9e1f1", "comment": "Malware payload", "value": "760ab9d75be9e37074d49d73a20bdaf5e2df3d9b39e17d8c34c9e135501739f6cab36a7b5b15ee75c58729aa8bc6406a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094379, "uuid": "955005f3-2503-416c-820f-13b837d73597", "value": "T16574D03036B0D872C1A314354562DBA09B7FB932596499C3E36A276E9F703D29BF6307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094379, "uuid": "0f42f511-4c23-45ff-b555-b47b0c8c31b1", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094379, "uuid": "49a3777d-4233-40d3-b0c6-28d06ebd4247", "value": "3072:7dyysZbayI5Am/fhR+eQXe/OVTEN/U6ZnfDPZGe6n+5GnWNTC6NRMHnlXpgNB8ON:tsday5mLsbT0ZfIFnMW2RqnHgYOeDAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670094379, "uuid": "097b79a0-6090-42ef-aee9-11ee66e26439", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670094379, "uuid": "37f4054f-eefc-4693-b03f-2c137ef8eb6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670094379, "uuid": "cfb04703-6035-4229-b5ab-c637f7f68ccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abbd3bd-7306-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670070664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070664, "uuid": "c008738d-c234-4c5d-82b1-d146217d3144", "comment": "Malware payload (Amadey)", "value": "177bfbd186e5d18281c73373376c3ba8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070664, "uuid": "b94a57cf-db08-447a-b26e-ae07bac1c7e5", "comment": "Malware payload (Amadey)", "value": "b6fe8de4c4c7645a7a9993c4585b67421486e2703cb6583c7d502a8497c91930", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070664, "uuid": "8cf8788f-5d26-4c70-a41c-284f5c924ec1", "comment": "Malware payload (Amadey)", "value": "894f69415fa7649b71e60533f31dfcc2ac32cc9c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070664, "uuid": "ae495c0c-65d0-45d5-9ebc-0e11fe87ecd3", "comment": "Malware payload (Amadey)", "value": "1e976469282e2da92d15b1754036df7deb63bbfd7885343c82d395d6daaba2f1c9670e7d253e2539cd0c907923160c94", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070664, "uuid": "56d238c3-048a-4086-88d2-13ca97996cb5", "value": "T19B84E13136B0D971C99F01318466DBA0AF7BB9725C6199C7373967AE9F303C18A7630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070664, "uuid": "f86a4caa-af8d-445c-ab40-5812d497a232", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070664, "uuid": "a647d958-95d7-47d3-94c1-4dd7a78c2b7c", "value": "6144:LifODA3KKxsdnIFKpVM+uRErTMcLnMW2RqnEfif2fY:LimDA3L6pO+/jMW3EfifsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670070664, "uuid": "a4ba2dd7-02e9-4739-9265-83ce406a7957", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670070664, "uuid": "bda4b7e1-4da6-4def-9aad-5ddddfee74fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070664, "uuid": "3187a717-6e64-43ac-9d5a-31079c0181a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739aead-72a1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670027548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670027548, "uuid": "3dee3118-8491-4272-914c-27b109546291", "comment": "Malware payload (GCleaner)", "value": "1c3ed4fd0a02d47fd5670395909e4c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670027548, "uuid": "b400520a-fbc3-4a23-a108-572177de8f4c", "comment": "Malware payload (GCleaner)", "value": "b9056535949f6570b001243ef38194194187ab156d6426e36a800c17d49b93b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670027548, "uuid": "e1884101-90ec-4449-bcd0-37b2ff70f0e2", "comment": "Malware payload (GCleaner)", "value": "7c167beabc1fa5e2954f309a0cc4dbcb2c94b769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670027548, "uuid": "81f0a1b9-ceb1-44f5-8f31-a05e1e4ce19e", "comment": "Malware payload (GCleaner)", "value": "074ca21b5a02d95a85edec1b28966426145dd93f04a6aaafcf4067980d3737c3189fa8f336ab7fe09a6678149eb4c1a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670027548, "uuid": "b10769a7-97c5-4ba8-9bc1-fb617660726b", "value": "T1D3B53305F9909535F0442F71B818FD60153FBF2968AA8D0967153ABEA62BB307C2D3ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670027548, "uuid": "04bf668d-cf5a-4c1f-8ed2-c5e021e984cb", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670027548, "uuid": "4ef401ed-3dad-4786-9b41-1a3304a50ce9", "value": "49152:k5iA7xXlC3aeu3Yq+k9/xM2WJHxnDkMxUERiQDozHYm8WyhonvCN8l2zAa3AG5cj:k5iA7vWu3YqcFnDHpMT8WlnvCuCF3Xcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670027548, "uuid": "ea39cc3c-ab65-4313-a38c-9898f291d1fb", "value": 2358262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670027548, "uuid": "1dfad51a-3cdf-4360-81fa-5a513cb95321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670027548, "uuid": "d0034fff-0bb8-43dc-9240-710c2d2bd752", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bde135e-7305-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670070317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070317, "uuid": "a360bc49-02e2-4905-baec-51f250662ab3", "comment": "Malware payload (RedLineStealer)", "value": "71d1b7ce025e5d50d245d777cf47b2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070317, "uuid": "7443f0b6-303d-4353-bb0c-ea5e3e3847ac", "comment": "Malware payload (RedLineStealer)", "value": "b9806db6959eaf756dd803b51495ab2d9b2ef4aa0b7a902b268d07ab7af15748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070317, "uuid": "f9d522d2-d005-4ef6-ac78-8cd622050d8a", "comment": "Malware payload (RedLineStealer)", "value": "41ff2c2f863df5e52c8ab28705cf1df1f633f15c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670070317, "uuid": "5f061214-7b72-4344-a9ce-d51f528c0027", "comment": "Malware payload (RedLineStealer)", "value": "70eebfb4fdb0832410e12d52649a1802dd4be0f9904d8fa8c73c96462d4ae771a88b244daee770528866d7a9608f5247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070317, "uuid": "41da0e98-8cc4-42a4-a1e3-9ce7fb573586", "value": "T1ADA6338279C859B0C6A43D768BEABA7484387F111F6ACFD7B3593E0E11B11D04E39627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070317, "uuid": "20c3f4d1-820c-42e5-b71f-534084cb69ea", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070317, "uuid": "997cb467-5237-40da-8441-69adb6102c6e", "value": "196608:SAiDgpcQXledaHtC5/hABhZAbhKhnD7vyVGLi+Y3nZ/yy:fpcQXiNhChZAbhK2yipp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670070317, "uuid": "af963f87-71e0-4cb8-83ce-9391fde88dc9", "value": 9533452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670070317, "uuid": "73d29400-3dfd-4591-8424-f4caaf8b0839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670070317, "uuid": "cebad5f9-fa38-4c2c-bf66-9f286231df7c", "value": "B9806DB6959EAF756DD803B51495AB2D9B2EF4AA0B7A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e4e903-7303-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670069505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069505, "uuid": "2c2c0f93-4f5f-4080-9d4a-9cc5f81fbec0", "comment": "Malware payload (Smoke Loader)", "value": "ff4ef52f1b88c67c5b09f424a8e02208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069505, "uuid": "0f50bc2a-1fbe-419c-b074-2e13e47147a8", "comment": "Malware payload (Smoke Loader)", "value": "b9baa85436864c5794447cc29a58e9ab10374ce1a8a6cd9d43646f2bd87779ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069505, "uuid": "d2562770-e0b9-4bd4-a97c-f5f9f4f3064f", "comment": "Malware payload (Smoke Loader)", "value": "f3c7633440235289f7cfcd97cd99065ff8ced75d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069505, "uuid": "f1ca040b-3ca5-40c3-9c17-175689922bbb", "comment": "Malware payload (Smoke Loader)", "value": "2ac61b65af35f1a08cbcbe6d69872a260ff3d96b7657f2862aad7f08efef225d8567aca0166a597a601fcacaa2d17dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069505, "uuid": "1306eb81-3e02-4fdf-95a5-00f4faf4ca4f", "value": "T11474DF3175B0C832F182C5344476DBE3AA7FB93259A1ADC7236527AE5E703D14B2A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069505, "uuid": "a1e3c063-3ab7-4d0a-9966-1e32a4555ac9", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069505, "uuid": "9e6c2d51-d5cd-4bf3-accf-e4fb67919d63", "value": "6144:zjJVXAaeQjinNR4sKwiUhugfhnMW2Rqnh+Y0:zjXXAarWNdKwiUhXtMW3h+Y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670069505, "uuid": "42f536f4-9c57-4557-9cba-0f638c32b38b", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670069505, "uuid": "9a194248-7925-43a7-9dba-2b22a1e8926c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069505, "uuid": "390c4d24-9716-47e7-b3e8-c98df295257e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c46f6f-732b-11ed-9266-42010a9c0072", "comment": "Malware payload (DCRat)", "timestamp": 1670086676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086676, "uuid": "5f36d77e-c1ce-4263-b628-438c2d0c043f", "comment": "Malware payload (DCRat)", "value": "eb28d38d600798a08161657098614d19", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086676, "uuid": "e1e56b67-ab95-4b7f-b778-707cd1b0bc06", "comment": "Malware payload (DCRat)", "value": "bb60a1b440e724320be0da80d1804440d329e5be5ae318563c6cf858ce26008a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086676, "uuid": "35323d34-f326-4c62-8c9c-49c08753a854", "comment": "Malware payload (DCRat)", "value": "972396e32b40487bc94e58b8de3daefb04afe599", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086676, "uuid": "566b3c3c-9df0-4171-8d48-4c7adbcbd766", "comment": "Malware payload (DCRat)", "value": "b4d03e50deacc3e07d18dc5b23022b4f3b71eb2e7d299e482da0a0c7cff8effa916b79270f3e7928f8e7d2ed663fc45c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086676, "uuid": "8af7e8cd-3561-4b49-a7d1-a49e3fcc1732", "value": "T1CD15CF0FF53984C4C86457BDD2BFE790A8DCB288C9D97FC9707EA83825683643A9C585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086676, "uuid": "3b761258-efd3-4c12-8227-0c0f1e3128be", "value": "5d1347f36e9b27f5470825188b98453f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086676, "uuid": "f316c070-1ec1-4e32-8250-edeb75db532e", "value": "24576:klqFe997J46tH3pP2iazAw6LnWg5a41n7pYl53x8om2CzGtb:kYMj7J46tH3pP2iazr6L7X7aiz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670086676, "uuid": "96e26225-81bf-4553-89f5-563cf917c98c", "value": 954426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670086676, "uuid": "27199a5c-9e90-434b-b1ba-e21023d43380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086676, "uuid": "7809996b-2d6d-40bb-be14-f84c7fc45a6c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa28a13-734a-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099977, "uuid": "8ec9e649-5b74-4343-80a7-796de139289e", "comment": "Malware payload", "value": "6c9952de2827e96ce5ac852db418e9ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099977, "uuid": "a688d32f-4bc5-42ea-b43c-9cde5fc0d567", "comment": "Malware payload", "value": "bbcd2ad5a3df30b2206cba0ed2d44985fafa4680590e4aab351badf0835b0e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099977, "uuid": "3022dbf6-1216-45a7-84af-c3b28d5180cd", "comment": "Malware payload", "value": "a390e05fd081b8dcdfe1d93933eb5029d533cc30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099977, "uuid": "53c653d5-b35b-48b9-8c0b-684d40331e17", "comment": "Malware payload", "value": "c58c617c06fbc47f623df012dfc0b2a8933efaeb33fb91812c06202762afa0f4c25346f7bb1fdcd09b0692d48b8ddd2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099977, "uuid": "fab52517-ec40-4ccb-a5bb-f039671414f0", "value": "T11874D03039B0D472F652D5309476EBA3AA7FB822586089C73369776E9F303D18A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099977, "uuid": "bbfc2a34-6252-4b79-b978-a657820c276d", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099977, "uuid": "e345def2-8484-4a78-acce-1e550d54837a", "value": "6144:3/A8A6z7whkAZdaEjsnMW2RqnCdLVdYA:3RJ6daEjCMW3CdpdYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099977, "uuid": "d030abcc-7397-4f2e-9845-d717d901c865", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099977, "uuid": "540e947f-d51d-4b76-9670-33636471690d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099977, "uuid": "6d385fea-c6b7-46d4-a80a-64dbd16628ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fb3fef-7349-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099431, "uuid": "9b395a46-db8a-4ad4-b05d-e33dbd641c4a", "comment": "Malware payload", "value": "71a05e63b25e5e04d8677db86305b8a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099431, "uuid": "a9cbf00c-3c72-4809-8731-e527562ab2c2", "comment": "Malware payload", "value": "bc35d994336209efc78eb210c7d8a63c123406b63fc4d71c3037224b295490b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099431, "uuid": "e720ab08-6160-467e-8115-a0c4b0fa7904", "comment": "Malware payload", "value": "1b165b19942c1c0b4f66a8a4f01233e637919fb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099431, "uuid": "c882ac45-7f9a-49af-88db-df0bbfaa6f8b", "comment": "Malware payload", "value": "853c24b1b679b9fb22d73c790c4e8470aa3eabfed73232393a5b950b5e07e8c3002c59379eec788ab29eaf3aa5103495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099431, "uuid": "7f0bd7fb-af1b-4d33-bcbf-c3bc99b46acf", "value": "T15C063383F3059634E561FB32AAB3DB5528772B4B8C502AC13349BD0D6E7E79189412FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099431, "uuid": "f583407f-0776-4cda-aa92-8137e7cd1c3b", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099431, "uuid": "e3a6e821-b965-4a1f-a213-0a943a423d2d", "value": "98304:MBD9aBkA8Bg9znbpZyfHbQoTEe04VZXcyK:A0BL/9DlZyvsve04PXcyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099431, "uuid": "23e45713-3d3a-4685-b98f-ab0913a6e2ea", "value": 3757975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099431, "uuid": "9f85370c-73d9-48c2-b603-e753477930fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099431, "uuid": "8c10bf16-d347-41d3-91ae-82c1d77432b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e1030d-72c1-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670041043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041043, "uuid": "1575d976-93ad-4266-9f6b-052f5098df04", "comment": "Malware payload (Amadey)", "value": "0da2a98c506853113ad576c34366c9d7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041043, "uuid": "49c4e5e5-b6af-4657-996e-ace2ff96c1f1", "comment": "Malware payload (Amadey)", "value": "bc99f10c467d8330243ba7004a29330b1cb816d66757b901cf8b6fe1867e57b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041043, "uuid": "d199da8c-faa0-4f9a-85f3-795b3c09a5d5", "comment": "Malware payload (Amadey)", "value": "e179fee64330deb29fc97d2ce9fbb935a57b7f86", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041043, "uuid": "3d7bcb96-814a-4cb0-b2f6-c933fd9c05ca", "comment": "Malware payload (Amadey)", "value": "4c1968828c9a565cc137c682ca65c9641b0e37becaecadc7be39e870350d4909cb90ce7d32fd2ff034c4bf80c209b45f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041043, "uuid": "0210b11b-29b4-4627-8e40-335107a9d114", "value": "T1F084D001F6A0C836C59245FC4926DBA99A3DA8325A24C50F3774AF6F6F337D182763C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041043, "uuid": "c247c1c2-2dc9-40a3-8bd7-e63b3770be7f", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041043, "uuid": "6bec7b7a-0ff2-401b-803e-60d16041ae41", "value": "6144:qPWIdQLV8mdQcRGLrLIVPakT0Cvo+U+FbUkvuRpLwj8:qusQVdQFAVCkT0CvnU+VUZRpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670041043, "uuid": "aacf1847-47a7-4719-a230-2cadeef28857", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670041043, "uuid": "e33e369a-614d-416e-a227-86690c781d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041043, "uuid": "5eaebe57-fee3-4666-82d8-5c720679dd57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af90cb69-72d3-11ed-9266-42010a9c0072", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1670048902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048902, "uuid": "0feb235a-6053-41d2-ae8e-fb79b8a1685e", "comment": "Malware payload (SnakeKeylogger)", "value": "f6875b1ac68223b34f429f7d91741934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048902, "uuid": "968e197a-ddd7-4d51-a8cf-e556bb4cc096", "comment": "Malware payload (SnakeKeylogger)", "value": "bd7f5bc092a03ddad04ed423b689d7b99aeed70569e390279ecb9ce692eb6c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048902, "uuid": "37082ea3-a53c-478f-9614-e7f9e679dd4f", "comment": "Malware payload (SnakeKeylogger)", "value": "caeb667f10776d8928d23a1bcc720c262a37d763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048902, "uuid": "2f6bf094-ba46-407e-9e5d-70afaf053542", "comment": "Malware payload (SnakeKeylogger)", "value": "2cc5cabee3cfb0ac7c1f8d6b182fd2e8f2afcfee07af371d1a151a1e5dcd2f7b11dd9b8580ad98d70acc34f393ee33e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048902, "uuid": "1a971666-2534-4eae-8de8-d5cce7c9bb1c", "value": "T1A9E41764B1988915FF79DBFC36C5194A311A1DF0A8BA2CE84C8574C20E381C5EEF99ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048902, "uuid": "3235042e-b78f-4fbb-80bc-c662233b7cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048902, "uuid": "e85958ff-a6e5-4a7c-a992-737f1a2a9df3", "value": "12288:ocvkg586aWHffbUo4jQcx0nFcO+LaoRUDi:7vB5O8fbUo4jlWcOUDRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670048902, "uuid": "c4dddf9f-3ca5-48ad-8fe3-d4ef64789c64", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670048902, "uuid": "ef10c3df-3011-4ba6-a31c-01b389525139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048902, "uuid": "b43417d8-b57a-47b4-88c1-cef5b3ef45e8", "value": "SecuriteInfo.com.Troj.Krypt-TF.30306.21402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171e0c64-729e-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670025883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025883, "uuid": "059114a0-c23e-4106-afbc-890a984434e3", "comment": "Malware payload (Smoke Loader)", "value": "34fdd28a583fc8bc7d8966da18f5399b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025883, "uuid": "ca220ef4-b70e-4268-b793-b06c7f96879e", "comment": "Malware payload (Smoke Loader)", "value": "bd9f56cff4739bdab749e8975b7c34998095a6393992471c6fe5debe89850bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025883, "uuid": "1413f075-68f2-452a-af6c-6e5134115004", "comment": "Malware payload (Smoke Loader)", "value": "0a51204a215b187b347e735cb856121a4f959143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670025883, "uuid": "ce89e76e-26c6-44fe-8b0e-eb6482265e30", "comment": "Malware payload (Smoke Loader)", "value": "c341c7638003ccd936f85c85930f6d94f921dc4c733f645974a057efa3b1389ea7bbd0febe6af42bd32f72c46033ef1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025883, "uuid": "a37a67d9-0396-4f98-b173-edadf1d4b421", "value": "T1EA74D000F59088F2F58604FD5911DBA8AA3DA8326664D90F33A46F6E5F372D296733C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025883, "uuid": "8d355e80-485f-42a1-9231-5f3f2721c2b0", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025883, "uuid": "a7b9df5c-0440-4eee-948c-468d48dc0712", "value": "6144:jryIAdLP8StMcRVsxO//Y+5XKuRaL7jK:j+BdftMv8//H5XDRaLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670025883, "uuid": "0522c2c8-4bed-4611-b8d6-08c015c10de5", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670025883, "uuid": "346ad9df-cd3d-4cbd-a22c-3e4cb4bdeed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670025883, "uuid": "27a68535-be02-4cb7-9832-5903d34f6add", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039a31e1-7317-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670077820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077820, "uuid": "4ebafb3c-3bbf-452d-b543-1bbf71f69994", "comment": "Malware payload (RedLineStealer)", "value": "065ee41f9a4f66bd96f0448d68cc4178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077820, "uuid": "f4bb2516-07e0-402a-913e-06937eea3f46", "comment": "Malware payload (RedLineStealer)", "value": "be91543d87f31d5bab7129c8bc63646ccc7c6aacabfa527ef4642a386145334c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077820, "uuid": "b28e51fd-7f14-458c-ba39-c3964be4cdc8", "comment": "Malware payload (RedLineStealer)", "value": "12cfe42b86f2f050cb40f75cd1bd1b1832e6aea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077820, "uuid": "5589be20-3622-489a-bf2e-5e939cedacaf", "comment": "Malware payload (RedLineStealer)", "value": "b24d2c8dc5484cffb1dc3fcedb3b1f451751c98c2344c6afb46747f6c47fb959c4afce057219980c3cc32f8d80966ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077820, "uuid": "8cfb89a9-ed54-48c1-97f2-4290354e518f", "value": "T1CB34F7207916C031C56061B72DA9BFF2C19DB8259BB049DB7B800F76DA122F67A71E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077820, "uuid": "30b64a06-b273-42b3-bf48-bd36d318d418", "value": "8e8ff15d652fa4cfc3097ccc64aa2fa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077820, "uuid": "57c0b89b-c97c-49e6-af9c-372fa38a1734", "value": "6144:QuipnySnYTepzkqldDIM4z9ujpdD5LGS:QbVlmM+ujpdDAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670077820, "uuid": "b0188898-ee55-4f28-a3ce-511285e55913", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670077820, "uuid": "61e3fb8d-7d57-4ca9-9a21-e09a09b43f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077820, "uuid": "99c8c043-7077-452f-a4c0-953cca15dfc3", "value": "065ee41f9a4f66bd96f0448d68cc4178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1a27e2-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670056624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056624, "uuid": "3cebb120-5314-48f7-8505-3a80b59ff5a1", "comment": "Malware payload", "value": "ad0687ab9b7e302135ec5814aeeac066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056624, "uuid": "eb300893-cf8d-4a22-b738-417705273e58", "comment": "Malware payload", "value": "bed964df2a595487c35df6229a52fbbeee6e3bcb76742b5fd63006731316e080", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056624, "uuid": "6c5a6a35-b2dc-48a3-9c52-63c34df55535", "comment": "Malware payload", "value": "989579a4c559b1029b5bea8543218f4754631b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056624, "uuid": "66bac03f-1c77-407f-bf1b-f2710dbe9e6b", "comment": "Malware payload", "value": "5b9d390d5db0f7c54d9a21ce06aca65c2d1e9a9c1bd7b57a64f6732b0c8d4ce4c3b0425db8ae6efab3b7607198520886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056624, "uuid": "8e7d6c94-c005-472d-bd64-ebbe0caad291", "value": "T10D763316F9E05439E787C3B2D13A2BE577F1A98587315EC723C686267E388C8E52538C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056624, "uuid": "ddf00e64-9c1d-46f9-ae67-b964a134d3c9", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056624, "uuid": "06a423dd-a85c-42de-af62-14e3a263884b", "value": "196608:91OXbdpfA6IhrMglTgLPuDKMg93xoHFxLdD2FeVw:3OXbdpfaeYTgL2E3xKx2AVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056624, "uuid": "30ab5dd0-d436-4245-9b5c-5c358068b59b", "value": 7595510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056624, "uuid": "906971b0-08b7-4e7d-af3f-cc41c059c67a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056624, "uuid": "fd98d2c4-7eb3-493f-a942-fe16fcda11d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b40b8-72cb-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670045365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045365, "uuid": "e32c5269-603c-481f-822d-8b21351df18c", "comment": "Malware payload (Smoke Loader)", "value": "fb1ea2b595b19312a7fe7c84fbfaa851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045365, "uuid": "f444561c-2069-4668-9ddc-6cb020626c55", "comment": "Malware payload (Smoke Loader)", "value": "bf1c3acfdbc19da600b1439d99a4d21e9018419ef27c4a2a3200e90dda42e4cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045365, "uuid": "eede10ff-339d-4e81-955d-20e9d0a00a72", "comment": "Malware payload (Smoke Loader)", "value": "38aa34a205d03e197c83660a86c9edd84d67458c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670045365, "uuid": "2ac11596-363c-4ee5-a598-7204c4ed7bc0", "comment": "Malware payload (Smoke Loader)", "value": "83daa5fd68872ef49e413f8f15cf5932cc7a24f5460a82e55103127563e059cfebba31867b528922258b79f2cba4bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045365, "uuid": "ab78447c-40bb-4197-8c23-dddfcfe8fe96", "value": "T1A274D010F5D18877C78204F94916DBA89AEDA871A629C90F37A42E2E5F333D196333D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045365, "uuid": "24d92ec0-9070-47f2-9aa4-c7aa143dd2b5", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045365, "uuid": "fe3dcefb-af1f-489b-ab06-8d30aacd601f", "value": "6144:A5RIuVLO82j3scR5fm9jTk8q/gv/TQkJnTuRTS8j8:AnXVAbsLTkDm//NSRTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670045365, "uuid": "edb634a1-a830-4eb3-9862-ea4f73e6ab24", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670045365, "uuid": "b09e7bfc-d1ba-4f0c-8ae6-968c1ff5c6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670045365, "uuid": "5159f2f4-7cbb-4e30-96d4-dfe7b0555ab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610db6a0-72f1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670061655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061655, "uuid": "c059bfda-dae8-453e-b21e-acd2443c1294", "comment": "Malware payload (GCleaner)", "value": "5ce6c6382f4ab7c22b84571940ac38d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061655, "uuid": "65cfe7a7-4f1c-485b-b8e8-0d03c6cf3002", "comment": "Malware payload (GCleaner)", "value": "c0bbc463e30c1f3ae95a31acd57df04185fde6aa6bb8bf961b98c3d679381ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061655, "uuid": "5221ade5-ca12-4aff-9989-ec17d34bc9ad", "comment": "Malware payload (GCleaner)", "value": "4b725e2b216e8668498e270732291172e5fa689d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670061655, "uuid": "acd16876-5d71-473e-b63a-6371cb5499e4", "comment": "Malware payload (GCleaner)", "value": "da08990b92d767630661635c320edf2a4c7840daf71a6dbc5ff990371863d1d7f7398b3375dcb6231503b8917f8f89e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061655, "uuid": "7af0e8e2-5cc9-44df-a2f7-07182ac14346", "value": "T10F06333034EBB574D746EAFC1E2BA613BE35A2F67C20A410AFC4E5CE2B53918451749B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061655, "uuid": "a75d78d2-b20a-4ea6-b4ac-5a85cfa2d09c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061655, "uuid": "07685528-2d04-4241-8abe-0c83615647ab", "value": "98304:ol83upkWZN5KSHrpxtOeqvXhfGpOMFp91dT5UXcyU:0kq1TRCxJMz7d1UXcyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670061655, "uuid": "2871dc11-bcdb-4529-8e9f-a71c73a9a11b", "value": 3748539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670061655, "uuid": "eef864bc-d796-4331-97aa-5e81166f6796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670061655, "uuid": "90f1d5e4-a78d-485c-9033-aef90492e191", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc76707-7341-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670095874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095874, "uuid": "e592b691-b23c-4ef3-84ca-b2150853c19f", "comment": "Malware payload", "value": "109d08799ddbd170eead4aaea98f84d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095874, "uuid": "361bf12b-2b68-4d82-80f8-04b695c1290c", "comment": "Malware payload", "value": "c0f12cf3cc2030141227a7a933042a0b2e423fcc010ab5da08465afd2ab8c638", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095874, "uuid": "2e182248-1ece-437a-a129-b7f426f8e935", "comment": "Malware payload", "value": "dc1b1fabef19e8f6c3b558c34059bcac39f32074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095874, "uuid": "bde044d6-5a01-4569-8030-c293abf81d60", "comment": "Malware payload", "value": "78ff3bced89d4e526979177589f6a42f434f1ef06240295aa0e5651f6dac88ff9a483a372eece235c640c87b061238b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095874, "uuid": "70aa6ebe-d745-43db-999a-715e63a3d81b", "value": "T1F5F53325E2922771FC64D7342E0DCE0158AFB9191871560D1BCA0E7A7F2A24ECD6DF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095874, "uuid": "450021d6-5281-4bb8-9f52-31abfb1d3494", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095874, "uuid": "91435f12-6986-45e8-ac15-34316dc68708", "value": "98304:w9JibmE1rENfbATTB4ZvoYGl28o5+D2KEXcyM:AJibBElETTByvomEyKEXcyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670095874, "uuid": "cc3e71c4-2152-4dd8-b3a0-6048929388fd", "value": 3624720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670095874, "uuid": "7bbfd1f2-2e21-4761-a471-da92533dd64d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095874, "uuid": "ea05e9ab-21e0-4703-925b-bae62f3562ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ef5ea4-7359-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670106304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106304, "uuid": "1a373541-3ffe-4c85-ace6-3fa665a634d2", "comment": "Malware payload (Mirai)", "value": "0b5ae6ba278b23c1ea27348124ec3a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106304, "uuid": "db67cfbb-e1de-4836-9cb4-f3b54ab1ae9b", "comment": "Malware payload (Mirai)", "value": "c161fde26a1635e1103a6a9a8a837c8856f14400313eb77feba5a215fe1bd2d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106304, "uuid": "3452bc1c-4ff6-40f1-8812-065a9e4d70c5", "comment": "Malware payload (Mirai)", "value": "6ebebd8d27bca649668773ee41c229a09e50d081", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670106304, "uuid": "1c651670-8e6f-473a-88bf-177707a2cbb6", "comment": "Malware payload (Mirai)", "value": "1e947377e2ad7dbfda4a6a4f3a37292254acaf76c8671007e352b6072b0f7b28af27e3a763716d46c07fc24f2d79f952", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106304, "uuid": "d589e5a4-a0b0-490a-a2a9-2698ca2834cc", "value": "T1AFF2E02B281210ABDD439274586A0FF00CB5074B61C2FCC67AE55696CFE35F574A6FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106304, "uuid": "8bf086da-8034-4f89-9475-6827998799bf", "value": "768:baCOZ31VTepOEjCjfvwM04oazl/gs/s6Y/d6JgGlzDpbuR1Jm:g1VTKOEjCzSnil/gsUZdeVJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670106304, "uuid": "5ad1e9c2-257b-4597-ba14-c4c7df459d04", "value": 36580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670106304, "uuid": "ac5b8869-a685-42d4-aa59-258502547e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670106304, "uuid": "f5ecdc74-37a2-4c86-81e4-a08527993ded", "value": "bok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff0dede-72da-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670051963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051963, "uuid": "50548fab-41e3-4872-b689-815a71231415", "comment": "Malware payload", "value": "5e2cbfb05a1e974a12de3f4c6a34bab3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051963, "uuid": "0b405e90-884b-4ad7-b378-3fdded28df56", "comment": "Malware payload", "value": "c29d157a57e8abf2a60b2f82432987bfb89fd900607f4d5b4a0d920437f21261", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051963, "uuid": "6436cd9a-a688-45f8-b342-535cfdd51c22", "comment": "Malware payload", "value": "46781c521d676e081c9197242dd9948b0090cf0f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051963, "uuid": "271ef835-21a2-4e45-82ad-8053aeb86626", "comment": "Malware payload", "value": "bfe8b8f06bd9b23412ceb77717f6914910655dcf8af3bddf75b08a71541f309e418cf97203b5155e5e34497855d6d668", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051963, "uuid": "0d0487ab-a091-4c3d-8c7d-0d08ccfe7725", "value": "T16DE5F1DC72B0420335DCBA05887B5F8F17A52210B2D7924DED5BD877AA96B3B3522077", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051963, "uuid": "09280adc-7eb2-45ce-ba50-f08eb8555f09", "value": "49152:aIhauUFuB6HhSBX7EtsLk2jXuzlWR1Vxs:VjbChS5fj+5WDVxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051963, "uuid": "790debdb-85ed-4a51-ab6f-2e98aea895d5", "value": 3101028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051963, "uuid": "62fc2c58-c931-451e-80d5-9aa89c1eb2a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051963, "uuid": "383a1478-e219-44a1-9d0b-fa966e43325a", "value": "Notafiscal-uubir-11686-ADGQR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71301782-733f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670095183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095183, "uuid": "39ddd376-fae8-4490-bcc2-d244a328243c", "comment": "Malware payload", "value": "9bf740bb361da8b6872e647abfb48549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095183, "uuid": "820fd3e1-4ac1-4495-84b3-664e783befb2", "comment": "Malware payload", "value": "c331968d9d31ef9668491d5d5f19894dc7805ca084a355ac4f37636f71560808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095183, "uuid": "2f2eda92-7266-4847-9286-1e5b88dc9d66", "comment": "Malware payload", "value": "be81a55bd481280108c5e7bc30fc2e2a4d0967e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670095183, "uuid": "338aeaea-04f5-46d9-800e-b3b409abc47e", "comment": "Malware payload", "value": "7a76a4a18be0d3ec30746c9ae9c3ab63a36d614d3cb283f5e79b3b0add3b28b7944e58a18111a122a9fc9aabf35e1080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095183, "uuid": "72a1451d-85e9-4ee7-87b7-842f96c2a25c", "value": "T1B874E03136B0C876C5930D35546AEBE0EA7FB43258609AC337296B6E5E303D2CA76747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095183, "uuid": "9822efe3-b949-4409-843b-693152dec2a6", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095183, "uuid": "0d5de22e-b7d4-49d6-9cb7-243b579b84fd", "value": "6144:QQF6TPo4W5QxiOQRefdnIYUZsjWnMW2RqnvyY:dLdKxgBnZsjAMW3qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670095183, "uuid": "80bff55d-16bb-4096-ba3f-4d1c6391f7e0", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670095183, "uuid": "0ecc50d5-7827-4d94-885e-43465cbf6189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670095183, "uuid": "5abf4911-6768-438d-927f-a6e66a3afce1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7a4436-72dd-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670053326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053326, "uuid": "efbb30cf-0221-4228-9887-6cf8be28c446", "comment": "Malware payload", "value": "63d0a0892ac553ad9c5c39774395f770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053326, "uuid": "0f4407f6-e812-460a-9845-7e23e3c7dad2", "comment": "Malware payload", "value": "c557d82beb056f703331e5856e8e6cfbc48fad4263e2924c05bd6b74a36606fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053326, "uuid": "7e0eee9f-0358-42b0-86bb-fd4cb9e10e1c", "comment": "Malware payload", "value": "eaba743b54715bb32fbfe182179e1a41a96b8875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053326, "uuid": "a1e012d9-5462-4eb5-a0ba-edf13d9534b5", "comment": "Malware payload", "value": "c39fa89959c5fb7a23e4497b140f36c0ebca9775ac507460643bb6c7dde2e57d889566765557f22caac85fabf7d8010b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053326, "uuid": "b68aa1c0-0eba-4754-86f3-e900c33f4584", "value": "T143F52B12B244AF3AC06F0A399427E594983F7EB1AE118FCB56F03D4CBE365406D3965B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053326, "uuid": "3f6049ec-e49b-4d43-a41a-9ab8f902b9ce", "value": "69de50ae4531298340832f82d2934ac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053326, "uuid": "288f34d3-c38d-44af-ae5e-fff119e26e20", "value": "98304:O0vVHbOfMre8VYOPFUmhodet5YGmlVRaSx+7P:PT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670053326, "uuid": "ac90f43b-9ec6-463a-8df2-3a2edff9fcc8", "value": 3457536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670053326, "uuid": "f27833d3-792e-415b-96f6-84cce3c3a0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053326, "uuid": "9eba83b1-e4ec-4d1f-b244-9524e5a3600a", "value": "Notafiscal-yqnry-59401-OHBLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c06b9f2-730c-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670073190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073190, "uuid": "20cd5e19-08f9-4fbd-ba02-238f0dbfb088", "comment": "Malware payload (Smoke Loader)", "value": "aa746e120865e27889ef646b79b20ca0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073190, "uuid": "1da6b18c-8333-4a3e-bc28-20536cfbdf71", "comment": "Malware payload (Smoke Loader)", "value": "c6dbf8fab6ce214746637143d46cb11dfb80a2e5a6f4cd4abd2b6351fb823295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073190, "uuid": "f511210a-58a7-4722-b683-900eef1b8c4c", "comment": "Malware payload (Smoke Loader)", "value": "da0af9da748195d3fe2ca908ed1a92759498d0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073190, "uuid": "366b9e97-aa55-4662-bf4d-f2dc14760dc5", "comment": "Malware payload (Smoke Loader)", "value": "3f835c91e2732652e312cde3e363ed57f8962f6d51513ca606cd468a3b9d8abdfe589d17da409c3bea7a901db6430ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073190, "uuid": "c4578632-8a91-4d89-ad93-bff557a19504", "value": "T1C874D03176B0E832C55318708466EBA1DB7FF832AD6499C337692B5E9E703D18A72347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073190, "uuid": "12dc333a-b09d-4746-a661-87a05ac580c2", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073190, "uuid": "6b8ca549-50fc-4ace-a860-783930792bb8", "value": "6144:qACnsAAPKuyXvDrQAo3z1X3nMW2RqnTxOY:qAMnAPDyfvRoDBMW3lOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670073190, "uuid": "02aa20d4-05c4-48bf-b971-aaa06803aabe", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670073190, "uuid": "65409f05-766b-4d7c-b735-9850a3126829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073190, "uuid": "cb831497-e89a-48fd-9614-f5bceaddc62c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05cd6ee1-7333-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670089849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089849, "uuid": "e2792f4c-081a-4ea3-af2b-d553da76ee5b", "comment": "Malware payload (Amadey)", "value": "e2f9b10ebce3a02e8590628b9b127845", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089849, "uuid": "7a7228b2-6373-4338-bf67-e19bf71ccd00", "comment": "Malware payload (Amadey)", "value": "c72b5cca8b8bfda5a2acdaefe19bc967c431b5eaab0ae6f344a4a58b772c87ce", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089849, "uuid": "70c58983-6b22-42f5-ac73-cfd4c4cbced4", "comment": "Malware payload (Amadey)", "value": "2c69edef210227567fac4a72ab0f4cb64a33b4d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670089849, "uuid": "80eac801-addc-4954-b5e3-0840e18c1c10", "comment": "Malware payload (Amadey)", "value": "2b87f9f24caf8e689d24a14f9ff1e360486fe431616ab2284f6998551d82df12c313198681f2bf2912accf266aa3a90c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089849, "uuid": "ab7a0c5e-c963-4c65-9291-8f5dcc190e7b", "value": "T1F384E03132A0F872C5520876446ADBA39E7FB6365861D5C733692AEE5E303D18F7630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089849, "uuid": "c9c9aad7-0924-4a60-86ed-fc25db2b0d61", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089849, "uuid": "31f10c9c-cd67-4ceb-9d0d-5837548a3059", "value": "6144:7G7gs5SqxntDwvPCGY3zp+8eCijWnMW2RqnUTY:7wbsqxtDmPsF8CijAMW3wY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670089849, "uuid": "05175237-be06-4b15-a0e5-b4f46ce1a09b", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670089849, "uuid": "34ec60ea-e334-4ee3-8bdd-5d2daa650b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670089849, "uuid": "2a32583a-da6a-47c2-9173-74dc31035349", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d451e1b2-72b8-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670037368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037368, "uuid": "25438160-2fb7-410a-ab52-d8ff718fa6e9", "comment": "Malware payload (Amadey)", "value": "647887f3392cb8787e34821945df479f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037368, "uuid": "95d9a4e1-9615-4a69-b58b-2b6a9eab32e4", "comment": "Malware payload (Amadey)", "value": "c7fbf7b6658684a09631e93a561a6f07c4d38c4faf6cc88371408f8b02dda65c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037368, "uuid": "2c694fa0-d80d-4531-8c84-f16e8d274c3f", "comment": "Malware payload (Amadey)", "value": "2eef2b0e527f8c9fa5d932e04ab38d78cf258872", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670037368, "uuid": "b9a39c79-927e-4714-818d-147531f6f0ca", "comment": "Malware payload (Amadey)", "value": "66c1ce7639d297760b3df0682af5282586da0db0f60d4781197e63f35bc10fe18a02c9d60c3e44a3a5f3bd55bd61b420", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037368, "uuid": "a233fba3-a149-4c30-8ffd-675eb2108a41", "value": "T1A084D011F1A3C836C58204FE5935EB6CDA2DA831AA24940F37A46E7E5F332D196733D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037368, "uuid": "be6ad2a3-5c8d-4e4c-a29b-6cf21f4d21c6", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037368, "uuid": "934ab7e9-59a2-4d5d-9db7-c8a701798bd2", "value": "6144:xDjIRjLiS8S34cRgoSem04c5T5nO9uRitFz0VJj8:xHwj734yE04cTnOwRv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670037368, "uuid": "58ef85ea-66f1-427b-965c-0f00c3e50e6b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670037368, "uuid": "bab81183-b444-41c5-b58e-510f5056007e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670037368, "uuid": "6eb608fa-a194-4af4-883b-3fd7e1920bd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5720d6a-7302-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670069152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069152, "uuid": "a56fc7dc-f082-44a9-beb3-4923fccdac55", "comment": "Malware payload (Amadey)", "value": "0e241eb76711334a1afa524dea0f112d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069152, "uuid": "78df876e-365b-476a-8d8a-909a3fdff01c", "comment": "Malware payload (Amadey)", "value": "c85f5648df2e13e78ef93ba580dadd0158abd9cc0986bb9fe05a6be6f67f9ff8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069152, "uuid": "b91d782a-5143-49d1-a9ac-a3eb584bbdff", "comment": "Malware payload (Amadey)", "value": "1b1791dda277260baa31e812294c3244e63b9c8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670069152, "uuid": "356cc07e-0052-4ed3-9afe-e71c448686fb", "comment": "Malware payload (Amadey)", "value": "abf2be066ea30562568c416d6df2719be4e190543d652cf7bc14b8cdb8dd5d3c797d9d29bdebe2bd09da7bd238846b8b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069152, "uuid": "ff2a73a7-d1be-4c6a-be1b-e4e9434afdb9", "value": "T10F84DF31F5B3D832C19305758156DB609A7FB8729DA198CF235A2BAE5E303D18A36337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069152, "uuid": "94366763-32b8-41d3-9b1e-4e095836dc89", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069152, "uuid": "97d589e8-04cb-4e09-853c-5ded812456eb", "value": "6144:z5p8X1A6e/SMgtCH4agYPEKzzsdFwe1KnMW2RqngAYo:z5pi1A6YQcH4agYPEyETcMW3jYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670069152, "uuid": "04295b24-2f74-44cf-9534-97d286432fa8", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670069152, "uuid": "7d076f7f-1151-490a-87ec-8bb71fabc13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670069152, "uuid": "a34b350c-177b-415c-850b-48657f11704c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905e0dff-72d2-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670048420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048420, "uuid": "8d206a9a-bc63-4f64-b6fd-7e28da5f2e75", "comment": "Malware payload", "value": "892b2d8df639b342bcd24a9d7e4b6cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048420, "uuid": "7db631a0-2aff-4b16-814a-0fc46ef21a48", "comment": "Malware payload", "value": "c91103087514969139313248ab8fca5082e8c076ef4a5056e6f4c6b3bdc94e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048420, "uuid": "8329a851-4e01-40ae-83e2-e24054257e0e", "comment": "Malware payload", "value": "c4efbec207a6d296580bc5bc98b56cb780a6e19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670048420, "uuid": "69776140-1f13-4915-bfb2-92596d884219", "comment": "Malware payload", "value": "a3f0485a3f81d7a87f8946b0ecd822fb8d360e44bc0dce512a55154d66bf18f23e6a8846748ae3129ab3e528687e5ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048420, "uuid": "9984c1bd-f84b-411d-a609-38a34f44b852", "value": "T14FE65B41FED60ABBD60211708BFE53CE1331D9006F6ADBCBDA01BA2DB8732565EB1255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048420, "uuid": "fed45814-1554-46ad-8790-7f3e9e8a9e45", "value": "5ee4aaa6ed3a42aa0da491ed92042317", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048420, "uuid": "66209145-8c08-44c1-9342-e86ea5304c13", "value": "98304:0j39YKH5DyVgMzXEMmOGdHotCx3QJgMVebX/A+r9brgWKfaz1L/8B+CRB7rlw:0rOgU2MPGdHotCIVej/AiSdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670048420, "uuid": "c674ba18-3dbc-4124-8400-af67592d65dc", "value": 13907816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670048420, "uuid": "6a79082d-10b0-407d-b675-6ff42010b813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670048420, "uuid": "b8bf3829-c2d8-42cc-964c-7848d2ef2580", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6640554a-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload (LgoogLoader)", "timestamp": 1670044055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044055, "uuid": "6aafc08c-42f4-44a5-9a86-62295e9df8cc", "comment": "Malware payload (LgoogLoader)", "value": "c3e9d3c9d21979c21222af19982ec0ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044055, "uuid": "93192caf-42cc-4c06-8a7b-1a05bb2d0028", "comment": "Malware payload (LgoogLoader)", "value": "ccfc8a33e392514d74e89202a6480f68678a11ca8895651c6603ea1e1c8b000a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044055, "uuid": "b1d66afa-2ecd-4325-a839-6b375826326c", "comment": "Malware payload (LgoogLoader)", "value": "90cd9f7676caefcc628976800a3600af23db8cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044055, "uuid": "0b7d0d85-d6a1-4c1e-a318-ced90059f83f", "comment": "Malware payload (LgoogLoader)", "value": "882febf73d63076e05c4c9ac42990291fc6f20da0742a9fcc62872016a2812899f1ceb511864f19ce4d62edf12171092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044055, "uuid": "68a1417f-3d6d-4312-8a77-706a0192facb", "value": "T1CC752215F3D3953BE4AA037048B6A3B2A2A8FD304776C797A28417792DB33F10466797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044055, "uuid": "dfef0712-5b0b-4f1a-98a9-c0d3b8dff1e9", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044055, "uuid": "a60d6f5e-cae3-4dee-b66a-6fd14a44c4cd", "value": "24576:0FkCmr1wVsVhn+HeHm2JUkb3H6ppJ+yyQX8AqZjO8Fl+/nunhhfWrqzx:02z1OsH+j2uIX6bcynXIBO8q/nuhBtzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044055, "uuid": "64c3eb2e-1c3c-47a5-b2bb-27774104109b", "value": 1691032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044055, "uuid": "5c5dfbd8-aef5-440d-b1cb-772ee52a4e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044055, "uuid": "ebdfdec4-4f06-49a1-ac16-2c6fae6ae31b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c62e7e-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109019, "uuid": "bbbf6d2b-8b8f-4315-8f00-35b37d5cb649", "comment": "Malware payload (Mirai)", "value": "57180b86d0a013eb96c48d546b86f509", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109019, "uuid": "9418cc84-f88b-469b-9865-0994cec8dfd4", "comment": "Malware payload (Mirai)", "value": "cd0867d562fcb75ed3cd8a10ce8c1d2d77f677741224d18236c52fb9a0198a82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109019, "uuid": "a412b960-ff61-4b00-a190-d1eded1155ba", "comment": "Malware payload (Mirai)", "value": "96533d64fdf6f1f654d067861deb99797b39bb0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109019, "uuid": "29366ead-c100-4e90-8faf-da02b830936a", "comment": "Malware payload (Mirai)", "value": "28d19a4d31b63b1a5a52017396952acea32ac01c01c055f8b7e3a53544be4f6ff55fd6157618580e89913e14099b95a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109019, "uuid": "63d606fb-2d7f-4587-8374-612db340bdf5", "value": "T1F1432AD6F401AD3EF84BE27A94574E09FA3167C051820B2773F7BEA3AC720596C26D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109019, "uuid": "46dcb623-d5d9-43e5-8d6c-86f690fda1c7", "value": "768:lIeaA7jI0qZ/XMVelo9DCHweCFjub8c86jp+9pN5W0Gr7sSTXGFaQLDThq6VKQ:+j/CvV4cF6b8c86E9pN5WBrof1LPhqWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109019, "uuid": "e402fca8-7e6b-4038-902c-d9718ccd5b15", "value": 55772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109019, "uuid": "5a24187c-71f0-40b8-a6e1-a30da683d016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109019, "uuid": "8d5c5d7c-2b55-4496-9148-fa8f1b36adf0", "value": "57180b86d0a013eb96c48d546b86f509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32aa9d9d-72a8-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670030224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030224, "uuid": "39bcd51b-d15a-4629-b1ba-dd761f940b3e", "comment": "Malware payload", "value": "fb6937c38e0d2538b825fea79b46e718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030224, "uuid": "78e5309b-63c9-4070-aac0-8b1dc9566aa8", "comment": "Malware payload", "value": "cd70ee551f071c503388002a977fd0e5df5d510ba5610f77ceafbdd70ef0635c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030224, "uuid": "6957a2f5-e4c7-44fd-99e7-18ae723cfafe", "comment": "Malware payload", "value": "4e6130176400c13ff113db76b7615ca05afcfaa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670030224, "uuid": "73cb88e3-5621-4f3a-beb6-a8a3d12b5291", "comment": "Malware payload", "value": "4acf758e2e68ea3987473897aa2d996ce15f5201e0ca4a0c9748934676dc6a9664ce10926c6816f5eb39c3ccf4bb5c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030224, "uuid": "0f8e8137-5fc7-4caf-9779-934cf27e4c68", "value": "T1E3A39E253990D072C48715704464CAA1EFBEA53267A9DD473BA81A7E9F303D267BB30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030224, "uuid": "b88229f1-1d0a-4308-8961-37af9bdcc98c", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030224, "uuid": "55cf6da5-161b-4f3c-8558-1081100c308c", "value": "1536:qkAlot34MacI5Q5JELaPCDWEb3Y0CCFVBfDBqxRm05YR:qB83TzI5jL/8HCnYZ5YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670030224, "uuid": "14c16353-ebc1-4ce7-8203-ee8e1d252a54", "value": 100768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670030224, "uuid": "58410494-a5e9-48f7-9a13-d4d02874ac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670030224, "uuid": "ea0f8686-6650-469b-9fb2-b0defbd85e0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364dd92f-7312-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670075757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075757, "uuid": "8bb414c5-ace6-4e13-bceb-6e94369aa8b5", "comment": "Malware payload (Smoke Loader)", "value": "1b5906ddc3453ff0f290f97382632557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075757, "uuid": "c01e307f-a897-44d7-8cba-c17b2f6e7ba5", "comment": "Malware payload (Smoke Loader)", "value": "ce38e2de843c9337d93b8bf730ea72e66b902aca7c955e634b5f55ea1db79756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075757, "uuid": "6869ceae-9ee0-4018-889c-7f2f05be908f", "comment": "Malware payload (Smoke Loader)", "value": "bc215fbe2c160305e041cc85592791f383551b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670075757, "uuid": "ae4e918b-de0b-4b0d-891b-794e847887f6", "comment": "Malware payload (Smoke Loader)", "value": "0bfc75659f34e3f30236b233d210432026506c9695b6db570e9b2544379f89fbee42acd04bb90dd09cacbb898344bd85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075757, "uuid": "c6ffcc05-64a5-4d0c-bb2c-c5a453aed1df", "value": "T19374DF31FEB0E832C6D354708466EBB09A7FB93259A099C733662A5D5E303D18673376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075757, "uuid": "1f33ccd5-c920-4400-8d0b-083b3b199f35", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075757, "uuid": "2da0dbb5-8a91-4c19-9af1-804443ab6917", "value": "3072:9zx89fUqsAVslg5JEg+r9NeLc4PSAfUOBGnWNTC6NRMHnlXFfMn6HYDrU9:I9fpsAyKorinRfunMW2RqniyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670075757, "uuid": "fec5ff52-4028-44e5-a0ae-bb84e605e0d6", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670075757, "uuid": "b96df459-0068-41ad-b3d1-cf11bf544bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670075757, "uuid": "0c0c2e54-04fc-419d-9d46-5e2b21d6ddb0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49181fad-72bf-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670040140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040140, "uuid": "40216827-65fb-49fb-b534-c7d5fd951cb8", "comment": "Malware payload (GCleaner)", "value": "8109a7e15349d328aae3c3b248a11b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040140, "uuid": "2d037fa5-31d5-41e4-be3d-b85002b14475", "comment": "Malware payload (GCleaner)", "value": "ce4ac721e112c8cd58f042b9d371d641597b4dffd91d402c5372df8fc1fc60ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040140, "uuid": "91594215-dea8-4634-a0df-7e05d31e5aec", "comment": "Malware payload (GCleaner)", "value": "840bd56dc257e32ea17c887624a9b9a743d461bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040140, "uuid": "2fe7e80b-9c9a-443b-b845-a36b928c1c8c", "comment": "Malware payload (GCleaner)", "value": "258ddc0e3e07484a9f805eabfea3ddfc6731dec15af09bd981fad3d41229281bcffcd3e86fba8316845edad1034768e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040140, "uuid": "5dd90999-19fe-4e9d-ab7b-f344a3a98521", "value": "T18BF5338362F27C7DF0189B741DABC90C1E111FF37851D61DB11892DE7696F8AA8F221A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040140, "uuid": "94d644bf-58e6-4a98-a47e-c9241595309f", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040140, "uuid": "79f1259e-f8a2-4ed4-9a6d-38b3d5f41077", "value": "49152:weVUpJp5chvoINUtTFSHGELj3k47lTTv4a3XSSy/7DjwWyK1GYZjA8UsbIs6OLAE:wRpJp52voINEb6Y4BT8AidbX1AOXcyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670040140, "uuid": "da1a7fd6-c95d-4041-a22c-94ef4c6bb13d", "value": 3626270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670040140, "uuid": "f45eea6d-3b3d-46c7-8471-f05f59f95575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040140, "uuid": "aa487946-7a32-46de-8a15-0537968f8050", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345ef1bd-731b-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670079619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079619, "uuid": "0e19b8eb-8895-47d9-b15e-3ada6d27654c", "comment": "Malware payload (GCleaner)", "value": "88285e81d0f5a078eae78e16dde8efca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079619, "uuid": "10017330-be67-40f4-a4ca-d7ed0733e317", "comment": "Malware payload (GCleaner)", "value": "ce5af3b0de5438041b6fe17464d25a1023572d74a3851cebaa5670e30ed9ed6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079619, "uuid": "a703dec7-72e8-4f33-a2cc-04b99a1d44ff", "comment": "Malware payload (GCleaner)", "value": "a3784243505768aa19056c04a666af28d43690a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079619, "uuid": "c7c89ae6-abb7-41fd-83cc-d10816fa2cd0", "comment": "Malware payload (GCleaner)", "value": "e7e25d1a9b7c93a770a2e85c0cd28740e33b7801a0997be474f1274a2b25e015a767bd6f99b7a3df25f015fcfbd90ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079619, "uuid": "963feb1f-2247-4a52-a303-e5342b974f36", "value": "T16306337791D79B39E06BAF335CA384804C6E332192B4D9E727ED8A5D5A6B48DC10432F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079619, "uuid": "656d9351-a1d3-4b11-b895-d17e61b19ebd", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079619, "uuid": "389aee6e-08fa-4f80-a89a-412122aa51af", "value": "98304:8+5aNAIvEEsK4LfXExr8mPTBEnAfFC8CMV6HgBeO38sXcyA:zasESX4rLPTB1fFXChHgB38sXcyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670079619, "uuid": "93fa67af-dde3-41c9-9eb3-316009c82202", "value": 3740826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670079619, "uuid": "1aaa6ae7-af59-4ef7-a65d-f868db1892fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079619, "uuid": "c272f65f-5963-4e8c-8023-e646d56061d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef95eff8-7338-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670092389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092389, "uuid": "f706dc3e-d124-4d89-a434-339d86dc6458", "comment": "Malware payload (GCleaner)", "value": "0ebb6ba14dac9da560adb466cb57ce47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092389, "uuid": "154fa0a8-ce67-4cda-9537-643fded6b3cc", "comment": "Malware payload (GCleaner)", "value": "ce8c362b149741c5d5430d2bd6947cf6e0675e5ff13efbd9b2d497fadcb37f76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092389, "uuid": "727bf28e-d111-4b9c-917d-1ce6446a95a0", "comment": "Malware payload (GCleaner)", "value": "520f8809fe36c210ec73439e5730b3307603b78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092389, "uuid": "647a6d43-f7ad-494a-93e5-bb231c3de569", "comment": "Malware payload (GCleaner)", "value": "54c912b81931d1ca8dc83ee1ca93a99f73aa276b024df9fe6b4287b1696b2207e7a8650f620172b6f26180445244f80e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092389, "uuid": "2849e2de-1d37-41eb-ae28-7918f015e520", "value": "T1E0F53363B5B700B8E4BDD03E9AEE43484E63B6695979171B379C09B3063A3B39E10771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092389, "uuid": "6f657842-19b6-45cc-9694-055f0c02d43c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092389, "uuid": "92554451-1117-4f7d-ba69-016e0cd7a46d", "value": "49152:ojSrmHXmpoQYNkM2A0NMIuxutWatq44ks4WPFIXZicAyauyPfyr1xcQr7mT97AG2:oG+mRYNLB0NtM3atrvs4WOqQWhXcy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670092389, "uuid": "7db5a8cd-6d7a-4b68-a91a-15085d75812f", "value": 3626277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670092389, "uuid": "254b0698-eabf-4b9b-8fca-2781de8c0b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092389, "uuid": "e0262063-2b3f-4e57-8486-ce62a4b6e1c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef42d0a-734f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670101917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101917, "uuid": "1057e2c7-9c26-4f6d-ba91-a7020466d51b", "comment": "Malware payload", "value": "bf6b8ccb1dbd0a35081cb4a5a41ef009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101917, "uuid": "d3b8f873-962b-4cd8-8b02-ed3ce24af87d", "comment": "Malware payload", "value": "cf1b1b00d00a831862ee3cd39eb5949dd95013cd99ca246e991fd089b0bc16db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101917, "uuid": "f585d655-e7c0-4f65-b2a8-6740cea75885", "comment": "Malware payload", "value": "9c3285a7ca34a72bdbf8e3a81e5c9c1079e14541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101917, "uuid": "67d2e699-a9dd-4db3-8089-11aa9d16ce73", "comment": "Malware payload", "value": "ab256638316d9ed0dd0dee669099667b9afe48eb02515c110adb05712f13771811db135c98f9f6561d2b9034f597ae51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101917, "uuid": "f9060a50-303d-420e-9ea2-f2cb7a0175a5", "value": "T17374D03036B0D872C59305348466EBA1AF7FB87259A58AC337296F6E5F303C18A76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101917, "uuid": "56d73f72-79bf-48e2-b5e8-1c58da772ba1", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101917, "uuid": "3f8d027e-57a5-4874-a4fd-91febf076f59", "value": "6144:CVvWyYHjCqafn9aQ8re/nMW2Rqn2bS3ad6Y8:CFDQjqnN8rePMW32bxd6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670101917, "uuid": "cbf103ab-bce4-403a-bf94-57c76177b55d", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670101917, "uuid": "3d5d9046-9c19-42d8-9cfc-6a1732c55300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101917, "uuid": "e94b8bb6-472e-4f9d-9c57-3d7fe8e5c7ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fddf547-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670052688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052688, "uuid": "a62a332f-df2d-4d5b-b97f-e8779b8bb79a", "comment": "Malware payload (Amadey)", "value": "4a611e1883d30b6a35bcfa52473ce39f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052688, "uuid": "3eeb136d-db92-4c33-a66a-e5f16a88721d", "comment": "Malware payload (Amadey)", "value": "cf43d34189f3b253d13a61d5939f1a6642eeea54483b547f460556356eb47ffb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052688, "uuid": "4dd7932e-8623-4e14-b3ae-1dff7637a512", "comment": "Malware payload (Amadey)", "value": "39076e3fd308fef47d03935ce0ee54bcca6f5138", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052688, "uuid": "5eb7d503-3d9f-45e6-87db-3ef111433f17", "comment": "Malware payload (Amadey)", "value": "905e7537be5307a68a8649b2ddf8d70e611b9b22b2f20611ecf4eb13e9d28fa3b0938123c3b4b8c7ee253ed6d3690376", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052688, "uuid": "b4e58af5-c281-4062-8077-6ae9a0b0c787", "value": "T1CC84D010F590D876C59201FD9852EBA89A3DA8F19A24C94F33A42F2F5E733D196723C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052688, "uuid": "87f09a05-6010-40fb-aa99-bd5c689fad48", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052688, "uuid": "cfa7c43c-9d33-45ef-a6aa-5579e247a774", "value": "6144:lr2/Z8TcRRgx9M0lTIVt/cS3KBwKyuR+EYij:l8Z8TMc9M0lTIVt/cSaBzbR+NW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052688, "uuid": "a21f2334-1184-4ec8-85ec-014ac8f90f03", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052688, "uuid": "0ea670b6-8b60-4df8-90a1-0315c3e98a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052688, "uuid": "b00a3002-dfc5-4c3a-900d-b76183dbb54d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3942b445-7334-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670090365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090365, "uuid": "dc5d299b-ae56-4c36-bc80-59f79277b9af", "comment": "Malware payload", "value": "feb10dc6bb6535afb1359d6ab5542666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090365, "uuid": "4c1eaa75-caad-46de-96a5-f15a038d6638", "comment": "Malware payload", "value": "cf944362d88ca9e50ddba1ac4661c6185e9d2be1727ec4c78bb003fa3f4a9309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090365, "uuid": "ef921920-9726-4e8b-92aa-9016a1a32eba", "comment": "Malware payload", "value": "2fbe7eda660d382527a7cfadbfd1b9e174893227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090365, "uuid": "d2403927-76f6-44c0-8a24-becd736e16d9", "comment": "Malware payload", "value": "c4e8df8fac0716819bab011b7f443fe9049a443096cd5f1ee08a03e44921b24cbeb61dfb4777d3980cbb20fecd595d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090365, "uuid": "f67fe25f-4ec0-400d-9012-a6bdf466da00", "value": "T11275235497728576D8EB0C38807CF7B606A835326778CAC3A3C2952EEBB51F0697471B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090365, "uuid": "6fc7172c-761f-4e82-84ee-7d0ec42bcd60", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090365, "uuid": "4f865045-484e-448b-8ecf-39b8dc3455ca", "value": "24576:kIUV/2ENzR7u1cfwOcPnzfLRAD8fnwbou70tvpDvCP817fs:cNVK1FBTLRAgfnCoppLCPUfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670090365, "uuid": "da659642-d9ba-42f2-9ba2-8211e5fb42f6", "value": 1615256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670090365, "uuid": "c18732cd-6435-4b53-a00e-bba8fcb12283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090365, "uuid": "662be614-da4f-4189-a090-92e2b7687542", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb65633a-72ad-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670032601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032601, "uuid": "c13dd8fc-8eb1-4132-bab3-e3ee647b029c", "comment": "Malware payload", "value": "6a21bee2b2c2a299a1ec2a1a681afad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032601, "uuid": "13422a6f-a351-4d9b-b80c-2dfb2e54b8a4", "comment": "Malware payload", "value": "d02073df234f693d60aac7218705efef297e6cab2d320f60ecbf280006301228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032601, "uuid": "1bff6521-bdcf-401a-837f-d8c293102194", "comment": "Malware payload", "value": "bf7d67faf807519d95be4c20d15cd72e877ab556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670032601, "uuid": "15aa1708-2c6e-46c5-9116-1219bb9f03f5", "comment": "Malware payload", "value": "ce07bc7b65b96715793c6764845ae1187fe27162670d04f79dcfbfcd27d7218dd0ed874238ba319495220002fa095520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032601, "uuid": "d6a017f8-f9a8-4292-a72c-7d499db241a6", "value": "T1A7B533A9B830046AC54AA1B40C45836AE6FDEFD934CE47BE4A31854C9E8035DF5F9C7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032601, "uuid": "253f9221-b2d0-445b-8729-30cea6d10720", "value": "92b3e704f77c93397637a30b9013702d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032601, "uuid": "271ef992-5c5c-4f51-af02-cf3c38a825e4", "value": "49152:z6LA1uNZF4ezU+mDzLhjBkP7QisyfD6jo/QZYcMpiyQsChxCM17yX9x:zGFZPm/JBGUnyL6jo42cAihFCMoXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670032601, "uuid": "c2dc48f3-f6fb-4cef-a08a-247fac70ad86", "value": 2466816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670032601, "uuid": "bfddeea5-c0ad-4a94-9e14-a6ea28f442b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670032601, "uuid": "d9c3716f-bd11-4f1a-a05d-ec82a7acf040", "value": "CrackME_v2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b64415-72c8-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670044061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044061, "uuid": "050e2327-9cbd-4f20-98c5-97d08a01fd80", "comment": "Malware payload (CoinMiner)", "value": "ab5f3a328764bd1df74b9e042bdd702e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044061, "uuid": "68b182ad-5c5b-4efe-b529-1c6630c94252", "comment": "Malware payload (CoinMiner)", "value": "d15f2dcf4e0705b78a1736eac273dbdece6317df130b740395f45e761ae5dca2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044061, "uuid": "6a633d79-b6d5-49be-bae5-a5bdd73b0935", "comment": "Malware payload (CoinMiner)", "value": "fc39f240cdf0716e63e75f69fc59ea4e44510003", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044061, "uuid": "3a3a97c1-885e-4fd0-b4e7-dfa41243b76c", "comment": "Malware payload (CoinMiner)", "value": "9dfd4e09d3021cf4261ff57977dec79016260b4463f431f62aad3000d2ea7675db45b5a44fc3b6b37372de41256f97e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044061, "uuid": "4fee780a-a1c8-4647-a226-a8cdeabb80b0", "value": "T17665D082F7C0DD25C1F602319AA64A65EF35F65762360B4A738DF32B5FB2B809903746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044061, "uuid": "6f325a17-3201-4932-b638-471d5fbb4418", "value": "9af99c4647e788951fc37fd2f8305eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044061, "uuid": "2e72037d-057e-41a7-9734-49b4c1d3bb0e", "value": "24576:GS9mE7v7zmwbY2QkHqai6GuJFESjBndfPV135tRJ8QFFYwiWjLMTYSnMF:GS9mE7vvmYY29qT6GuJFESF1J/pJMkSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044061, "uuid": "8da704f9-e877-474d-ac03-efd443e2793b", "value": 1510048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044061, "uuid": "f9a072d7-ce59-4a07-9222-86889d3967a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044061, "uuid": "0e72c43d-dd7d-4452-98dc-0abe53591163", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b925c9e6-7308-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670071682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670071682, "uuid": "6aaff9d6-3e84-4095-8fda-83b7f011843f", "comment": "Malware payload (GCleaner)", "value": "d509720b66ec14b7d69a4d49be0f1b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670071682, "uuid": "48a897b6-1e35-421f-ba8f-d2db23b8b6f5", "comment": "Malware payload (GCleaner)", "value": "d2eb4d2563623062275e4ca9ea5056efcb67d888dedffcfa87c5295133a796c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670071682, "uuid": "638d66eb-f03d-49fc-92ad-d9a28e87188e", "comment": "Malware payload (GCleaner)", "value": "ad479e271d43e6a8d8c196bbbc505b7b46ee2deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670071682, "uuid": "a7218a9a-ca3e-4ce7-b384-2938c72a7c31", "comment": "Malware payload (GCleaner)", "value": "0b23ca680e59b976a96cb4ef5d2b972bacc44c572023a494d664c1a9275713cd2402f6d2160dc507962284cfb49188a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670071682, "uuid": "febb4ad5-6bc6-4642-ac5d-c4e8ba3d960e", "value": "T1EDF5330AB2A445BEE2534531346B99745CB1FFB12CAADF5D29F9CD087F7ED800288A4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670071682, "uuid": "df1d9958-2695-44b3-af6e-c96238e988e8", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670071682, "uuid": "1c2da2c6-67e3-4bed-8453-a144af14ac83", "value": "49152:MdPaq9hzpaGw4eSyLqV+cMKEjaLqlNFv0CiwnSKcyxRsHxsCs5A2FLe2y6eAG5cR:MocRw4et+rM3GLsXvMwnxsuVFytXcy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670071682, "uuid": "550dcf8c-c889-4388-bfaf-7896c65af8b3", "value": 3633715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670071682, "uuid": "3bdc60bb-dd03-4423-ac66-b586cee7b5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670071682, "uuid": "265fa542-c7be-4cb7-8e6b-4fb3bfe872b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9ac4ab-72c0-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1670040817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040817, "uuid": "5294eb0e-c79c-4fbf-a938-3242a2068d65", "comment": "Malware payload (RemcosRAT)", "value": "163a36cd5f528caff118561c41240852", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040817, "uuid": "3df27245-8c68-45d1-8baa-4d801ef98d0e", "comment": "Malware payload (RemcosRAT)", "value": "d2f787be13758751d4f892c5d06477ef18f3c63adb8fe5a7ac675c9cd9bd749a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040817, "uuid": "84a80802-b201-44e2-88c7-8f00472a0ed0", "comment": "Malware payload (RemcosRAT)", "value": "4ff998c1bc785941acb567cdd21d657069e2f271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040817, "uuid": "978024af-ae3f-436f-897a-aebe8a506614", "comment": "Malware payload (RemcosRAT)", "value": "fef452b3f75ad1e21f90157d082fc2ca4e997bfbbf188181b74aed90fd2db9fcc7701be21a4383d5cc8d445deb559e50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040817, "uuid": "923b47cb-e668-45d7-bb49-f7fd462aae7e", "value": "T18AB55BCA66003C61AB5F1F9CFE4214BCC87699C7BC8F12815ED14EE1A07BF69E189947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040817, "uuid": "66172a57-3946-4824-b2a8-ba622d2dd7d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040817, "uuid": "644a91ff-e2cf-4aba-a401-c8d1e12f2e8e", "value": "24576:h8RiqGGj95kr7Ad2gE7pbTFxCqeu6tHHe8tKaKFDjo5ppPK4os+jrGFLrFu/C6VE:I23Kqed+YkFDULr8qmmnosrD38CPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670040817, "uuid": "bfeffbd8-44e9-482f-8c51-2668c3fed126", "value": 2350080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670040817, "uuid": "e045e204-016e-4038-a565-2651f5085377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040817, "uuid": "15e40eca-db7a-4e11-9d63-67edb227ab72", "value": "163a36cd5f528caff118561c41240852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c12604-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670056368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056368, "uuid": "b307df9f-3344-4f68-b1f5-aa5bbb0b5f64", "comment": "Malware payload (Smoke Loader)", "value": "e2e2e31932c081cbf967c5f727b886a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056368, "uuid": "8fe0ffac-c377-4c95-8572-83ed9c4fb2fb", "comment": "Malware payload (Smoke Loader)", "value": "d30ed21eceaf577b6b281081531de1186a8a52c5576049322b8f870fcb803995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056368, "uuid": "ac86f4e9-8ed6-4130-95c7-33ec83509f37", "comment": "Malware payload (Smoke Loader)", "value": "a410c811a346989909ea013bfeec8b8825185579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056368, "uuid": "fb298384-339b-4b50-a434-2452ff036dd7", "comment": "Malware payload (Smoke Loader)", "value": "109ef622e4a33ba9c5edef66b4fdd2aaf4352367435e0fabc51f42e6dd10e4fcbf6d57045e02863af416f3ae60001ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056368, "uuid": "7efecfc3-7b22-45b0-aad2-48ce211a17ca", "value": "T13A74E03C76B0D472C3970431886ADBA1AA7FB8325E609AC73329276E5E343D19772357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056368, "uuid": "9799cd84-b305-4e90-9b41-264de06f2c4a", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056368, "uuid": "f6b29305-840e-420c-8c85-1f83c10430ae", "value": "6144:uksqc2SPYhWuB4WqvRxgBjqy6bInMW2RqnkbtC5Yi:ukk2SPWfq8Bj42MW3hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056368, "uuid": "0f6abc68-0506-45a0-957f-eec5ad090b30", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056368, "uuid": "3b045617-30f3-47a9-8e14-b1d95169dee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056368, "uuid": "934123d1-da3c-4d39-b38f-10b1dcbccbbb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a00bca3-72e0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670054450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054450, "uuid": "71ac0391-4f2c-442a-be14-c8fe2ff1f186", "comment": "Malware payload (GCleaner)", "value": "2b6f11fd8c84d19b246a2831088d6394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054450, "uuid": "63d98f40-8520-4309-ae7a-9e06eb4f71d9", "comment": "Malware payload (GCleaner)", "value": "d3c82680c24a587f976d3e1103c0fb975e0775f46d4e1c45312eca4b34056383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054450, "uuid": "e2b65cd0-8560-4cb8-bc3b-ef811622b5f8", "comment": "Malware payload (GCleaner)", "value": "d2c3963f2826d1342dae5ffd7c7342085ed87a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054450, "uuid": "29df868f-4712-4c62-aa0e-797723b9bb0a", "comment": "Malware payload (GCleaner)", "value": "0bda679b446406a054e864438506c2a9e25c1320c1e48822547e5395a6d30d0d89b944ddbbd98c4800ba775511779b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054450, "uuid": "aa47dcc5-1f00-4f48-9789-ea2956e91397", "value": "T13106333192894335D442CDB22DEE8E40B939BE2D1570520AABCC9A9FBF1F18B5CDC716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054450, "uuid": "10e584f3-892c-4477-9482-2d24f90bd42d", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054450, "uuid": "55117306-a02d-4321-80be-492b81d897ae", "value": "98304:oBcAsXLLNedLmUKp1N2uMQItKkGpwxEgt+3yJ9YmBXcyR:ikLhtRpLRIMkDqgU3OY6XcyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670054450, "uuid": "e33917b5-b551-40a8-885b-39a67475453b", "value": 3775069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670054450, "uuid": "7f097eb5-f80b-4d42-be16-1e48695a98cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054450, "uuid": "10a71f79-5d8b-4521-b5e5-398dbc46b774", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465fc70f-72dd-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670053021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053021, "uuid": "24e443d0-f02c-4391-b75e-4ab53cbe5af0", "comment": "Malware payload (Amadey)", "value": "8578a09c89a40c85aa3b3b39837a419a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053021, "uuid": "2029756e-de94-436c-91c1-d3b933c68bbf", "comment": "Malware payload (Amadey)", "value": "d4bfae1379a9f3eb7238c0a4270515bcac286b844a74df15efad136ffa4520a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053021, "uuid": "1e887391-d69e-479d-b964-22260cee58b6", "comment": "Malware payload (Amadey)", "value": "5bb8a1531f0918a48cece91c00fea7a44cc80026", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053021, "uuid": "2b0164c5-3079-482b-9db2-3b15f8a5025a", "comment": "Malware payload (Amadey)", "value": "d363166b889e09899f3b23671d4bcc9d08b8f770d8715021ed95377037f5d84196e91ef8bf3f9902c5f5f0ee79689b46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053021, "uuid": "de1b25ee-731e-4290-ad64-02bac88ba7d4", "value": "T11284E03076B0D472C25305F18466EBA0AA3FB9315DE59AC76328576E3F703D1AAB6307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053021, "uuid": "8614ba89-d9dc-4ad4-b94f-918802a6cdb6", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053021, "uuid": "bd324944-5b56-400c-93f7-73780aee64b6", "value": "6144:qpnwBUuHYh49ihcw6r8cxMmyEaWAKryrfsnMW2RqnzfrYi:qpIUuHDihcww8hmRAK9MW3DrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670053021, "uuid": "51db27c3-eb89-4e24-94a0-73d51f0097fc", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670053021, "uuid": "d3c01ad9-a88c-447f-b2f8-869aa60f9cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053021, "uuid": "f0186e77-690c-4c36-966f-7f856d6296c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b38447-735e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108606, "uuid": "5eb1e3ec-d751-4383-b356-c4a9e088c5f6", "comment": "Malware payload", "value": "6026b5d4deda1d0007324b1eb58e23f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108606, "uuid": "37885d61-5c20-4b1b-a081-9d0d9101b04f", "comment": "Malware payload", "value": "d4d224c2bf90b16864397b769eaffc56833f931be0712d41ecea43754cf848d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108606, "uuid": "d97204fe-7d03-45f9-915d-e73b65cf984c", "comment": "Malware payload", "value": "a170b2b037efb23181517952a8b36076f49cb23c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108606, "uuid": "8afdd6b2-7743-42df-b567-c3fbfe00a03f", "comment": "Malware payload", "value": "c30b655fd48c676344a7a85de206ec074d6c435f1dca26e45c656f36cab0ea82c496c4ea53232090ce37e8431f92e433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108606, "uuid": "cd0ef754-6517-40fb-8b72-19215732faf0", "value": "T19874DF3136F0D872C6A309359466EBA42A7FFC3258A19AC737281B5E5E703D18776383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108606, "uuid": "3da9ebba-0a97-40d4-8126-0354c3fe46e0", "value": "c13a4ce7a96b7de18434d9eecd3ddb46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108606, "uuid": "b4dcd8ff-bb24-4814-b081-18eb4968b591", "value": "3072:NhZjntG+vOe3N/5sCAtOjUJ+yYjV2api6EQGNfjt5SxbcGnWNTC6NRMHnlXASMRU:JD0XiN+PwgJ8ISzETfjt6nMW2RqnHnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108606, "uuid": "8899dbe7-422e-4702-8b5e-cbb3aca02db0", "value": 343552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108606, "uuid": "27248f46-2c23-4fad-9142-187f3d97c7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108606, "uuid": "f0698b4d-7f30-4c0f-8a4f-752ccc8a4ce8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ede4f0-7329-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670085922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085922, "uuid": "fee3f223-b4aa-41e8-a2db-164dcdf5e2e2", "comment": "Malware payload (Amadey)", "value": "7128bce0bb1d7cdf6ba8159ed9d40818", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085922, "uuid": "8c99e2b2-c90e-4b54-a0aa-463e991d27a2", "comment": "Malware payload (Amadey)", "value": "d4d5774f845060bdccd0d2c0dc3562c756f2d2db710b2d98a9a64e38c50871af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085922, "uuid": "54653188-6092-4cb2-885b-a8be76012929", "comment": "Malware payload (Amadey)", "value": "5c111b685451708a78457c7103416ef2c2d01143", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085922, "uuid": "b749071d-75fa-42b4-ac6a-d4269aa34b27", "comment": "Malware payload (Amadey)", "value": "e7cc354bb0c42f4110c0a7dcdcca0060d4643df3620a6f6ad9c71c56f2a906cf7ee6574feebe2251297aac7b15378dfa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085922, "uuid": "a4c1df53-0f7c-4127-9fb7-86ca0604b7ab", "value": "T17F84E03137B0D832D39254759466CBA4AA7FF83258A198EB37552A5E4E30FF14B7230B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085922, "uuid": "46a02e08-89f4-49ce-95f3-7541b80f3380", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085922, "uuid": "e748bfc6-0445-496c-a0b4-d4c4418f7038", "value": "6144:505zgPbAreHHvrsrCcZn+hSlTVCFqdVDnMW2Rqn0tR8Y:505z6ArMvrKn+0hVC4dVLMW30T8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670085922, "uuid": "4a96fec5-cff8-4e76-80e1-20f383191150", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670085922, "uuid": "f0c7d210-bf89-4e31-a937-c85755dc0775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085922, "uuid": "fc460d9b-4c78-48a3-8d87-2062ad212c93", "value": "7128bce0bb1d7cdf6ba8159ed9d40818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf448828-732f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670088442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088442, "uuid": "768c395c-0fb6-460a-bec4-d5caa8e7b0cf", "comment": "Malware payload", "value": "7143b2fc29bc3c3f78cf659c0fcaa69e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088442, "uuid": "c9d89edd-e35a-4260-8a7b-341f1cbf2f1d", "comment": "Malware payload", "value": "d53df721d32f576d75f773cbace780f5ff08fc4c0093e886d99eff1b71c9b2ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088442, "uuid": "f50a004a-2b74-4daa-8b15-bc048175f49f", "comment": "Malware payload", "value": "126fb41fb3a28ca9f48b4b023b321f2c699a02f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088442, "uuid": "40d5d57d-f577-4cdf-816f-e6d07394fbe3", "comment": "Malware payload", "value": "f14099a384a81be2d66844abc40e4a0a6e70610533c6a0c74f9ae4d0bbdbb878004368bdbd4c5c08b5c20b9262d72daf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088442, "uuid": "ab9edaca-6b24-45e0-93b9-3e12a001ddc9", "value": "T191F2F2486E11DF52EB1009B32D5C6A6CC9BBB7AA073F3461DCA5FD4F839615A588F340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088442, "uuid": "893009ba-a99c-4106-8f84-15dd1a6e5423", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfj:pxpJNlEYvXndUt/afj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670088442, "uuid": "03249c8c-b951-43d9-a9a2-e65c35bdeb65", "value": 37476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670088442, "uuid": "d16aca45-4e0e-4307-87ba-9f5715c8701c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088442, "uuid": "61c78ee2-50ad-4452-9136-225f8622b568", "value": "SecuriteInfo.com.Linux.Siggen.4218.18435.14046", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf9792d-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670056706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056706, "uuid": "1dc8fa9d-1e6b-43d4-af1b-4c4317660078", "comment": "Malware payload (CoinMiner)", "value": "1b190bfbfd9f9cfadbceec44a9372af4", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056706, "uuid": "fee2a09d-b20a-4ba3-b33a-2208bc2ed6f3", "comment": "Malware payload (CoinMiner)", "value": "d5e596c6e0b0d31a26a6a6343ddb18b35e0643b76cf36735d5d42b503b8cc19d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056706, "uuid": "2dc4b853-82fa-4c3a-8f44-0047dd2d4995", "comment": "Malware payload (CoinMiner)", "value": "7c7a3420794c282acdfe1bb3bf065a5fca2096ae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056706, "uuid": "3816076a-88d7-40bc-8710-05147d52b834", "comment": "Malware payload (CoinMiner)", "value": "dba33c01f5553afa749bdbac29bc0eb604dab73ef3b4df8541b4a67028ad98e35966d1795943eaadf94ef53a383d0c98", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056706, "uuid": "3b114340-74a6-4250-a551-5db77ae1a101", "value": "T1B465D082F7C4DD25C0F602329AA64965EB35F75762230B4A738DF32B5FB2B809943746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056706, "uuid": "695825a4-207c-4fc8-bb5c-475b70e278d7", "value": "2d0a541ce09cb8bc4438fec3909adc1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056706, "uuid": "08394273-3a4f-46d2-8ae4-9defcb2d2fb9", "value": "24576:9S9mE7v7zmwbY2QkHqai6GuJFESjBnyZ46eCTOsuzh4IxAtRiGK8u:9S9mE7vvmYY29qT6GuJFEMLQOsshPM/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056706, "uuid": "610944ac-d958-4af8-b50e-98ba57705ef7", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056706, "uuid": "90a4a688-21f8-4f50-a61a-072d03453916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056706, "uuid": "284812ce-4517-47bc-b3a0-c6892fa47f49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adea104-7327-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670084892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084892, "uuid": "15d917ec-2a54-4085-919a-b0ce30f6969c", "comment": "Malware payload (CoinMiner)", "value": "e8dc652bf8ad2a5d4ae605056246e7d5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084892, "uuid": "fa7d1c00-9b9e-479e-8690-2efb4209edb9", "comment": "Malware payload (CoinMiner)", "value": "d78dd90e07a471cf39503ba78c0495097d7ab7c5a0f8ef64477208fc16bf36f2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084892, "uuid": "1aa5222b-d53e-4f4c-8e59-24a898be69cf", "comment": "Malware payload (CoinMiner)", "value": "3bc3294c4949a22fc3ed0fbdad0499549885bffb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084892, "uuid": "26d69f10-d163-49c9-bd82-b5ebd488a7c5", "comment": "Malware payload (CoinMiner)", "value": "2e4a2987a858305b1796a58b07f2323c4314a666e9723a5c9b099e9054a51ae18cabd85848aadc3490b819007934ed07", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084892, "uuid": "e1e07f03-7fb1-4894-9014-b9b76d1ac203", "value": "T17115D14076D9B618F0E729F40FA5C3A78227FCE446A2961B2F34320B5A71D418F6677E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084892, "uuid": "02b50685-6920-4bf4-8012-c822beaa9eab", "value": "a0ca92c3ddaf9bcf268b6197e6bcb7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084892, "uuid": "9f6a65b0-9e32-41cc-b1d0-3d9bbfd4c2d1", "value": "12288:TIBK7N1jdQc4qZ+3IGv5+LPlHq06CXGG8ibgg6Ciz8kCoS:bjZQc4PNv0PGGQtokI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084892, "uuid": "caf5d600-dd1c-4261-9148-364ec2d8264b", "value": 890136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084892, "uuid": "1bc52b64-bebb-40e6-8ba4-e61039d7add6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084892, "uuid": "d8006404-5b85-491f-a4e9-894297970bdd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8753e017-735e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108535, "uuid": "55ff3ebe-0145-43d9-937e-cc28af7ccdb4", "comment": "Malware payload", "value": "c5918bbb61646a733472d2b57ef9f5f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108535, "uuid": "ffd18b93-3640-4f18-adf0-8d2154dd9be2", "comment": "Malware payload", "value": "d85297fb5f244a8080dc6b7f41ae4b613a320d4e4e1d25729fe6ad1e9898b03f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108535, "uuid": "c02878f0-71d7-4c4d-895e-52f40a9b1d7d", "comment": "Malware payload", "value": "8a58f0cea483ecdd0dd0445c2090e71a00d5dcfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108535, "uuid": "a8aa1cb8-f5ab-4c34-a708-ccddf6cd0428", "comment": "Malware payload", "value": "2542e05fa19325b090a3f4947e639e70fa253437fa256846394c511704e747852a8c297aa0250249cc3f98976ed60b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108535, "uuid": "b2a37e53-3f77-4b6f-b939-0ab9b8e6d54a", "value": "T1E074E03436B1D7B2D55305319876EBD06A7FB83289A099C773A9276E5E303D18A3B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108535, "uuid": "eaf987fe-423a-4688-ac4b-5155c672a8cf", "value": "c13a4ce7a96b7de18434d9eecd3ddb46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108535, "uuid": "93e33f6f-ceef-43c9-93d6-4ec2aef24442", "value": "3072:WUimvmDnsY5sVbcdmnl5n+xNldZJR0hYKVrX1PGnWNTC6NRMHnlXcr7rc7JHYDrE:hGsx5RWfCX4nMW2Rqn0k5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108535, "uuid": "44023093-42c3-414d-a184-556c5af5965e", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108535, "uuid": "ec019c62-5f49-45e8-8433-69494604ef48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108535, "uuid": "40699f04-2f5d-45ef-a07c-3ff975c55036", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8292a152-732d-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670087481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087481, "uuid": "69b48906-5977-473a-8d81-66ae3cb893ef", "comment": "Malware payload (Smoke Loader)", "value": "c48ed3d7ae1d01be749f6e0fe814ad90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087481, "uuid": "bec13b71-077d-4f82-8e50-dc172052a5e8", "comment": "Malware payload (Smoke Loader)", "value": "d86f6dc13b726f7f94dadfe4a4f23f88563361f9d8adf32648120a30eca7ba8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087481, "uuid": "d37c1b4c-6fb6-4b8c-9ed1-4e6b4c27d437", "comment": "Malware payload (Smoke Loader)", "value": "395bf3f4e8207332c1429de88c07a36ed642751b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087481, "uuid": "7c4c4527-189b-47d3-bbaa-3c756bd2e182", "comment": "Malware payload (Smoke Loader)", "value": "e47fcca463acca54c3dab1debebb77134b65932650131b96fa158ace35850218d9adb366afb9c83589a6972d71701955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087481, "uuid": "b33e5f00-0988-45e9-94dd-342d7cad6ea5", "value": "T12174D03036B0E432C64314359066EFE09A7FF83259A499C727997AAE9E703D1867634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087481, "uuid": "8074fad4-1345-4838-bca5-0308e7fa5197", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087481, "uuid": "4532e0e9-ad0d-4dc7-a73d-8844a9ad0eba", "value": "6144:sj9UIAve2bTF2EcfB/zZbLnnMW2Rqnnh9KY:sjlAvFbTFgBdMW3nh0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670087481, "uuid": "07712495-4dac-431f-b3fa-169e61c604c5", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670087481, "uuid": "729bd509-0881-41fa-9e38-2e28e34940f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087481, "uuid": "d2b70fe0-977e-470d-8167-bd15b49269b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6a1554-732e-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670087766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087766, "uuid": "d9b93966-de97-4702-be83-af3d862762aa", "comment": "Malware payload (GCleaner)", "value": "6587ec4aace9ab942700e98e95664040", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087766, "uuid": "cc89f050-c339-428d-9641-a8e3eb21fd16", "comment": "Malware payload (GCleaner)", "value": "d930511b9d6bb5665bc103ed51b34d009933f984e68b1fbd5ab8c1af22c130eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087766, "uuid": "ae4662f3-7265-424a-a9f3-43b9e9299e38", "comment": "Malware payload (GCleaner)", "value": "35a92d19f85f20e4af8e1fc3cc154114c872633f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670087766, "uuid": "e88b832c-4ea2-4565-b37e-8344bcdbe14c", "comment": "Malware payload (GCleaner)", "value": "5eccd092947e256c83762d4b165d7e9da40d0fe9a4ccb900d3590e09236fd221debc2d60104b736d65c3315b5162d307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087766, "uuid": "7788baf8-f693-4ace-9780-70b6a8d68d11", "value": "T15FF5338AB149493FD223E5B94F768E934C5F3C36AF4A150CE9E8553C0B92A1CCB4C6E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087766, "uuid": "37ea03b8-6fd1-4d0e-8758-87f8b36981f6", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087766, "uuid": "e4e7d9d9-35a7-4a52-bf37-c220a351daa6", "value": "98304:g2wlZ0ImDURdN8Lts3IBUnwl0AjH2jWKiAzCNzAXcy0:LGCzwdEts3IIwl+tuNUXcy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670087766, "uuid": "94283954-ddcc-4c8b-a43b-4472fb0bceab", "value": 3611747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670087766, "uuid": "7c841980-a793-4f24-91cf-1a944cf8081c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670087766, "uuid": "2a27da4c-5a13-49fe-ba79-69fcac694155", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdad80e4-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109082, "uuid": "bce89cb4-e765-4e06-b6e6-bd7227c75c86", "comment": "Malware payload (Mirai)", "value": "679bf5bd82fe5359e3f635ef37199633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109082, "uuid": "18849c01-7323-4b49-833f-e6dcf69d93f7", "comment": "Malware payload (Mirai)", "value": "d9676f274b046b550f5903c49fde573a32d893aeae7dd8ac32b84624b0fdce64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109082, "uuid": "6dac5e26-f861-4c8a-9fe6-b1b627617cda", "comment": "Malware payload (Mirai)", "value": "aa83a087b5f825a1e444c193bf79918950e26ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109082, "uuid": "bc8c3878-c42e-4247-8a55-a484e418b628", "comment": "Malware payload (Mirai)", "value": "e4bef8648c336ea697e076ab3abe1734992836063fabd200f5336a2b112f20151333f69647abcafa3b4b4a5fc9ef111e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109082, "uuid": "a65a571e-ed20-4c5c-a66d-297c366f6718", "value": "T1DD63D759BF610FB7E8AFDC3705A91B41288C955B22A53F36B970D418B24B24F19E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109082, "uuid": "4b9be4f5-1a68-4808-949c-2715f4cdf2be", "value": "1536:VDTxZk/08xDfZ3xG30HLvUbXQZWEOWSb+10WE6dj:VHxZk/NZOLQCePd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109082, "uuid": "c1132e82-ca18-48a1-b647-1dbe0d9ebe8b", "value": 73304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109082, "uuid": "d321f910-5f8a-4dee-8f9d-2d1b86e22252", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109082, "uuid": "129cddca-4746-4095-9daa-b21fbf801e75", "value": "679bf5bd82fe5359e3f635ef37199633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d27a66-7309-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670072045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072045, "uuid": "92a1f581-db4a-4269-b176-516592815275", "comment": "Malware payload", "value": "b4f1287a3c6d1d842d2dc026650a1de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072045, "uuid": "de35fc6c-9f74-430f-aa7a-8f84c0124254", "comment": "Malware payload", "value": "db824894422da14c58ceee2489ad61b80d9a4cb81d989dc56614e63af6c6cbc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072045, "uuid": "88a973f0-87c8-439c-bb08-cc12c93a9364", "comment": "Malware payload", "value": "3e80016742d7c25995e406d4e1f2e2e2275d46b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072045, "uuid": "d11e01ca-16e5-4fdd-af8f-04c624f463bc", "comment": "Malware payload", "value": "692565b70d1a7cfed7748be250e63af0774c3ef26433931f0c2506586673fec309526c28446220c5e6d9472e90b0e9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072045, "uuid": "45953fbd-8457-48ca-a8df-4f271998ecec", "value": "T1EA538D2579A1D432C5A364B080748BA1EEF9A53222B9DC8B5B691C799F303D1977B30F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072045, "uuid": "7236fe77-1291-4f4f-99c2-336adcc843f2", "value": "768:VUFMRlotWNZZu83vHHpSjLPRrrshzAn5ihyoRATIkPFnt+GfwQp67g+R36M1h9:VRRlotuTZpmrrshzHhTRKFcN3fv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670072045, "uuid": "bff88baa-8709-470c-95c4-2f165dafdcaf", "value": 66016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670072045, "uuid": "43483090-d6db-43ee-92c6-da7320553eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072045, "uuid": "0a29b6dd-6dcd-452e-8c0b-3e477313f8a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246a244c-72d6-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670049957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049957, "uuid": "4afb4b3a-3c01-4138-953d-fa05de86be65", "comment": "Malware payload (GCleaner)", "value": "c39139b051b7cdc6045b11f92e579937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049957, "uuid": "6b29c64b-4edd-446e-b9b1-da355710cf95", "comment": "Malware payload (GCleaner)", "value": "dbed81f341c58eb61c144eae3f25eaee3e06d7ac896904cb40dd165d61e17d0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049957, "uuid": "6d6dea38-711e-4d1a-8334-e4c54be3b4f8", "comment": "Malware payload (GCleaner)", "value": "0a778a70b30bfcd0127b7f76ba6e1c06ff1f5d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670049957, "uuid": "34a5eed6-3203-4789-8f21-8ce44ea383f2", "comment": "Malware payload (GCleaner)", "value": "4c0d7aa8148148a78528d748f3587a04fb963dac3fee667708f39cb8492e05d0d6291522dfb8457cb46b8b51455c73eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049957, "uuid": "ca9c42fc-c870-4696-9e69-c01eccd3942a", "value": "T109063304EA89C81CC0C5D9B8ED5B481A2CF63D661CB4ED7174BC91AE11B6227489F6FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049957, "uuid": "7e3fec7e-6908-4ed6-83f5-4d0f5f7ae79a", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049957, "uuid": "25cbb37f-d8aa-480f-bea3-df174c6e737b", "value": "49152:MLF2YU7jRJdz/sNBhC0TFigphnLpGhkgsA3coWIZMX/m/dFl3A5/rIQhWYGYUi8Z:MOx8kYnLGmGvCsXlw5/AKUJc1WydXcyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670049957, "uuid": "a70db71d-be7e-4354-a5ae-65047fd12601", "value": 3754076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670049957, "uuid": "dca6ffbb-fe98-481f-9954-eab5fab72ba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670049957, "uuid": "73a6f675-76f1-4f67-8143-1e75aedf5e6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38307f78-7319-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670078767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078767, "uuid": "d5847d9e-d086-4019-93a5-312029cb7f19", "comment": "Malware payload (Amadey)", "value": "9214486c9806c76b57c78d45a96f12a5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078767, "uuid": "427b89c4-9985-454b-9063-d727c827204d", "comment": "Malware payload (Amadey)", "value": "dc0ea03a3427e76cb48c28eb7bf0a57f3518fecf7fa544ae575a549851482555", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078767, "uuid": "9e924ac0-f89f-4910-b662-963e0aac1358", "comment": "Malware payload (Amadey)", "value": "3714a9b3dc5055859dfc4f17754655f34ac4e140", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670078767, "uuid": "30fa882b-7185-4d87-a69c-5865ad81a3a3", "comment": "Malware payload (Amadey)", "value": "b1394107d015cdd78dab44c250d8504a816e568712418e8237d1988a6625e7e6c24cc01aebf98c761d9cd302a2fe242b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078767, "uuid": "6f9b52fc-509d-466a-ad9d-ee23bc607668", "value": "T10B84E03536B0D831C69314718466FFA1DAFFF822A9E098C737552A6E5E703D28A27347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078767, "uuid": "dde01144-774d-4c42-86ce-dbe796d7930d", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078767, "uuid": "a4bc0b21-7d2f-4a62-91fc-8b087e1656a2", "value": "6144:4CkxAqAjKJjy2D2ZgWHbaUJxF6UohvnMW2RqnYCi3RrY:4CkmqAj4j3iZgWH2UnF/EMW3YxBrY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670078767, "uuid": "67735af5-e02d-446f-9bad-7d1697db9dfe", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670078767, "uuid": "12c4c8b9-e5e7-42cf-935d-e6664147ed46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670078767, "uuid": "be00f462-07c3-4fbd-939e-b0e051d5eaa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c82a3fe-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083230, "uuid": "e33c7830-a37a-4978-91d8-e61bf9145a46", "comment": "Malware payload (Mirai)", "value": "e91e61563750891b7b1eb35df6c1777b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083230, "uuid": "5dac7a43-2af2-4e99-94a8-dbc5862523cd", "comment": "Malware payload (Mirai)", "value": "de7c4415293ac58c70647ac7a394d0b6d3b6e30e75d98bebe0fbf473190911c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083230, "uuid": "bc5f91bf-c5df-46da-9795-cf27d1f39f77", "comment": "Malware payload (Mirai)", "value": "0e096f40f07d4781c9f65b506fa7106ea8595b68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083230, "uuid": "3ba78cd4-58e8-44b5-84f3-d8e31d62a882", "comment": "Malware payload (Mirai)", "value": "9f03bd4bcb5d40ebc014714679c03d8379c6c65a3b0db43d03c5cb8260f25998ff8996045e04b8d859a3e8ea41d5a48a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083230, "uuid": "c75f40ce-54c2-47a1-b7fe-68be41fa5b9c", "value": "T105E2F1AC99C468D1C97F1CFD10160FB29958F460B24EABC963108D9CBF5EE4B5D848BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083230, "uuid": "d25eba46-5322-4ec7-8bb7-7891c394b134", "value": "384:fn6Ppdqf3I54hJulN7s1kNYTA/fKiFs4V9B6f8Oj0bCwFtNKpugmgmqzDRWGVCzT:v4YuDs1kNJ/fKiFUf8OGCgGRm4NWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083230, "uuid": "6250cd32-c2c9-4e66-92b9-0bd8f6b2a224", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083230, "uuid": "89b96d51-1d28-4ea8-a3d2-29fb112b502b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083230, "uuid": "2a072cf5-1d29-4e3b-9fe8-4a976560754e", "value": "e91e61563750891b7b1eb35df6c1777b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8490e17-72de-11ed-9266-42010a9c0072", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1670053668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053668, "uuid": "c4a5fd2f-6d73-4e81-9ab7-89b542e5ad17", "comment": "Malware payload (YellowCockatoo)", "value": "e5123ef54da0bc5c3b96d75ede62517d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053668, "uuid": "ab386b2a-156e-4a1c-ac18-e37b5c8ac2d1", "comment": "Malware payload (YellowCockatoo)", "value": "df0ecc78131aedea3be331f007cf3c6f0575dfdbf51cac37c9db881aae0c2d75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053668, "uuid": "68732f33-d102-4a92-86f4-1821ddf05e6f", "comment": "Malware payload (YellowCockatoo)", "value": "132bf699800c7556aca3a999a682a82cc727ff57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053668, "uuid": "26032404-9964-4778-a7d0-c9a27307a79f", "comment": "Malware payload (YellowCockatoo)", "value": "869bc893f5e52db15c681d3557d6548d0193166f7755ead8bdf66d4c7e326180686f572e05d013a4325ebe8b5fcfd57f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053668, "uuid": "a6b63048-acda-43a7-a4a9-ecd24dd5972c", "value": "T1A9E48A043B65C85C8B6C26E9F99B9F17BB2456F3DAC29F0E0F9790710A1B8611D930F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053668, "uuid": "77e020a2-2334-4c16-8428-c78ee4e844d2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053668, "uuid": "215f5e95-8f1b-4fe0-baa2-30636a6c5203", "value": "12288:6pU34msySR2+PVoXSvLQnk5946xxPRiPu2v/gi4/tkinbC1tPYF3awOtEasEHYIA:6pU34msySR2+PVoXSvLQnk5946xxPRiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670053668, "uuid": "3084bd12-7f52-4ba9-b462-7fdfdfc2eb75", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670053668, "uuid": "417e4950-9354-4470-8316-54498e890f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053668, "uuid": "e6347bdf-5566-49ef-9a67-d48d14e7f379", "value": "OABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZXHqSxAAS0YOcMNOVKQQDxJ7VA4NOlNKY4XHQLI6UNMQBXDNXklXroMQ6ZNBHkelRUp2hPT7XWNRAUh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bfe2c0-730c-11ed-9266-42010a9c0072", "comment": "Malware payload (LgoogLoader)", "timestamp": 1670073206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073206, "uuid": "82f4ea00-84bb-4337-97f4-f036efb6bdb4", "comment": "Malware payload (LgoogLoader)", "value": "99a680e7d710652344ed23a9fe40e832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073206, "uuid": "04e75a9a-af77-4a74-8c9e-0b6693165805", "comment": "Malware payload (LgoogLoader)", "value": "dfd88d1b834dac64cb82037099eff4e0d062011c712b7d413041a801ba0ac0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073206, "uuid": "443dc4a1-cbab-40a9-95a9-2366f44c06b7", "comment": "Malware payload (LgoogLoader)", "value": "0a60ed32ba9c50d437d66bca85f48c05798c0d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073206, "uuid": "9885744e-0492-4d1c-8311-bb6a953155a5", "comment": "Malware payload (LgoogLoader)", "value": "36b5ff6e27cb5e6042bcc32779fbaf2b7dd3f1e0a00585cfec8d85ff333e6523029f1708dc059be4a9397353e9169aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073206, "uuid": "60888ef7-15e4-49f4-838e-a324a23d7cab", "value": "T16975230477A1D037E0261230C961EBB71739F8718A72C38BAB895BAD4DF27C26679753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073206, "uuid": "3bef124a-0220-4b16-adfa-c943e5d479ae", "value": "2272bd1fadcc3c967b255c33596d9f56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073206, "uuid": "dbfcf2a6-5636-4b6a-b87c-6515a8217d51", "value": "24576:xefSX7ktn93nXwm9pn0vONAbkqkQyHNbRfdJuOfA45TLqJqJFBURqUH:c6r4ZnWPQqkQIdw0ASJF+qUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670073206, "uuid": "ba5eb95e-2aa2-49a5-9b36-3edcec98c91b", "value": 1656288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670073206, "uuid": "5780efc1-b3f0-45db-8451-d93790eaef25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073206, "uuid": "91ffbe60-e78b-466e-bfee-52ae900cea55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bffc50-7348-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670099269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099269, "uuid": "cca4a58a-d422-4f79-8634-2aa818841743", "comment": "Malware payload", "value": "e7a81eb73e35e4dfca1d996e2e129eea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099269, "uuid": "92b31a76-1e74-4bb2-90ca-56f132429699", "comment": "Malware payload", "value": "e0550ae065b53404b7234a0426b2970b7236e71cb6f554d0b3afbaa15daf38c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099269, "uuid": "5cc24c7e-b45f-422b-b0e4-bfa19df8dbea", "comment": "Malware payload", "value": "6a06c4e8e7dbaedcce765ca0756029a8d7bad836", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670099269, "uuid": "1dfd40c6-a32a-473b-9f1d-ddd183594cd8", "comment": "Malware payload", "value": "be71f41158d8052c9f661aa1c7eb5240d7dad29a251401e67c5ac8d5e8c26e35bc8b1eae41ec5693cf3f0787b4b258ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099269, "uuid": "a317d6c1-7361-4235-b9d0-98af439a332e", "value": "T1F2533F017291C663C48A1A768CD4E6DF3B32FC62AF55865731C9B32F3C3A391DD12A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099269, "uuid": "3ee35732-2115-475c-864e-093ef190ef05", "value": "768:bGJI6LUTHuFpsvPwmayx4CjpxSz0Am7fsf:nFTkpOPFayqz0Am7fsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670099269, "uuid": "ada7f6ba-1b3d-432b-8692-effe832b7a3a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670099269, "uuid": "30bc70bf-00a5-4960-8e35-66f5aaf1b524", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670099269, "uuid": "ac35244f-e859-48a1-8559-6e37a4843e81", "value": "SecuriteInfo.com.Heur.721.30906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b57673d-72c3-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670041970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041970, "uuid": "aa201432-e0d1-4ad2-8b67-510ba2615b21", "comment": "Malware payload (GCleaner)", "value": "64884570f9e6ea1977b3f4ed158a035d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041970, "uuid": "31558ba7-3f3a-4e3a-b1c0-ea9337d5cabd", "comment": "Malware payload (GCleaner)", "value": "e2bb63161ec42b9f538d2cd415fcfc6ddd40b6a8fc6188fcd6afe7d0acee853c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041970, "uuid": "54de63de-2500-4861-a2b0-4716962dd029", "comment": "Malware payload (GCleaner)", "value": "6a5cba85718bc939361c0306620fe9315f90d6ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670041970, "uuid": "c9a5d73a-01aa-4671-8ea6-5f19cb73ac2b", "comment": "Malware payload (GCleaner)", "value": "8abbdb80c5e28ed92beccd2ca18eaafdaf78c95e35db29b29d0f443d497ab7fb07b4c3963551210554d1e2c7d977cffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041970, "uuid": "ad5a2efc-16e2-4de5-9f89-469dec821e50", "value": "T1660633B592AB0039C4C2DB7B0C5297594D2B3A2AE44A71C4F2FC44EC7B67A4C7F32655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041970, "uuid": "dfbaa9ff-c2d4-4987-8c29-3ad23fcae3b4", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041970, "uuid": "4002ddd8-4c2a-48af-b539-913d87c6ad58", "value": "98304:or1yCn+rOpmJQ46pKYePZPel6DXPCl9d9MaH0rXcyQ:A11+rSmJV6pKnRml6D/m9DvUrXcyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670041970, "uuid": "7b7420b8-8d6d-45ba-8c71-317949564f53", "value": 3722237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670041970, "uuid": "9734222c-3468-41c9-ab02-e8e1fe4320dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670041970, "uuid": "673eaa8a-5b59-4416-acb3-5d9bdb054559", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cda8c9-730b-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670072721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072721, "uuid": "0735a096-78e5-4c71-a82e-e0e2d53b8435", "comment": "Malware payload (Smoke Loader)", "value": "80b690b8932d5d7a5ffabad8628416b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072721, "uuid": "fcfbc2f2-5246-4f17-ad0a-16c0d6f24799", "comment": "Malware payload (Smoke Loader)", "value": "e2bc1df5380b61ac6a97b377f3301b1b9d69a46f7f65fb7e1a1dd0dc7b95c718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072721, "uuid": "96a45065-63f5-4973-ab8b-a39e9457ce6a", "comment": "Malware payload (Smoke Loader)", "value": "8f7e87d26dd32aeac770bd01ea2cfe944b43bee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670072721, "uuid": "8ef603fe-d1d5-4ee7-8109-ccad27a965de", "comment": "Malware payload (Smoke Loader)", "value": "9df1a31a271521d4e0946b48c2ee9a6c6018b70f61df5e4e00b26f5bc595db3e0db4d2e179beb41c6e499da4220f4aa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072721, "uuid": "9d61bb2f-7e7b-4b73-b6dd-bdfcfcd80fca", "value": "T12874DF3172B0D832C56315308866FBE19A7FF93259A189C737693B6E5E303D2876A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072721, "uuid": "7e7a08fa-bb01-47d6-bf3b-a0a37221bd61", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072721, "uuid": "caa708d5-94f9-4baa-b8a2-591466ab9e52", "value": "6144:WUYFJAbKNyDt/RD/znt9xP01b6LGnMW2Rqn/VJFY:WUAJAbuIRTzn7Z2bgwMW3/vFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670072721, "uuid": "67c9a4be-cd92-4bc6-b48f-1c46a55f3ac7", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670072721, "uuid": "6cfdb72c-5fbc-49bc-a595-486fe01d0adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670072721, "uuid": "da08f332-030e-49b0-8f5a-b9b41793a12d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3827e68-72e5-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670056667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056667, "uuid": "715ce6f2-be30-4572-afa2-bab83c93800d", "comment": "Malware payload (Smoke Loader)", "value": "219b47b51f21ead70a456ead1343d13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056667, "uuid": "b17acdad-68e9-4951-a365-3c453050713a", "comment": "Malware payload (Smoke Loader)", "value": "e31b935192ef6bf964112e08ba41179fb520963288ca5edc3b367b2c6c924b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056667, "uuid": "dc3b9f66-368a-43a7-88dc-677659c2e700", "comment": "Malware payload (Smoke Loader)", "value": "d04c4dfa8e5ef0ad8b8a485e909d2f8c7ddd58c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670056667, "uuid": "4800a370-d066-4ca4-89dc-273483b8e671", "comment": "Malware payload (Smoke Loader)", "value": "f3e8695e1508a2d50f0d7b43842b9fb568d68688e86622458a87c2c6ce387258db6c015b748818cb6430a79c5d806ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056667, "uuid": "edbbf88f-24e0-462c-8c8c-666c9ea4599f", "value": "T10774D0317A70C472C69315318866DBA0AA3FBC315DA59AC733692F6E9E303D18B76347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056667, "uuid": "a7c52f03-3844-4913-b4d9-294d67ec43e3", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056667, "uuid": "6fae15ea-6036-4bbe-af13-8761dd191634", "value": "3072:uqp8z7PxgTSvV5QhpgLysbE8GYlJz8tBZPkBGnWNTC6NRMHnlX4UPsAkHYDrwT1:/avPxgWvYhp7sw8NYBvnMW2Rqnd6Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670056667, "uuid": "e7594804-64e6-496f-9307-2f31ccd67cc0", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670056667, "uuid": "ff335dba-060f-4a9f-9997-eb19d11c1194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670056667, "uuid": "c33e17cf-59f6-4671-81f0-14bdb8413921", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fbd7b9-72dc-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670052728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052728, "uuid": "bf10b9ee-51b2-4091-9d3c-14548806177e", "comment": "Malware payload (Smoke Loader)", "value": "be68e8883c5bdbb0191140ebc0cf57f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052728, "uuid": "85f65c24-0f30-4fcd-818e-8951f54969a2", "comment": "Malware payload (Smoke Loader)", "value": "e32c3dd973130b2877455c54a61ec73e36f375f5aa1e8e52d3b526bf8a5d0b1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052728, "uuid": "b677b405-2c00-4205-b473-81ab3533c50a", "comment": "Malware payload (Smoke Loader)", "value": "b2b568c51da5f6e97144fd363f94de7437187952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670052728, "uuid": "ef3f885d-bd21-406c-a07a-8c14a5ff6616", "comment": "Malware payload (Smoke Loader)", "value": "6ddb8df2e96d8798f5e9b6422311102a3b6013317fcec69c10a030498f7f443a0c37300d5b510398b2ad59f0ff6f8608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052728, "uuid": "ccd414ff-b575-466b-9e74-a2d2b46bfe07", "value": "T11374D03072B1F872C5930C328466DBA19A7FBA36596199C7336D1B9E5E3C3D1873630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052728, "uuid": "1445abb5-a6c2-4935-b796-35f73a2dd09c", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052728, "uuid": "66615cac-23c8-477d-bbb5-f8b324ea4f34", "value": "6144:qnpvVo5uqYhaKzG7tX2fCKnMW2RqnCj1Yi:qnc5uqIih2KcMW3y1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670052728, "uuid": "7077115b-b453-44a5-a344-3ab042061521", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670052728, "uuid": "03a6d0e8-1af7-4521-a2aa-ad1ed214e87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670052728, "uuid": "e37b15be-df4c-4b6c-93bf-dcf13af23a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846c2cd8-7321-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670082331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082331, "uuid": "e389f998-6f1e-40b9-8d60-8c9cdff126c9", "comment": "Malware payload (GCleaner)", "value": "21ca74e54be1896cb33d068e8fd4fe40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082331, "uuid": "472871cc-e226-4382-82b4-536a04321c84", "comment": "Malware payload (GCleaner)", "value": "e3334a5082a5817ae5ee6cedea82113f3fca0207ef46088209ec53b8345a10a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082331, "uuid": "65c3149b-81cb-406d-b175-179e3bbffe47", "comment": "Malware payload (GCleaner)", "value": "a0f84c9434ace925648381f1cccf41a294d9395e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082331, "uuid": "47051d09-bba2-40f1-b8c4-021350a46202", "comment": "Malware payload (GCleaner)", "value": "973550e73dfba7478ca99cdf0b13c31dcacba3aa1577468c1922d999300de6c0a485a905ddbc6ba8a7f8ec20fdce9186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082331, "uuid": "13c333ef-555b-4f3f-8fad-30821e59d3dc", "value": "T1DA0633E0FA019079F5615F325906AC3C2EA9FB375861B198B38C0A612EB33FD51D5B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082331, "uuid": "3dd49edf-6bd1-4a2c-9490-a5403f532c92", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082331, "uuid": "f7109d01-f997-42df-88db-79ccd5931413", "value": "98304:gJKkBv3KKHaxhcizQvhY+9KOlixbX6glXcy0:1+NdvhY+zliZX6glXcy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082331, "uuid": "45235bbd-5fea-4b02-92a7-7af5557c74c9", "value": 3796416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082331, "uuid": "6cfcdcda-a1f0-4c18-91ea-88d2e176ab15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082331, "uuid": "62c6828d-45a1-4d3a-8765-eb118cfeb64a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633279d3-7335-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670090865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090865, "uuid": "ab66976e-4617-4286-8fc2-4bd0bf186f85", "comment": "Malware payload (Mirai)", "value": "42147bc74f24f10061f1b627fe4b88a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090865, "uuid": "72e0d35b-e8f8-4012-9bb8-a7faf764bd6c", "comment": "Malware payload (Mirai)", "value": "e3bda371a1157df145baf66773604e18215b4845775db36d5866cd1d16232c3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090865, "uuid": "d54e882d-2d24-4bdd-a5b2-a26c1fa13e6c", "comment": "Malware payload (Mirai)", "value": "d5e4d09564c312fc1f3fdf83d7a7cef1782f3a36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670090865, "uuid": "1d2b414d-5df9-4e1a-bb6c-75090dfc56b6", "comment": "Malware payload (Mirai)", "value": "5fc508f0d3e2ec29a700240a706ddba35b76992266d4925023781d3fd760a0214db3eb7d33a050b2bfb938ebbab6acc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090865, "uuid": "92abdb53-cbf8-44a8-8367-f0b49e64aba2", "value": "T16E13085273090F17C05329F0127F4F918FAAFEE21AE0B1C1A16EAED685359F32146E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090865, "uuid": "f0627c75-6b80-4c9a-8d1a-8f69c3696c86", "value": "768:onV7Rp4b82ciWTdGu7IuxdK9IlWS3CvB7QxC2TcwbZ010U5Mb:8c83VdGz42Syp/Wb+10mMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670090865, "uuid": "be6917d8-cc71-448c-9a0b-e82fa687cb9e", "value": 42500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670090865, "uuid": "057671f4-9fd2-464d-b333-e62ebe638d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670090865, "uuid": "2c31d09a-639d-411a-a1c4-2ffc5ed5f3c5", "value": "42147bc74f24f10061f1b627fe4b88a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76014936-72b0-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670033773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033773, "uuid": "b8658c52-3c97-4ee0-b78f-29beaa961dce", "comment": "Malware payload (GCleaner)", "value": "ca73297ee6ffbeb4fe802ebbf30bf0c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033773, "uuid": "e9b5f423-9acc-4a3a-bb3d-91f3cd3f9eba", "comment": "Malware payload (GCleaner)", "value": "e6d69aeb75068fd5e6f6962a8d069c155c0955b5c1486da25dcf7dfb68ba15bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033773, "uuid": "3722143e-1fa7-44f5-914d-320e004c6bd7", "comment": "Malware payload (GCleaner)", "value": "d17b1264499dc39aafa5ffc83d710255ca054b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670033773, "uuid": "3d43f399-dcee-4af9-8903-a93bfa359263", "comment": "Malware payload (GCleaner)", "value": "ce9fd1e9350118db73c932f02d784c65412ca8599865c03534750f02d3708bfc03c35ca4d8952017be51a8f1dc6ab27e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033773, "uuid": "148fd014-dfbb-46f9-8d33-04d98a0f4e20", "value": "T17EA53315D3F19438E622F7789D6FE8461D336A423C95D685D3AC43882F374CAEE98392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033773, "uuid": "b34901e7-6188-46cf-b99e-a1756d6b2907", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033773, "uuid": "d57c5365-cdf0-464f-9310-a2d0e1c2d90a", "value": "49152:MPYtWHhjMvUJGw/fodxVZSvgUnKCkFUk5aRWAG5cyz:MPeWZM7M+SvVKCkFdpXcyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670033773, "uuid": "e63b4aa3-e3af-4cfd-ba1f-45d2df38dd63", "value": 2182862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670033773, "uuid": "98d3f7cb-9490-4c2a-80f5-42e454e48f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670033773, "uuid": "68add0dd-6085-4127-a874-47b37d9b7599", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91256840-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083211, "uuid": "343f8bcc-b6b5-4559-9175-cd220675f9f4", "comment": "Malware payload (Mirai)", "value": "0c53ae0ffd584a109abb9be00f75f426", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083211, "uuid": "4facbe9d-12c1-4a58-9840-85763b6bd5e5", "comment": "Malware payload (Mirai)", "value": "e70945f79362f36c52fd5dc35e5bc8b24e9fc01e0f82b3f488fa2aa4aa52711a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083211, "uuid": "f0a53952-606e-43e5-98c2-cf45d3c099e1", "comment": "Malware payload (Mirai)", "value": "9d0ea5e0e7833919a019c6a719b2e31019e4fcbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083211, "uuid": "5a1704ac-0141-4b1c-8215-2a531327d857", "comment": "Malware payload (Mirai)", "value": "401db7748c69e2562315bb3c67c1a638386c3ceb623a61585cfcb9b398ca70d3e3e7bbc7ca5c1522212a61afefa7cfa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083211, "uuid": "d20bb7e3-be41-4b19-bdae-99b2521a9345", "value": "T13133F2E4E363EB53E25254AF08064DDE0E0E1BE851AE3914D33DDA9C149A8154BFDACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083211, "uuid": "31c9dd51-5761-44e9-b8bd-527c23f10cdf", "value": "768:dPyuZr6HxkmEt3VY92uqUZlKOzzOTMoUH27J+n9Fv/G7+U9q3UELVVhRLRP5/Jq0:Pq43VTU6OGg6+n9NG7+9LVVhRNRgpecQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083211, "uuid": "186d8899-6ed9-4cd9-b8dd-d92b415e8050", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083211, "uuid": "100b42b3-cf82-4d01-b06d-d8569697f8c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083211, "uuid": "80ddcf67-629f-46eb-a4ec-848417f0104a", "value": "0c53ae0ffd584a109abb9be00f75f426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75bbfdd-72dd-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670053210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053210, "uuid": "9abab0e4-a713-4703-9200-2497386c7342", "comment": "Malware payload (Smoke Loader)", "value": "8c0bc82603c0f92e176dcdaf1c1720f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053210, "uuid": "8f613a12-b037-40a0-8403-ee00a5683170", "comment": "Malware payload (Smoke Loader)", "value": "e75a91e0cc1736eb3e3734bee7c6ea60c1a24d06abba650243a6d6c78e7d45d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053210, "uuid": "11b8faf7-3ba5-498e-8b4b-8f8fa6a88bed", "comment": "Malware payload (Smoke Loader)", "value": "798f3e6669f5485da710f94f28f418b90ce404a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670053210, "uuid": "59af63af-7522-43bb-9b46-8a8451e5856b", "comment": "Malware payload (Smoke Loader)", "value": "90520fb3b32126b6ed57f3ef18aa23c42fa1aef451a02ba938b2d548900c191fa78e540aebcd6cc4514f48aed891a2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053210, "uuid": "62a2ad95-baf8-4d65-ba4a-f0e691a66e5b", "value": "T1AF74D000FAA1C832C64111FC4825DB989A2D64F1E96CC90F37A46F2EAE733D196773D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053210, "uuid": "cb695d78-d9af-4da4-a8be-0da0e1370837", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053210, "uuid": "29175acd-feee-4843-a55a-74bf024abb51", "value": "3072:vW8X9XsSiyHh5QRfD4+yPl5/HV3N3EFIHgCQERtFo0aok4u4AXQhIh3p6M8MvjZq:/NXsSzHcRPy3/HVd3A1CZRf9k4puR3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670053210, "uuid": "8dce2f31-950b-4b9a-82d1-ba7bb6338420", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670053210, "uuid": "6ae1790b-292e-4171-bacd-51e310c124c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670053210, "uuid": "e6607f7a-813a-4eb5-adcc-7a47dcc5334b", "value": "8c0bc82603c0f92e176dcdaf1c1720f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb097f7-7317-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670077945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077945, "uuid": "64c588e4-a23e-4277-8149-57faf3ac8bf0", "comment": "Malware payload (GCleaner)", "value": "f886b5f4b2a67419311bb5363285cdef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077945, "uuid": "c94cd025-7cc7-4e05-9fff-08ebfef775c6", "comment": "Malware payload (GCleaner)", "value": "e7767e8245fd9b7b029a174b2e944fe1d3b1bae436467f3002239c1e3f7d08d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077945, "uuid": "52f9606e-549d-46c2-89ee-3b15b32da851", "comment": "Malware payload (GCleaner)", "value": "432b37eed03bf4189500de9454fde41f589bc355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670077945, "uuid": "9391911d-d7b8-44d1-8d76-acd375c57f71", "comment": "Malware payload (GCleaner)", "value": "48f6f80b9a8a16b966a2ac3f2ddde25daa5071b52d6f6e02682faa82e548a3207e0990a19b77f7cb585926328b1c9509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077945, "uuid": "06bdfb19-95c4-4d15-b215-b7abb9ec50d5", "value": "T1410633657AA04C36F042E9394F47EA810C313A2752C4464FE6CE1EDC6977399B8BD36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077945, "uuid": "9b6092e9-891e-4021-aba8-00d93f3168f5", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077945, "uuid": "4e1b52ff-b5e2-412c-ba89-feb7c9a4f353", "value": "98304:4jBen8X7bDOnV015GxZtHGj3BMGumUnpCAHPeu0HIXcyB:eBq8TO2PG9mj3B9TUnEAHPXcyB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670077945, "uuid": "b17ca81a-7a20-4ff5-8613-75680a778a27", "value": 3774896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670077945, "uuid": "d145f64c-4080-47f0-900d-946bad66c013", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670077945, "uuid": "014424df-1040-48fa-b117-9c1be9bfcfbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fa5abb-735f-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670109036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109036, "uuid": "b8066905-c09e-486f-a487-bb23321a629c", "comment": "Malware payload (Mirai)", "value": "23786a766685b6c69598b8a392a2b82a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109036, "uuid": "5b14cddd-b3e2-45c7-8391-8d3532d76fc2", "comment": "Malware payload (Mirai)", "value": "e781f392879dfac2d5a0741b2cee2229959bb496d7033f2d2bab4e35e5e58389", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109036, "uuid": "1bdc4f50-f3f9-404b-8252-f3d4550354d4", "comment": "Malware payload (Mirai)", "value": "3475c3bacaf7a11e2431fb400cb5f32c9985cfb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109036, "uuid": "7e868253-bbfe-48e2-bdec-f2a81a102c4d", "comment": "Malware payload (Mirai)", "value": "bb6a34d0ed22f925b9d9c3d965a373d418379f7b46bdc85388e085a928b0324c8f67e5fa7c76d1d420efd8d969670412", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109036, "uuid": "c81cf391-2ffb-4c97-ad73-75ff491cd60b", "value": "T1B7335CC5F543EBB5D84204703076EF339E3AE6FA215DDA87D3E5A532AC43502A50BA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109036, "uuid": "65929405-cf91-4654-9ca0-6867ee80bef9", "value": "768:ytYRSjaQ9DaZ/oJlExakbMqu8iMDkvKy+hllqTm/4RsvKQLDJsgMjz:WYRSjaCu1wlP0Dly+hHqq/4G3LNsgMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109036, "uuid": "f123db3d-64b0-4360-a4aa-6def6b2a872d", "value": 51380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109036, "uuid": "52432d64-ab90-4f01-9fea-ccd2b71f482d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109036, "uuid": "5ebded50-1ebe-4c82-8e6b-f2218b31cba8", "value": "23786a766685b6c69598b8a392a2b82a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4498b4d0-72d1-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670047864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047864, "uuid": "d6822321-f8a0-474f-901f-4d30f5fe5a6d", "comment": "Malware payload (Smoke Loader)", "value": "d4e038f07f400dd7c2eb04f638e88ca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047864, "uuid": "3c9c2ec6-101d-42b3-b84c-3130cd38782a", "comment": "Malware payload (Smoke Loader)", "value": "e7ee70b357fb80fed68f04c6f0f9d661ba497574c57ca11e5c571544d70e1aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047864, "uuid": "399e09aa-9139-4950-b2c5-ff0d7bf68a8f", "comment": "Malware payload (Smoke Loader)", "value": "5927709f036ddc1158966c0e60dc4dc624936891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047864, "uuid": "c086ef82-3702-402d-8f75-aabc52010c11", "comment": "Malware payload (Smoke Loader)", "value": "28203392518a9f2a11e160d2ab128a4bf2c2c83aaafeac1f88c492d9c0d19ba9390d6efbba7d24a41a0ce0440a3c02da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047864, "uuid": "22abc328-62a0-43d9-a911-62775cd6426d", "value": "T1D774C010F5A0C876F19205F88821DBA89A6DA8F35564D50F37A46E6E5F332E097733CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047864, "uuid": "d83873cd-9292-49f2-bfd6-af4a96411a6a", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047864, "uuid": "8e5e85af-c030-4307-a965-f0e668b8bba2", "value": "6144:6jApIObWLr8rApcRM2t5wTfg+ASfbuR6j8:6W3SWApL85KfhKR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670047864, "uuid": "eef7512f-e070-47b8-a4fc-a6e5d2b7a7b8", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670047864, "uuid": "5ecbbf12-746b-4208-943d-deea47194de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047864, "uuid": "455b78f5-e746-460a-9508-db642522a5f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d13f89-734f-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670101932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101932, "uuid": "171f1ddc-09d4-4ed8-9aa2-7016d8d0e893", "comment": "Malware payload", "value": "512fa49779e9af52bf4aa49fa308c0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101932, "uuid": "7acd764b-1c29-4b4b-a7cd-305a76a38956", "comment": "Malware payload", "value": "e83e4db6d226391445db6e931939e2a0da67e8c4428bb2512034e166b9ca5414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101932, "uuid": "fe629820-bf5c-43f7-aeb8-fcb92f66e3db", "comment": "Malware payload", "value": "349e06c89c1fd9505833d4d9190cbdcec9750b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670101932, "uuid": "48eeb71d-3c4d-4f16-ae4b-4a674022274f", "comment": "Malware payload", "value": "40796778429135914d785d952929cea74514178624a10c01ee3e9ec141c54c24558e0a7e8b739128940ce6fd3f609911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101932, "uuid": "f25120b6-692d-426e-a53a-9bfa15d20543", "value": "T1BB752323E391853AE49E0278116ABBD1D33BBD714BB4998B7740379A0FF23D18925787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101932, "uuid": "4151f125-db00-4d32-a7e2-cccfa63d0e22", "value": "5ce034b939c6145516baadcd9b5d3871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101932, "uuid": "9ec606e7-9c93-43ee-957a-aa4e402ac94d", "value": "49152:wRKg6xV10XYK00lSHZJRv+DW/7R5sw1HkByHOOJ:wovmXYrq2JRbTV+Bfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670101932, "uuid": "def679da-4319-4558-abf6-634772a30046", "value": 1702096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670101932, "uuid": "208294cc-13d8-4140-a250-06e3ad8af056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670101932, "uuid": "631da937-5907-4344-82f1-dfe8bae126a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84242419-72be-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670039810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039810, "uuid": "68f740be-5e45-4f0a-b700-6b59d1589837", "comment": "Malware payload (RedLineStealer)", "value": "999fb390d347d57b892395f0a8fd160c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039810, "uuid": "c85026e1-9040-4786-8196-be022faec29a", "comment": "Malware payload (RedLineStealer)", "value": "e867b0089c8de42336fda26cb236f1560fade689995da8761637d45980f16986", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039810, "uuid": "2dc0b53f-52ad-4868-bc75-1d0110388ba2", "comment": "Malware payload (RedLineStealer)", "value": "f853f764579db8f6ada129fe1838a40e8b75bd18", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039810, "uuid": "ca976b57-4696-49f2-9f15-9db6bfd311df", "comment": "Malware payload (RedLineStealer)", "value": "1acfa841a4faea1fd63a67667611320122f538127910819e8bab040a837faab530e8a156f1f675d8b890dbdc569e482e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039810, "uuid": "8b35f83c-512f-42b8-9c7c-f38b7d9eeb4f", "value": "T1944512513BC9C135D2AE153684BBD7792A6ABD710B30D0CBB7607CAD5A312C3BA39352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039810, "uuid": "c87aaae0-f80f-42f6-b3e9-a3b0d1b8d7c7", "value": "24576:qtncpVGPuBd3X3yNh3j8/f3/uI0pctTrFjKVs/ViWFZ8FWztvUHKx79P:/pUPuBdH3sBj8/P/vBJrFdtLtvUHCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670039810, "uuid": "5a5a9d2d-caeb-4e1e-836d-73b4be3a96ec", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670039810, "uuid": "7fe14fb2-1fe0-40a8-8e69-66e6c5942ed4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039810, "uuid": "0086c311-2e37-4d28-bc48-0af10edeb478", "value": "999fb390d347d57b892395f0a8fd160c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3bbd38-72e2-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670055369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055369, "uuid": "1f8e3006-43da-461e-bcce-f8ad38916e5b", "comment": "Malware payload (Amadey)", "value": "0956e1f98194bec956f852ab7c619b7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055369, "uuid": "9596d90d-4ed4-4524-b141-88bc4b05a23b", "comment": "Malware payload (Amadey)", "value": "e92336ea587df387ec278cdc18544cebee7e5dcfb6f4870916412338273e5351", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055369, "uuid": "af22cb83-1ed1-487c-bc76-d570c560283a", "comment": "Malware payload (Amadey)", "value": "8e2d63914e8b726dc4d7067f28f7d9f606e9b012", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055369, "uuid": "97545f5d-2f71-4f1b-834e-34846b91e684", "comment": "Malware payload (Amadey)", "value": "8ea227a363506171a82343c47bfebdd61ac1c11fd2ac10af9607dadd64902abb7851bb7f0d2b1e1081e1a74ed710b62b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055369, "uuid": "66149c8f-2a1a-44f2-924e-01ec15179dd1", "value": "T1CA84E03172B4C832C65348718457EBA0EA3FB5325D679AC73729279E6F303D2866670B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055369, "uuid": "eba448ed-4fd9-4139-87b9-749139b63459", "value": "73a625d5eb97bde8281e4c029c7803e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055369, "uuid": "a1f7ced3-58ce-41a3-9b47-04028032abb0", "value": "6144:9mAjlHOfYh/eASZbfre8BYfYJLSYqW4jnMW2Rqn89BDqUYi:9mmHOfjA4bDxKYcMW321qUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670055369, "uuid": "7958aa12-f8d1-4386-94c7-889eac12f047", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670055369, "uuid": "c3a3c256-f42c-4aad-be65-a11405a91740", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055369, "uuid": "eb4a2d59-a751-48de-a605-e0af53739f41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befa152d-7361-11ed-9db1-42010a9c0080", "comment": "Malware payload (AsyncRAT)", "timestamp": 1670109917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109917, "uuid": "c6dea755-7ca3-4cf2-a2ad-1b4accecd8d7", "comment": "Malware payload (AsyncRAT)", "value": "19590a0af1f36d0aa9e9f7515a5ee7b7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109917, "uuid": "001ef597-f739-4083-9f3e-7cc0d4e68cbb", "comment": "Malware payload (AsyncRAT)", "value": "e98df30ddb2e8b105e23e7d5e7c913f1cb7d2ef963def3030853daa91f71b75d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109917, "uuid": "421e2ded-f966-44ed-8ead-9511447b565c", "comment": "Malware payload (AsyncRAT)", "value": null, "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670109917, "uuid": "c6fbc9b4-9009-4040-8e1e-a13cff598825", "comment": "Malware payload (AsyncRAT)", "value": null, "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670109917, "uuid": "f4204951-d5c0-47fc-bf3c-fb05c4fa4dfe", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670109917, "uuid": "78361bbf-ef63-4d7e-947e-4e1fa59ad3f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670109917, "uuid": "56e4449e-5705-4d04-99c3-2f6bdc8bfbe0", "value": "19590a0af1f36d0aa9e9f7515a5ee7b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e5587f-72d0-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670047332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047332, "uuid": "624c17ac-7f6d-4d14-879b-bffa686af40d", "comment": "Malware payload (Amadey)", "value": "8f366da90e1d6960063b4cbb6fb73cf0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047332, "uuid": "a25636bc-e10f-4893-98ff-73499b89cb24", "comment": "Malware payload (Amadey)", "value": "e9e49fb7278ab335b8f32517f0e21148437a5df352ab78402e34d1511005b5c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047332, "uuid": "0fa71a9d-18b4-45c1-bdc9-4e1689e3a34a", "comment": "Malware payload (Amadey)", "value": "d021f932c2ed4ae2403185d7d3a626ca71a818a2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670047332, "uuid": "682cd625-f609-4c81-9686-12b488641e50", "comment": "Malware payload (Amadey)", "value": "1d78f783133806f6eb6b607c169db835651ac8b93a2e7272f187cdc64590d7c364e7ebd446f46213db44575e2f7ad86f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047332, "uuid": "4a67fb2d-6d29-4184-ba9a-99c24b8d0ff2", "value": "T13384E024F5A0D876C58605FC8826EBA8DA7DB9325920C54F33A86F2D5E333D155363C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047332, "uuid": "2b6008af-f09d-4a8f-8079-a550c043bcf1", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047332, "uuid": "5d97506b-a50c-40e4-8f78-07297249adca", "value": "6144:sXL8rIjELX8u5EcRcwARd2WcmfeeyLV8uRx+Qda6j8:4Yr6E35E2AyWVfeeAVRRxDdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670047332, "uuid": "1274f952-26d4-472e-929e-5a0673cf7b22", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670047332, "uuid": "33cb0224-da1c-4e83-a9df-0ede55ddabd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670047332, "uuid": "2d61f5c6-7ef5-4c0c-8be3-ea1d8f20a0c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3076d5bb-7302-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670068875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670068875, "uuid": "8436e8fc-fb8a-42c1-bd45-020b3224cd2e", "comment": "Malware payload (Smoke Loader)", "value": "be9c101bf248674860ae02c917d0a848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670068875, "uuid": "2175c38d-fce4-4376-ad2c-c9c20976b445", "comment": "Malware payload (Smoke Loader)", "value": "ead9433bdea19b4583ccf9eba2377f202e31488fe7e36c22e398597fc49e220c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670068875, "uuid": "08e496df-87de-4cb7-afec-a5f21f07f20a", "comment": "Malware payload (Smoke Loader)", "value": "27142724112b844d745f2f0fb56954cabccb6971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670068875, "uuid": "f9b2d678-e6c3-4730-98ef-32dd931f4c25", "comment": "Malware payload (Smoke Loader)", "value": "0cf7127925818a62bf98c2cc2bd9cc1f3f5b3746a92897941793c125a28808d81a76d02820cf8a080ffb9886f6e87fa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670068875, "uuid": "4469167b-39a5-470a-91c2-f772630544ff", "value": "T15C74DF3172B0D532C59234744526DFA09BBFF931EEA498D73769276E9E303E18B26306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670068875, "uuid": "2339090c-59f5-4f44-af0a-65ebc1fcaa38", "value": "542e15760dfa5e1a3430927811715674", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670068875, "uuid": "7083ac6e-5595-4ba5-9e10-9f0984eee8db", "value": "6144:RcufVAeey7U5bkm4cr3aTwPjn/nMW2RqnEYo:RcwVAemgKLrPMW3EYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670068875, "uuid": "099d3a8d-b521-47f4-8c79-2a6660eea61f", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670068875, "uuid": "d433f669-1ad2-475f-8d5f-3614ba89e082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670068875, "uuid": "e5a3b4e2-ed64-4f49-8448-6c0e5eb49e28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4488ea2d-72c1-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670040992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040992, "uuid": "97282c9c-b8ae-4906-ab1f-9f133e8c1d94", "comment": "Malware payload (GCleaner)", "value": "afa8d0322198ffdf7f0ee8a1f2e5b04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040992, "uuid": "1cb49626-d496-4df2-bba6-4ef407ce135f", "comment": "Malware payload (GCleaner)", "value": "eb5582228427dde98488e0f9ab6f8fc9f9228790e4f42e9e8882def176900719", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040992, "uuid": "2b2cd3dc-cf2e-443b-b825-645457f4077e", "comment": "Malware payload (GCleaner)", "value": "11e5cde9488fca48b8d0685f21d52ad215b9b40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040992, "uuid": "6238010c-b8a2-4e14-b536-e8d1228e75c8", "comment": "Malware payload (GCleaner)", "value": "4f0775842256e405cc3baf17e6ca0cddfeb3a9a9079f508c309b7ef6844e6f4363b7130e43c387dcce20d57a48f152d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040992, "uuid": "86cd570a-101d-418c-9a25-d7b900aff775", "value": "T1C6F53333A4A769B4F8D0BC386F048D3569633B321D5D0E121516EFF53A7A086A930F9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040992, "uuid": "4e3a4466-e712-4b54-bd92-e7c8c17781cd", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040992, "uuid": "fb245606-4de0-40bc-9ed6-90bf9fccc6a8", "value": "98304:ArUH3m9FGl8SJb808RG0DwL5UtFLFSYnzoftB+EwxXcy6:FWm8obQo5UtFLFJzSbqXcy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670040992, "uuid": "4a9b0e8f-ced5-4e78-a35b-05955bd0b53f", "value": 3584422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670040992, "uuid": "1c87fc8f-01c5-491b-b950-7521aaff8c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040992, "uuid": "4a7e6fed-24a2-40ed-8a9e-ab4ce9ca5255", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c005d90b-735e-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670108630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108630, "uuid": "fd90114c-4301-4d2d-9b93-f7c5664df3a0", "comment": "Malware payload", "value": "4048d6716ad53bf7425043a2889cc076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108630, "uuid": "a40524a9-37e9-42c5-b98c-8e708372ae47", "comment": "Malware payload", "value": "eb76e8d0ab8a90305a4dd97fff661759cb8442322487d123c21e2e23962c7990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108630, "uuid": "0042ed19-9808-4e9f-adc8-483259c2613a", "comment": "Malware payload", "value": "3c790b2cfcf30ae19d2529e247ab0e75a3000568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670108630, "uuid": "28d3ff0b-3cdc-46d8-916c-8dfaa029a246", "comment": "Malware payload", "value": "b3c48bcc97e132c67d2ba8da4d3f521ef20dfd8728a4c0d3cf1906f90d78eb2a76af5b3b90c40786cc45148a5ccc2245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108630, "uuid": "c1eaee4f-fa3a-4b87-b804-f16685d5bdbc", "value": "T1FC15D04075D4B628F0A3E9F80F59C3678623FCD04B52859B2AE5338B1973AD18E7527E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108630, "uuid": "7a5614b8-1fea-48d4-89c3-aec535c9daf7", "value": "7ad9fa46ce24ad6b99e7d1dd30baf0e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108630, "uuid": "c004ebba-d284-41c1-8737-b5aa397fabaa", "value": "12288:mr2Fv747mJAhAzUnkZzr/7z2h2VcD0bv+k8knlb4XzMgXO/IHy61ayPkwKO:dv74WUnkZzjni2VcDSGklb4oJgHzZcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670108630, "uuid": "aa583066-3f54-469d-ab8c-f98a6f351c2a", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670108630, "uuid": "7e1074cb-42f6-4111-8315-667d78c5fd51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670108630, "uuid": "ce9db5ef-a93c-43ec-8c87-de13f9797a8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5434886d-732a-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670086115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086115, "uuid": "5e254f85-7ae8-494d-8b85-fd2af288ca58", "comment": "Malware payload (GCleaner)", "value": "dbad483e99a8d924efef43c509752ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086115, "uuid": "68a75d81-e3c6-4b35-b59f-fb9cdcf6241b", "comment": "Malware payload (GCleaner)", "value": "eb9692b49cdf6d4d4ad0f5f8c8334d09f4a12dbee9c03d4b7b234279b9560200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086115, "uuid": "a4ecd145-3584-4655-b31b-9af048a26731", "comment": "Malware payload (GCleaner)", "value": "183d96e307728e35f25b22bede7e046f0a17ef23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086115, "uuid": "bf3efd42-1cbd-46f7-b828-b55824cab976", "comment": "Malware payload (GCleaner)", "value": "042545fe718a10f698a0f73dfb07c7222db4a6052943f9a7bca3b279a43e589c74beb9b873887bf6b3bd831f7f243059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086115, "uuid": "d2229136-fc02-4e76-a40f-de84a85098b8", "value": "T16AF53325E5DFD571DA8A0B758C8CD9018C6BBAAB21F092C117AC87087BB748FE56C707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086115, "uuid": "19a09484-dafa-4951-9aad-32d6523c5c57", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086115, "uuid": "986bfdb3-ade3-40dd-a5ad-1fc08ae42386", "value": "98304:QxmYtAeMea4hprLPNDtFQ+EuFF0z4/CBzw9pcf7a7RGOHXcym:EVAjgL1DBE1zxB4pcf72RGOHXcym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670086115, "uuid": "7454368e-71e5-4204-b8a4-ddceaa0f60fd", "value": 3586192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670086115, "uuid": "6f6dabef-2b1e-4c69-9feb-346b00d09389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086115, "uuid": "c0956e4e-a388-4545-967a-9defa345959e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32da3171-7322-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670082623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082623, "uuid": "ba2d018e-3194-4d07-89d9-dcf9ed009982", "comment": "Malware payload (Smoke Loader)", "value": "e88afcf5b70f3b1591c2aa82064ab253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082623, "uuid": "8bddd135-2cc7-4fc0-8ef3-44f782ae18ad", "comment": "Malware payload (Smoke Loader)", "value": "ebf34a737ea9ff75ab367a8809d0e59fee5d55db6dd983f76c3e3961aeef7589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082623, "uuid": "8bea977e-bc9b-4ea5-8503-9ea3c84c1397", "comment": "Malware payload (Smoke Loader)", "value": "db198e6c573f2a64196b9887c180bfa02c4be9e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670082623, "uuid": "85feb474-c291-49d0-8f37-4c5dff92bb56", "comment": "Malware payload (Smoke Loader)", "value": "abce74e3ace440c605e7740b93145b93490a2803d7624a16e61aa876cf733b44430e95a13e13b65f3889258adc6e2448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082623, "uuid": "da581098-6578-4f17-94ce-7f215e2e547a", "value": "T10C74DF3236B0D431C59304378466EBA0DE7FF932F9A499C723696B6E5E303D19A26347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082623, "uuid": "0241bdf4-6066-4b46-baa5-6c00ba76b85c", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082623, "uuid": "23a09200-cd69-4823-83b4-bc64035d14fd", "value": "6144:1UYr4dwAfKrO09E8CJtPzoKuOnMW2RqnrE8LY:1UYmwAfuO09E8C3Pz/MW3AOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670082623, "uuid": "888b5da0-ea22-491a-a3d5-b9643117cfe0", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670082623, "uuid": "823f2676-636f-46b2-a755-676161bd91d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670082623, "uuid": "281cf7ad-0fcb-405e-8310-aad234bfe01d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7b7de2-7327-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670084867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084867, "uuid": "ec0369c9-801b-426a-b06a-ca8e14c6f59a", "comment": "Malware payload (Smoke Loader)", "value": "d44d9d3e497ed82967209c67c4ad3456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084867, "uuid": "37d92bc5-f49b-4568-a4a9-e2723592ce15", "comment": "Malware payload (Smoke Loader)", "value": "ec2fed17bb968849b8ff49931a230621191e2fc75e2aa5b7cde12059a0d259ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084867, "uuid": "cd0e0806-f715-4d39-b85a-621ac65d1a06", "comment": "Malware payload (Smoke Loader)", "value": "ece1d7cd85fe80439bd47d66b62f7ae8e2f1ffa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670084867, "uuid": "a0603da6-5d5c-456e-8f89-d92260a6e74f", "comment": "Malware payload (Smoke Loader)", "value": "56f76c0ff765742d4432cdbc58efe3a75d14c9b91a67a0320849153f02ee287e9a8a7ea4e47fc24baef6ee5d1e84deea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084867, "uuid": "0d23deef-7b9f-405e-82e7-fc4e4bb8c524", "value": "T18974D03176B0D432C59305319426EBB19ABFBC329DB599C7235D2B6E5E303E18B7930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084867, "uuid": "839489c4-74cf-4791-8240-31a82ec14098", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084867, "uuid": "457e470a-ad44-4f58-93b7-cd8ef9503d91", "value": "6144:OMLVAveWVS/TJSVMFntLknMW2RqnzGJ7Y:OMJAvTkFuMW3C7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670084867, "uuid": "bc0374f2-1639-4099-b572-d1e766346c4d", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670084867, "uuid": "7c9ae437-c65a-4408-ba22-04a0564d7344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670084867, "uuid": "6c42141f-fed4-4788-8918-21e94831ea41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a18ebbf-732f-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670088138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088138, "uuid": "a97a5b74-ef7c-462c-b402-d7135dcca5d2", "comment": "Malware payload (Amadey)", "value": "bb9ca1911faba048d60d03b9c6ab3cf5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088138, "uuid": "bae6880c-882b-4d3c-8631-247430646ea2", "comment": "Malware payload (Amadey)", "value": "ec393856ec680019dba6f7a4b67f1967feec54f8e7ba56146d06559acfcc6bb1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088138, "uuid": "c94ef49a-b5f8-411c-8be3-cadc618ac26d", "comment": "Malware payload (Amadey)", "value": "959039fe338a8f0e5a4770dffc6ec31c2f03291c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670088138, "uuid": "b740ca34-10d3-4dba-a72e-80a996bd20a6", "comment": "Malware payload (Amadey)", "value": "de22353f3133eb359ce34aa15eb56d2a812e9f24c26a20bbebe62e39a7328f37f7ed36f25be6671ee850583685e7eae3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088138, "uuid": "70590e44-843d-4f13-b731-4e0f4396d66c", "value": "T15184E03036B0D83EC59305344556EBA16EBFB93119A58ACB339917AE4E307D19A32FC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088138, "uuid": "e4ae6f14-22fe-45fb-8d4b-16499ff50347", "value": "88f3452040e97f1dc959027eca7e915d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088138, "uuid": "c289dcc4-a0c8-42ae-a35e-f91da1fe2914", "value": "6144:8RaE/hzpmiNqBTA3C+NNV9ElrduCInMW2Rqn5Yb:8RTplmiagVNVGrdn2MW35Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670088138, "uuid": "69e114d2-bae1-41f7-b29b-79b8af93b24c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670088138, "uuid": "2c75e68e-1097-4c06-a569-919e2b4c185e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670088138, "uuid": "ccc456af-df49-40a4-9838-0fc4e3ec906a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04e3aa4-7355-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670104819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104819, "uuid": "a9c7c266-3150-47fe-8fe9-0f10268acfc6", "comment": "Malware payload", "value": "172244c254ce8b089f3b4a6053edbae4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104819, "uuid": "4beb1859-a7e1-4e41-b83d-7d008d62a4e6", "comment": "Malware payload", "value": "ed1d1c08546a03aea04af1f0ae5a67cc1d5f0fe7a3c9fd41345f4335070c458a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104819, "uuid": "db706558-1233-4bfd-8118-6f9f4264fdab", "comment": "Malware payload", "value": "1d83031e726d6c904f1fbca28aadb1baf7ea9886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670104819, "uuid": "13a02e4c-8ea4-4676-b885-7fd6ebc5ce86", "comment": "Malware payload", "value": "98b706ee33aefbc8878fd4e74eb76f2acf521ed9fcdc34e4875d4acb260be54737fd853d93f55d6b09b701e294fccec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104819, "uuid": "b0097408-15b5-407e-8dce-2ca5cdb86538", "value": "T11FF53348B497BA78D4038BBB9C7BC82ACCAB7C7124E9891915641A05BF3F2DD5C057CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104819, "uuid": "e893080b-ff41-4059-91bb-51c22924b818", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104819, "uuid": "921e57ab-cc87-4582-8499-3674975bd843", "value": "98304:AEym7QrK5R3rLi33D1iA0J8ENv4r8jHv6KE7zDgfsvgXcyC:4EjrLSTITRDjHvBEh4XcyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670104819, "uuid": "487ed0c1-d7cc-4b64-bf86-d405449b3701", "value": 3614916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670104819, "uuid": "3867e59f-64d4-47ed-8ea7-8ddff693b510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670104819, "uuid": "6f389ed7-c278-43a9-a59d-b95c232a8ab0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a110a93a-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091828, "uuid": "e5ae474c-e905-480a-8601-b6c41a7af5c1", "comment": "Malware payload (Mirai)", "value": "7177893b2a44b8aa463998c9b97fa317", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091828, "uuid": "e2ba96ff-0b76-4436-b6ca-f8a42fe07145", "comment": "Malware payload (Mirai)", "value": "edf7f8b9531c2eae755d2595bc6d0c5d7b1ef86ead7236cfc774546641916cc6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091828, "uuid": "a86beb36-baa1-494b-9a40-52aba22d8724", "comment": "Malware payload (Mirai)", "value": "0b7fee0a2ab04983bd6f74054fd1821bdf7b8a66", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091828, "uuid": "0596c194-8c7b-4413-a106-3522d383739a", "comment": "Malware payload (Mirai)", "value": "ff56669684f138737ebd947d73f0bf59418759e52906bc6f501364178a17e4014d7bd5b1a2d3f164e87cf09666e575d7", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091828, "uuid": "7683a07a-ff63-4d50-a626-b19e24875e61", "value": "T13813F907B9428BBEC04BD1B403F7BA39DC2279FE1639B186B7E0FE661951D922D18D14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091828, "uuid": "64f14b6e-0a1b-4642-99dc-f39f047ad226", "value": "768:3SEvqhMTZRg49jMxXtHkmgDhRCyQtFHaNesvKQLDNZHJN:XvqhMTZ24BkgDhotFHMr3Lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091828, "uuid": "0d9800b7-af60-4524-a581-36e31c093e44", "value": 44200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091828, "uuid": "a69f7645-0ae2-40ba-bbef-10571678c69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091828, "uuid": "4c9ed311-69f0-4767-9d6d-c69ddcd304d3", "value": "7177893b2a44b8aa463998c9b97fa317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340e1ca8-731a-11ed-9266-42010a9c0072", "comment": "Malware payload (RemcosRAT)", "timestamp": 1670079189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079189, "uuid": "34b4cbc2-f2c7-4ff0-8554-1f424fdb422c", "comment": "Malware payload (RemcosRAT)", "value": "796280ec19f4cabce99bbb14b4a43f28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079189, "uuid": "d8ce5ac5-38bb-443b-bf8f-e5a6e5acac50", "comment": "Malware payload (RemcosRAT)", "value": "eeb4e124303b10a370d6c20f70c17303dfe1cd6de4b255d85061804ad6902db0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079189, "uuid": "f41f5291-5356-4ebe-a5c4-bdebc675d7b5", "comment": "Malware payload (RemcosRAT)", "value": "537bedfbb6f6f2b544bc4892437f4a6050d932a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670079189, "uuid": "85eeec74-f9f7-46c3-b316-62841cd8ce4d", "comment": "Malware payload (RemcosRAT)", "value": "be31a50f38885db4aa4d7f0fc36b49591db83f8b77cbced00f954d77c781b73e72c89f89fd0589c5a75dd94a858bdb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079189, "uuid": "a6aca877-9098-4cac-aa75-1c7839941775", "value": "T13BC401813F43C89AF3CC5838AB9CB74406A9E601F772C7257BB98BA5105DCCFA49A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079189, "uuid": "b6628802-5bd5-4e8b-80c1-ce042d8a6a05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079189, "uuid": "a6780f6a-cf55-4d04-a114-92b5ebe0febf", "value": "12288:VmwtkzfN9A6V20TKzB32n/3Ki0mGXq7mclWKpNCi/g:ltkzf3A6VR6O/OrXqicvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670079189, "uuid": "42152f60-0c6c-452f-995e-3ddc20a3b026", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670079189, "uuid": "0ae2ca7d-607d-4c87-ba18-44bd54618880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670079189, "uuid": "2595f495-e637-43b4-8d5c-c558328a26ff", "value": "lucerne as at 28 Nov 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bbb726-7338-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670092025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092025, "uuid": "62f7fc8e-b644-480f-8d9e-ec0ec2d3f0f4", "comment": "Malware payload", "value": "ee693bb2f4d3ccc1281941987daeb399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092025, "uuid": "c8cff291-c116-4d47-9e27-eeb4b12031ff", "comment": "Malware payload", "value": "efa6c05f417eca37ebf0056a434a81d12407df4c24334081be88596f2f261a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092025, "uuid": "7915464c-f8db-4a07-b1dc-7737dec4271a", "comment": "Malware payload", "value": "0321aec76bd27bfb82ef5741401ef1170fea3401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670092025, "uuid": "9e1f026d-54e3-46bb-9c37-876da98b9eab", "comment": "Malware payload", "value": "cef8a2be66fb9512b7efa3679694c3375561ca740a39f19aa773aeda1c3d99e1e83d929377c6980d252584824d649bd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092025, "uuid": "e0b1918b-8ba1-43c3-89cc-7e78777c4fd3", "value": "T1AC84E03076B1D472C9D309348566DBA0AA3FB931596099C333692F6DAF343D19B7A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092025, "uuid": "05e73cf0-6314-462d-ab54-7427e5dd3f3a", "value": "2ecba4f94e8f44b19ea360cb81da7876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092025, "uuid": "e28d942c-a8eb-4de1-85b9-4617e4c0eb0c", "value": "6144:U4KCg5YhsLr5KLu0wZ0PBK+HyiztnMW2RqnQtOIY:UXlasX5K/wZ05nHRMW32nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670092025, "uuid": "939d47a7-8846-4531-ac41-efbbf36bc12b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670092025, "uuid": "e67647cf-7c96-4cb8-901f-8cfd2e585b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670092025, "uuid": "1474a4ea-38f9-49ba-b51b-b62bea4b6c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2266a8e0-7350-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670102353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102353, "uuid": "cea5d614-4913-4de7-b0a9-4a277322eb09", "comment": "Malware payload", "value": "b5d04a53ec15358a3f01ef8dc9b16030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102353, "uuid": "432fb62b-a479-4172-8079-ce45253b2072", "comment": "Malware payload", "value": "efbeab3ac161089d0460f064290c5f250bb32901fd6612072c81b74168753516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102353, "uuid": "e8a9c709-7092-46fd-a112-17ca6c636774", "comment": "Malware payload", "value": "6325063eeaa97ca9b92e0b3888776a31552d5525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670102353, "uuid": "aad0c7a5-f40c-495b-9f72-1755ef490501", "comment": "Malware payload", "value": "413aec9335c3207696b4d50fbbc2b286c8266de69d673b124890eec0147c051ac2162a93ecb98d542e9ad436eb477dd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102353, "uuid": "625b4531-62d3-46a9-adf9-aa3c511b1421", "value": "T1C274D07072B2D872C24305749556EBE0AA7FB8316960CDCB37692B6E5F303D14A7632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102353, "uuid": "0e2e58fa-b37e-47df-81d1-92ac7abc413f", "value": "558d571f1ba0471f806ada9634257523", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102353, "uuid": "e36fced9-3f5a-4012-9055-4f49fa6836f6", "value": "6144:L0SpLYcVNlyUVVyT1n/yynMW2RqneeaY8:LvN7JPq5yUMW3TaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670102353, "uuid": "52a8691c-bef4-486a-a72b-c38ffaf46c03", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670102353, "uuid": "cacda570-b18a-43c5-a1eb-f18390272b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670102353, "uuid": "1c3e17ee-34d7-46ac-a9e4-bcebe84fce5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ff38aa-7314-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670076889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076889, "uuid": "8db3692b-5796-4479-a7d1-efcb5f58fb44", "comment": "Malware payload (Smoke Loader)", "value": "b772a577fbfdd8a30ca8aedbb4af267c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076889, "uuid": "42c7d911-99c1-447d-be8f-980c8169bfe6", "comment": "Malware payload (Smoke Loader)", "value": "f0100d42c6f32b87836ebb8329d254ae593991e2728aa6135006074d6ca7b72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076889, "uuid": "dc62f26b-07f6-4c2c-acf9-f64fab9cdf14", "comment": "Malware payload (Smoke Loader)", "value": "30f9c239e4cfb98d38cbf91dc1ebaefcae383347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670076889, "uuid": "cad1a733-43ff-45e0-8584-61ab7d711db5", "comment": "Malware payload (Smoke Loader)", "value": "0819be20d67a2a8bc0c68586249f8ed55e0ecd4b7999877beb1fda977e1d9f4171bbcd11180ebc749ce1088748efd984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076889, "uuid": "63cbcccc-f2d8-468b-af0a-5d01740b4dc0", "value": "T13374D03136F1D832C55B91308426EBA1AEFBF43269A199C7337A276E5E303D25676307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076889, "uuid": "efdba95b-096e-45fb-ade5-ce067222bcca", "value": "209ee1f7e696f87cdfe678fea2cc9d25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076889, "uuid": "df705b58-fba2-4e4e-bfd5-382a815ebb42", "value": "6144:l/V+aAOKjXAz/oFxqR+k1PnMW2RqnF1ppY:l/QaAOMXG/oFURNNMW3FHpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670076889, "uuid": "91b8c604-2506-49a5-a249-bd9a5699aca6", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670076889, "uuid": "655530f4-93ff-483f-a083-aa5172c4572f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670076889, "uuid": "a4869454-1c70-4254-b757-4d65bbfccca2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e599918-72e0-11ed-9266-42010a9c0072", "comment": "Malware payload (AsyncRAT)", "timestamp": 1670054242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054242, "uuid": "a70ebf51-c232-4b48-bd29-d7a84ad98da1", "comment": "Malware payload (AsyncRAT)", "value": "8a627782b855f06a3d6d273d11f04f46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054242, "uuid": "688acfd6-5dcc-4dab-bcae-3eb8f2aca0dc", "comment": "Malware payload (AsyncRAT)", "value": "f0b7a0368fc27d98d42efd4e9c9dd2c252e5fcaaf13ffd67b3c545ec5b1c53e9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054242, "uuid": "0466f8be-d26f-4599-92f9-c5ea6487bd54", "comment": "Malware payload (AsyncRAT)", "value": "30570c697533fc3fc7a19ad5d4bc3753f2cf1c0b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670054242, "uuid": "57c27331-0dae-434a-84ec-9d303b788240", "comment": "Malware payload (AsyncRAT)", "value": "eb4c3dbeaab1bb6d7198760d90c4d45ef8eaf8030a7f7186f1d40e39a48deb998c3ab61f4a5daccd0de1798cbf5b5dfc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054242, "uuid": "275d9325-6e35-4540-87c2-a78959adfe1d", "value": "T11865BE117A87C172EAEE01705478EB7B047E76210B6084C7EBD83EAAED311D26739797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054242, "uuid": "304b3e40-33b4-4087-9b17-54483d72e3ae", "value": "bdee31d57a3727fa31f4964404cf695f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054242, "uuid": "5632392d-7003-436b-9390-105adf7ca54f", "value": "24576:xirh2DKsuoIj4G6KFined4e5+MRicaRT4D2aKpq9ZEjrTnFOyzhyz:Ir0DfFpG6S68+KaRTWNKpEEfTnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670054242, "uuid": "5759f90d-18b8-43ca-b550-ae3ac03a296a", "value": 1462784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670054242, "uuid": "1b6bad5a-0e44-4ac4-90dc-6dc5413fe6a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670054242, "uuid": "336981da-2802-4c90-ba95-e8f1784154c5", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae40a438-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670083260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083260, "uuid": "0047126c-8ad5-4766-ae04-2284e020afb0", "comment": "Malware payload (Mirai)", "value": "f5af47c0b6506d742c3276af12b7491a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083260, "uuid": "55899752-cd73-41b0-8dda-cd099e17e6a5", "comment": "Malware payload (Mirai)", "value": "f0b9451eb103755c9f83889f189a6de0a23e7dad3d04d381e7ad3062eea95e4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083260, "uuid": "b2797b5b-4d47-41ea-8e4b-3b9279e26f22", "comment": "Malware payload (Mirai)", "value": "9f599574dfaa8a08bb95d2eb9c5c45fbd5ae6e25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083260, "uuid": "3ad06b68-9412-40b8-98f1-d0f473c60c9c", "comment": "Malware payload (Mirai)", "value": "66aa558713ac0bb68237480e410979e7d138911d8ec5f1452b54ad786ac8a04e71962e7194401dbcdc972eee58105fcb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083260, "uuid": "4622dc19-e582-450e-9e53-6f37fc8f68fa", "value": "T144D2E16DDB99274CF462573198BFC13F74D6E8A3922F42C28BD84906283884D27B9EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083260, "uuid": "71445c4c-b22e-478a-af50-b6fead18aa9f", "value": "384:MpGclfUDwDsOAFImUQSAAHCB9TKcSLJY7eoayfsqxRFpDU7/2LbZQrmcFNyqQ:PcmROmIIAizKpLJY7Pa6tpI7/kQSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083260, "uuid": "33bd567c-b358-4cde-a8c8-0944e6c31f8f", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083260, "uuid": "8c0cde5d-1c4d-49b9-b99f-6a3d3e658649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083260, "uuid": "e6dd5f6b-1aff-4143-b220-ad8ff3acab15", "value": "f5af47c0b6506d742c3276af12b7491a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57dba734-72eb-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1670059063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059063, "uuid": "4ce65a35-2810-4c49-91a1-0e8d5918d910", "comment": "Malware payload (Formbook)", "value": "ea670d2f2b5b772c59b790bcc65c59f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059063, "uuid": "058d1f39-d7cd-4d0e-a2a0-49765c7d4393", "comment": "Malware payload (Formbook)", "value": "f11ff5bb01c4ad6c270b86f63b4209127d3521c98496f6bb2f021c99eaa881ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059063, "uuid": "c13fe186-0936-4515-bc8a-52af5ddc6cdd", "comment": "Malware payload (Formbook)", "value": "e173a6d224a97430b89bd06df5b2a4fb50b17a30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059063, "uuid": "5b4db0bf-292a-42a7-a9dd-1a0b5b612bd1", "comment": "Malware payload (Formbook)", "value": "e0671d105c8c599f7f2ea921de1a2c22439671e7373b5ceb114e293ac4a5ef916e04299ad544dd3d9c2ac0514373313b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059063, "uuid": "74ed7f12-4b66-48fd-9980-e1633821603e", "value": "T16EC4EEF1C795E5A8F886AE3D41335CBBD4AB997D6DA06DDE410C74B2AF3278210A05C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059063, "uuid": "241ef032-a6e7-446d-bdf9-fa5fbc3dd672", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059063, "uuid": "535a1d4c-8fb0-4cde-aca5-e299e0fec2dc", "value": "6144:lBnlWGbqJ4rPFzGCMrjCA6YCZzhKpNv9l2Di9jGn5HdDJRwkOMsPPrs/Ja1UV:w84JrkYszhm32CcxddRws6j2J5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670059063, "uuid": "2fce4fb6-9a93-401a-ab9f-963e0c1d54b3", "value": 548428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670059063, "uuid": "ae55047d-f1ae-4ea1-b6c5-6a260650f711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059063, "uuid": "d72c5e86-f60a-4aac-8374-7ba317fbfac4", "value": "payment_copy3_receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e850b6e1-72e1-11ed-9266-42010a9c0072", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1670055010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055010, "uuid": "cc2eb837-1742-4110-a3fd-0a3fdeb7429b", "comment": "Malware payload (ArkeiStealer)", "value": "f4e2403071fd5028745a451c46059b43", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055010, "uuid": "76c9026f-184e-4a43-8c86-776d418cf956", "comment": "Malware payload (ArkeiStealer)", "value": "f1642b45acfb9014b62e9fd1e99bab115dd88fdcd92deb49c3c9a7daaf037bec", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055010, "uuid": "0ca7f758-1018-41ac-ae85-9f9d1d84e3e4", "comment": "Malware payload (ArkeiStealer)", "value": "805398d5c4ccd1360d6b7d2190b35a9722b7896c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670055010, "uuid": "723258c4-ee68-422b-813a-be7b6f4049d1", "comment": "Malware payload (ArkeiStealer)", "value": "6c9d493200be27b560aac11ecabd1a2f7466e71a52907b7cae0b38307dff16e74bf86ca7cfddf943803c5692120efed8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055010, "uuid": "12910f3e-3fc5-4c89-ab49-85f742eb98aa", "value": "T1C574CF01F550CC77C54211FC8865EBE89B6EA8B25B20994F33643EAE5F3F2D196623C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055010, "uuid": "8b1a94e8-7ec5-464b-868d-bdf274187f7e", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055010, "uuid": "6bcf20dd-5eb0-4591-945b-0101cad306fe", "value": "6144:b76IHkLL82pUcRbIS2QsFnGX2wtvXuR0bAlj8:bW+krpUBU1mR0sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670055010, "uuid": "0a889de9-f83c-497a-86a4-65c2b91eab5d", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670055010, "uuid": "7efe9b3b-06a2-48ef-80cb-9159848b7754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670055010, "uuid": "9e198f5b-e108-4fde-94ab-69c1e1da645e", "value": "f1642b45acfb9014b62e9fd1e99bab115dd88fdcd92de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e50aa7-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670083353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083353, "uuid": "0f3af790-851c-4069-a803-80efa4fab58b", "comment": "Malware payload (Smoke Loader)", "value": "eb496a5c11501b5f26b7e9a1c724e5ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083353, "uuid": "8cf1f5f9-ca91-47e6-99bb-2bf449332580", "comment": "Malware payload (Smoke Loader)", "value": "f1b1349d6b032e77485d468213f9e86e324d82769ea3638ae3761e536462640c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083353, "uuid": "7e928d5a-54d3-47d8-948c-723784227296", "comment": "Malware payload (Smoke Loader)", "value": "544d09d8c1e1bf3ed001470bbaf3962bd549c63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083353, "uuid": "ce604fcc-ca9b-4cdc-80ef-37e4324ceb1b", "comment": "Malware payload (Smoke Loader)", "value": "c7c22a972355d0fbc855e712c66371a7cf0be55c18331245bb8c596fb752f31c7c757bc06367f719132103c38fc8fbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083353, "uuid": "80e83b8e-48e5-4cca-bc8e-fadaee82d640", "value": "T19B74D03176B0D872D69300758516DFA1AA7FF8316D61A9C723593AFE8E703D18A3630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083353, "uuid": "eb5b02fd-65cc-4b5c-b7e7-0e4473b71ff3", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083353, "uuid": "e319cf0d-cf73-4d6e-97ec-fb96cf91aaac", "value": "6144:X47/Aje4pwcV1fVhX+/xbJnMW2RqnZT5Y:X4jAjxHYxbtMW3ZT5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083353, "uuid": "4be591e2-6993-4c01-806e-9884da77e1ff", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083353, "uuid": "91bccc03-762e-4035-82d6-efd7a43a79bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083353, "uuid": "a1bf421b-b79d-4549-8e20-f52b0b85dd15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63480dd8-72b3-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670035030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035030, "uuid": "2b08083d-78b4-456b-b1b5-cf61225f3e9e", "comment": "Malware payload (Smoke Loader)", "value": "7e282fb04fd80c4a6b2bfd992ce94eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035030, "uuid": "8ab1d781-6a7a-4655-8a67-618ed9dc5510", "comment": "Malware payload (Smoke Loader)", "value": "f263be021d0ec5579db51492ae58a41c2647898c939324f326205ed575f6c912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035030, "uuid": "4e5137b1-566f-4344-b42a-be276d8803de", "comment": "Malware payload (Smoke Loader)", "value": "d368161fab7cfafaa064edbaa26ff2a3b23c0c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670035030, "uuid": "1810579e-e3b1-4b1e-be70-7c8b75a5501f", "comment": "Malware payload (Smoke Loader)", "value": "afadb77e9c351848f83cc4d6c47c78d7bde93865c5f9a38948f4ee1a398ffe9ece38b963679c9bf34446dea94b452c8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035030, "uuid": "6238234b-f5c6-46e6-8472-4af2d5b05496", "value": "T18574D000F9A1C436C58201FD8816EBAC9A7DA4315A25E50F37646F3E6F732E396763C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035030, "uuid": "b6e37a00-a499-447d-a5cf-63160a98b762", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035030, "uuid": "44f68529-a031-405d-b587-35344a51f60c", "value": "6144:AF5IkBLU8GXYcRzftWsMJq/6D/1UuRSCMYmMjH:AbVByXYYhMJqcZRSCM5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670035030, "uuid": "b8c97c4c-80a1-4dcf-a019-cb3c634df5a3", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670035030, "uuid": "21f8f0a6-45cf-4285-a376-9d091de178d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670035030, "uuid": "367e9f8b-a5aa-48eb-987e-6a07d11235ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907a58d4-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051857, "uuid": "6bf6afa9-ecb4-47d8-95a1-7f9ed5da02ec", "comment": "Malware payload (Mirai)", "value": "b738ec086cca6697bebe7fe61f5035c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051857, "uuid": "9c123fcf-4404-4e62-a2ed-e74fe1192713", "comment": "Malware payload (Mirai)", "value": "f30313fc6efcade28043e788c1413b35ed6873dc5dd895ed6aa622195c841cd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051857, "uuid": "7ae42466-8823-4ea7-9420-70ea3c41a2a8", "comment": "Malware payload (Mirai)", "value": "efce693cfda0c89ea6beed266c9fc18421ceba6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051857, "uuid": "f5eadd76-c057-4f32-9d91-260692f0515e", "comment": "Malware payload (Mirai)", "value": "ec43ed39f6b52e31a56b642832f14d095c4a9bb22bd43994feecd26bb2ad1c20e00e52ae2df1dc133821189a35fa0947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051857, "uuid": "d5e890f4-75dc-4c23-9f51-0b64c7dd11a3", "value": "T13FF34B39F6408743C1D22776B69B42453F239BA7A3DB3315A624ABF03FC27994D26D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051857, "uuid": "d565f1e9-6a58-427a-a911-5ea6b9521088", "value": "3072:hdyUWZ3axpgDjZCrEog6oxBEc5hB6GBZTM/9Wmvw0sL/Qpyn:DN43axpgD1CzoxBJ5hB6GBVM/9Wmvw0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051857, "uuid": "1ff89619-33d3-42eb-9ead-79a94a00a58d", "value": 161321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051857, "uuid": "f7d8bea6-ee93-4e13-974a-5634a621f313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051857, "uuid": "c2aedb92-d4f6-4d34-b7c4-c7fd9c469092", "value": "b738ec086cca6697bebe7fe61f5035c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "590c157e-735c-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670107598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670107598, "uuid": "1b94d2e5-66dc-4c33-8297-1843fb81facd", "comment": "Malware payload", "value": "69fc6d20f69635096e90d5befe72791d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670107598, "uuid": "b21b1a13-0268-41c8-9a3f-4294c081c723", "comment": "Malware payload", "value": "f4b624eddbe40923b83705e423369649ef2c74de8f4cb7cc026a2a3e09310f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670107598, "uuid": "c30899ac-dc42-446f-b8c9-45535d09fe47", "comment": "Malware payload", "value": "2b2536f6193b4d75c3bb3e6aeb7cd75e18ec47e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670107598, "uuid": "c10f42f0-8d5a-42a7-8adc-9a92c1f0befd", "comment": "Malware payload", "value": "d49887478cbb942afa21e8ac1634272be784847a4a99e59364d9b0b1609e6e7366be5356ae913787270fd1ee8916eeeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670107598, "uuid": "1caada69-6ff5-42bd-81a0-8b4c740e4ef4", "value": "T11C063373738654A4D155E3B13C60D860AE3F3F282825B7AC134C1F4EAB7A6DDA48E749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670107598, "uuid": "37ce05bd-1507-49b8-a705-99d75d45b089", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670107598, "uuid": "abfeb0c9-19df-4c92-8a59-4e5e167f2090", "value": "98304:g2d5MFV9aSUPU8QAK4xDMkVXZT5S6UaQyuMbGMzR6+jwXcyZ:TrPU8QyxDMkVXRQXaWoG0R6IwXcyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670107598, "uuid": "2ef45f8c-a8c7-4e28-ae40-9ffab029025a", "value": 3739409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670107598, "uuid": "749b177e-d3a5-4689-997a-dbcc6a3eff90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670107598, "uuid": "36d28d53-49ff-46d7-841e-9f126b1f55b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdf8091-7329-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670085942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085942, "uuid": "590b7b34-9d97-40c0-9c56-cb7142f0ce85", "comment": "Malware payload (Mirai)", "value": "ddc4c442f3756987ad973e910309c08c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085942, "uuid": "c5038014-0ae8-4200-908c-2bbc9ba63378", "comment": "Malware payload (Mirai)", "value": "f55ac023ff63665e89e3d52d30ba7df2157ee87dede3bc898ac9ec61ef10a565", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085942, "uuid": "9eaf62e3-5f0e-4cef-a783-e2b3f4046327", "comment": "Malware payload (Mirai)", "value": "4826eaf0c6821971bef315a2dac1652420d15420", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670085942, "uuid": "9ffe1ad3-bd89-462a-912d-a477a3b42e99", "comment": "Malware payload (Mirai)", "value": "69339943286aa9718eaa8ab56d0c5235ed971f823227109b6bd412bd6f4ff3e71028ac3ab5530bbfbdb4c10ed9351ebe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085942, "uuid": "a8b2dd8d-0d50-4ab8-97e5-c6a2bdecd0ad", "value": "T186734B24E9792E27C1D4A17A62FBC321F1E6220E25B4865D7C760F8FFF2465068172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085942, "uuid": "24e88144-6c59-4983-bd04-cbb97c48b49d", "value": "1536:RVFbZFcEvS/d7erkTS61Du+gc2i8R9QjLX56vNYCCAfBFx9:t/Jqxr1Du+gcz8YbovNqAfB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670085942, "uuid": "7ed4fe7d-d1c0-46a5-bb33-194207faa6cc", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670085942, "uuid": "a0b4500b-ab79-45d1-b624-c1970aa876ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670085942, "uuid": "18b77b9a-ec48-4e3a-a598-8f7394c8a11f", "value": "ddc4c442f3756987ad973e910309c08c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccb7907-72a3-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670028094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028094, "uuid": "65e5235b-d649-4334-84cf-5069140c852b", "comment": "Malware payload (Amadey)", "value": "a1a695930399a5fced11831e081cb3d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028094, "uuid": "f76ee64f-a1df-47c8-a248-def497b8bf5c", "comment": "Malware payload (Amadey)", "value": "f591f8a4fc63012d8ef1fea74b483945cf3982121366c490ed71df085cb7d2b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028094, "uuid": "af3241c1-d930-4f10-ad0f-578f359a088a", "comment": "Malware payload (Amadey)", "value": "3fedbbe94e5c9db49c249cda30616cbf79b34ee9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670028094, "uuid": "e3b84460-9da9-44d8-b08d-853cb282167d", "comment": "Malware payload (Amadey)", "value": "3e54ef408b650f78bd43ee5da18328a1221a43a038dfea0d7b8e6c134cf4dbcaf38e1032817b76b02ca7659d07c75a89", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028094, "uuid": "de76e032-4081-4f19-8c5c-877a73fd76db", "value": "T15384D050F5E0DC33C58604FC9816DBA8AA2EA8716625C54F77686E6E5E3B3D087333C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028094, "uuid": "97318294-98f4-4413-85fd-70b16833e561", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028094, "uuid": "d651522b-9ee0-4c1c-9b23-50756b729006", "value": "6144:1ayIceLJ8ilkcRHMu855+r7ac4w5HP1MOl6YG+LV1MBuR+GqjK:1bteRlkZud77r/LP9R+GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670028094, "uuid": "90c19ed5-ff86-4927-bab1-540ade8c34ed", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670028094, "uuid": "d7eb5d09-2a64-474d-8e7b-9a401518dffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670028094, "uuid": "da8f8f00-80a5-4320-b9e7-9e16e00021aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8878cd99-7337-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670091786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091786, "uuid": "fa8d0e8e-f909-452d-8956-21e40396ce5f", "comment": "Malware payload (Mirai)", "value": "ae8afefd39073570f678d2551ccc2645", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091786, "uuid": "51784f2a-4971-4c14-be53-dfb31ca0040b", "comment": "Malware payload (Mirai)", "value": "f634ffafdaf74751c4fab412d8d91fcc9abe2146976efe883351308582e50fcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091786, "uuid": "3079ce70-01a3-4492-9d26-1f2bbd07323a", "comment": "Malware payload (Mirai)", "value": "ac99afbc2a7272a1adc2a98c38bb82d9edd28877", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670091786, "uuid": "514ec4d2-deb6-4d08-a2b9-f968a58eba74", "comment": "Malware payload (Mirai)", "value": "5f62aab608220b301cee112f823f0207f6e8db110fdef4ea9ced49b80c8df91e22993e64eb19f995eecbd72601504933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091786, "uuid": "ffb963c5-d189-4a05-a2b5-b660fe5ba786", "value": "T175032962F91A9F52C00301F461E58E341F12FDEAAE932EF662B29FE044435D5B909FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091786, "uuid": "40738e7d-f068-43f8-b3c3-2537fd925e7a", "value": "768:4azlGxeyxt9CewY/bs4jCgoyZLwTICiNwbZ010U5Mo:4aQxFnL/YKIyGTICimb+10mMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670091786, "uuid": "ad171f0e-73bc-4df6-8021-4830471f8023", "value": 40372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670091786, "uuid": "a4b6680f-cd32-428a-86b8-75a03690b02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670091786, "uuid": "823e4bc6-dee4-46ab-9a89-f37396dbc243", "value": "ae8afefd39073570f678d2551ccc2645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c74ef7b-730c-11ed-9266-42010a9c0072", "comment": "Malware payload (CoinMiner)", "timestamp": 1670073217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073217, "uuid": "0103688d-d63c-47a6-9176-8f62a6e473a9", "comment": "Malware payload (CoinMiner)", "value": "4f1902241625b482c3c6f1a0f191c0e3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073217, "uuid": "d3f7a135-9feb-4a39-8b09-80fc84237fac", "comment": "Malware payload (CoinMiner)", "value": "f63b84859dc990b65e8eb8ee028a3b70ee03e9a3928fced6cea738ba7ef27a82", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073217, "uuid": "85f4a81c-9adc-4eee-be53-4335ee450ca7", "comment": "Malware payload (CoinMiner)", "value": "6a121e8ba1dad1123168b44d3ff27d275ec65585", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670073217, "uuid": "de835192-f756-4df8-8ff1-8387c140b33c", "comment": "Malware payload (CoinMiner)", "value": "2b94b214da405e868a278f569331cb48a1fb620296e7601584b62bb32797a19f18894644ab569d41214aad8274c93c07", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073217, "uuid": "513f0f02-d5c6-45c8-aef5-c1760bf7b6dc", "value": "T18445D081F5C9B165F0A36DF14BA6C3734A27BCF4A6D106172B64321F6A749068A3733E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073217, "uuid": "763c59a2-b3ca-4a2e-a213-cab3af6a372d", "value": "a9b6957b51d10876438e42f4d1647ce9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073217, "uuid": "01c5f960-960d-4211-9c6e-7c4dec321b18", "value": "24576:H5jFUhB1HVo1XVgWCd3l1vijZVp8RmL++ssS:ZjFUhHe1XVDQDviVVuRK+cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670073217, "uuid": "1f6c3995-bac2-4a0b-94ff-2d6374ec305f", "value": 1254680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670073217, "uuid": "96d3a31b-89f2-4973-8a9f-30e145dc6900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670073217, "uuid": "ee550f93-6a39-49bc-9623-f6fa652b5a1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9170f4-72c0-11ed-9266-42010a9c0072", "comment": "Malware payload", "timestamp": 1670040792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040792, "uuid": "e1354d22-d1c1-4e66-99e0-2a3fab182b92", "comment": "Malware payload", "value": "9184d98dac9fc5a978b9339a4a58e330", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040792, "uuid": "864a5637-920e-4d97-b329-0e303a5f5d2a", "comment": "Malware payload", "value": "f66c84142fc376444b6a6819bc4281ec1ef0c4d5c2308a7a92f74644731724b0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040792, "uuid": "0ac759ee-45bf-470d-b88d-c6d22d644c65", "comment": "Malware payload", "value": "4f7d2c2ef69364a3699bb61ad180710b962c504e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670040792, "uuid": "8dc7478d-3259-4319-b033-5207f03bf78b", "comment": "Malware payload", "value": "dbf586dff9f79d356554953b182920a4e47e93a3e80457d439322b95cb3a1de2b6bd06d00cb4102333dabcb32a7bdd22", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040792, "uuid": "07f02a3e-7dae-4d0b-afe0-40bfd405425b", "value": "T14656F18AB369A72FC87750734DFA563212864C578A83DB536948730C397B6F80F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040792, "uuid": "c8e6c295-0785-434d-9627-58d4f6409d7f", "value": "98304:mEjqBPZD8+FyYRjREd2Zrw9n8WrXrxGbfi4MIL+G39GaWIp3eNGzEGkYq6gYrRpn:rGhZD8AiXxGO4MLG39GaneotkNiW1mZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670040792, "uuid": "195905bd-9de9-4e50-9643-0cef13070b69", "value": 6097503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670040792, "uuid": "bb5efdaf-b090-4b79-9da1-85324d3e0239", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670040792, "uuid": "562f2e17-768c-43a0-8b40-7eef8552dbe8", "value": "9184d98dac9fc5a978b9339a4a58e330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e87b2af-72da-11ed-9266-42010a9c0072", "comment": "Malware payload (Mirai)", "timestamp": 1670051826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051826, "uuid": "b5bb0340-b810-4b37-a06c-a3bec4cc743d", "comment": "Malware payload (Mirai)", "value": "c8a794605fb110b0c8341665179b874e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051826, "uuid": "99ea95f6-5d9e-4550-8e87-223cb2d473dd", "comment": "Malware payload (Mirai)", "value": "f80f1854cb40fb302f6ebfea7b0d245fdec4222b1b68c7ed53ee72fb6a335bed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051826, "uuid": "fb5d7c19-24f3-4c2d-9c9c-73c53aaaa101", "comment": "Malware payload (Mirai)", "value": "2b7ed80f38dbae4c7870d5191bc7255873bd3ed2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670051826, "uuid": "67e2f5f8-8daf-43cb-9f12-e464f028d4fe", "comment": "Malware payload (Mirai)", "value": "33c2f3ee2d695dfdfac329b7ed09c813306724ab66c8e46b962e4cba00bbb07bff84a8efa82a65cfdb9d6edf2b320237", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051826, "uuid": "207751dd-8d27-4f3d-903a-0f63d22d7437", "value": "T1B0C32A36F4108753C1D3177AB69F96193F231BFB938B33166A24AFB41B817A90E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051826, "uuid": "66de8658-3de9-4a60-9947-9c5e37e790dd", "value": "3072:CdLaRDKluQeJ9xik5hZRKdCYuVmyvQ1J1UX4Tn:yLaRDKCik5hZRK4myvQ1J1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670051826, "uuid": "9ab96c03-5eaa-4b7d-9502-685b90e5e267", "value": 123245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670051826, "uuid": "7008d03b-f1f8-49b3-9a7b-533469353389", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670051826, "uuid": "953f14e6-b600-4f52-a0c5-1bd3e1396c02", "value": "c8a794605fb110b0c8341665179b874e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d719c1-7323-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670083291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083291, "uuid": "41876666-e41e-4231-a912-7bdb2964ed6e", "comment": "Malware payload (Amadey)", "value": "78f2ff1fc9e4fa10003b7fbfb08c57d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083291, "uuid": "cead113a-edab-4fa8-b2b8-3fc25b1f7f00", "comment": "Malware payload (Amadey)", "value": "f8ab64408750523492e67ec17f9b333d5324852106f475385a8fc8620f1af809", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083291, "uuid": "07bbd6a8-ee6b-4f88-a862-4d59bca8cf0d", "comment": "Malware payload (Amadey)", "value": "60bdcf10e5a6d407aacc3c2fab794f6649f0c35c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670083291, "uuid": "8e936c15-e09f-4bf9-be2f-24ac1975ee98", "comment": "Malware payload (Amadey)", "value": "afdcfb2c091bf733f04302284043c72599800ff58d0f0ae1effbdddac20f8910cc0c915f8c942280f236e938d568c49c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083291, "uuid": "20e4394c-da4a-43f7-95ea-2ba682503851", "value": "T11484D0F076B0D4B2C5930531B463DBA09ABFFA325D6499CB33691A6E5E303D14B2A707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083291, "uuid": "c06a7636-2bff-40d7-9059-caa1bd689c18", "value": "b483b26987043bea9f5c33199690f1db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083291, "uuid": "113369a9-55eb-43cd-847d-9aacbf9195f0", "value": "6144:+MXGAkeiYZnaBjHQ5bxBnMW2RqnO9tx2MY:+M2AkfYZQTm1MW3OVVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670083291, "uuid": "1004ec2d-594b-44d8-96d8-e1f82c50932d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670083291, "uuid": "02e899a9-e71b-4f0c-8e91-d591a0abcafe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670083291, "uuid": "b8bc448c-35c4-4aa6-a5e7-e7bebb3252ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8469b517-72b7-11ed-9266-42010a9c0072", "comment": "Malware payload (Amadey)", "timestamp": 1670036804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036804, "uuid": "7a0a165a-f86e-4aab-8ce9-07d06c4bd1ed", "comment": "Malware payload (Amadey)", "value": "5eef35d5168e95088384cd61ce33bc0f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036804, "uuid": "3a575eb7-7a50-4a3a-8b69-c51c1ae94e25", "comment": "Malware payload (Amadey)", "value": "f9787efd4339f6ff52ed7cc7bef2bf4caaab33069c760cdd97c107d12f8a42b3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036804, "uuid": "53bb54f9-1bc9-4d38-b27c-8189a627805e", "comment": "Malware payload (Amadey)", "value": "faac1a9e7bb7e08c5c619e34bd04a2af4c3e877f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670036804, "uuid": "6e956c76-5b23-4493-8f0b-3956a92ec547", "comment": "Malware payload (Amadey)", "value": "7879153751cadfe346aee9140a27f0b0df856b27d23faea01c97e1c1099c63da8ce07831774b6af617930c6fef657cf6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036804, "uuid": "516ab99c-f99e-4bf3-b417-715e063f884f", "value": "T11584E100F991C472C54201FC8925DBA89E7DA8316AA5D90F33A46E6EDE733D066B33D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036804, "uuid": "5fefa61d-d2a1-4f0a-a84f-eff55e778b28", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036804, "uuid": "c98fd6c2-db49-4db8-8934-36b0bcb95bb7", "value": "6144:wnOIDxLA8d8sQEcRFKxGReq9pEdUmI+7xQD+BupAzCSuRTk+jK:wOaxe5EOKx8Z++mI+2D+QA27RTk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670036804, "uuid": "4e8f0624-46cf-4d7c-ac2e-7f2078e9cab2", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670036804, "uuid": "7218928b-dfaa-439d-b705-dc96be8a1594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670036804, "uuid": "dd6668a6-b0db-4706-a036-23eb9b9641e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ab36a2-72be-11ed-9266-42010a9c0072", "comment": "Malware payload (Smoke Loader)", "timestamp": 1670039650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039650, "uuid": "b1a643e2-a818-4ecc-b3fe-470acbfa6cad", "comment": "Malware payload (Smoke Loader)", "value": "2218d075e8828ef93674f250f46bea54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039650, "uuid": "4c415a10-af27-461b-ba12-ed6a922366f7", "comment": "Malware payload (Smoke Loader)", "value": "f9b997e5cf256c99cc80318a9f8f0d269422e3cb989f3e435076257941eecbe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039650, "uuid": "c6cb830b-e53d-49b5-9f70-0877cad72103", "comment": "Malware payload (Smoke Loader)", "value": "02f850a6e5202096c151f5c054648510afee4bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670039650, "uuid": "b59fd7dc-f37e-43ab-a19b-dd3f08018f15", "comment": "Malware payload (Smoke Loader)", "value": "a63fb99e59d7e604fd2d70852036b5e0111d90f4bd9cc7a56a1e4ef298dce3e4cccab48ba9a90118c1be4e563e5f969c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039650, "uuid": "b18a114f-6bf4-4ac7-a8a0-e99bbe6b5e42", "value": "T1B974CF10F591D436C1420BFD8815EBADAA6E68325624D92F33646E5E1E333F187623FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039650, "uuid": "b8d82882-3613-436b-8edd-24a2cd20fa04", "value": "620e6f74b803df61a14fdd0777d3f37b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039650, "uuid": "e45c0fa0-bb91-4a77-96d6-c0748e9d1a9d", "value": "6144:zCeIOWLb8CZAcRA3a0yOYQDTn0XouGgnMPuR0q5jp:zP3WfZAlK0yOYQDTn04uGgxRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670039650, "uuid": "5cf92ea6-c615-41f4-9e25-6245c2082697", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670039650, "uuid": "b5cf2de5-1dcc-44de-a677-9435897bb756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670039650, "uuid": "73f230ea-3c5c-4c58-ba1d-78c9f8fd8d25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4d53e-72c9-11ed-9266-42010a9c0072", "comment": "Malware payload (Loki)", "timestamp": 1670044517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044517, "uuid": "faa42dd1-91e5-4876-9471-03a1a0677bde", "comment": "Malware payload (Loki)", "value": "62d3e3ee385e01f1373de562d3b7c57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044517, "uuid": "516a40cd-bc76-4d14-9352-953607e580bb", "comment": "Malware payload (Loki)", "value": "fa74917b3412cf02ceb60de07292b3b5ad1b9553cf2b4f91cbd0b463276c128d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044517, "uuid": "358268b5-c657-4289-960a-b2e7b61209b8", "comment": "Malware payload (Loki)", "value": "bb5853e568638a08e4946bd485166e16d8caddbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670044517, "uuid": "a80ce5d5-7e8c-4ea6-85f8-9b2cfc3c7eb2", "comment": "Malware payload (Loki)", "value": "c2b9fea1f65ad22031b3d8e834b83d4af3295011885299d63eeb66b7d49aa296d2867d55ace07e57bee28d4bea89f789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044517, "uuid": "6dd15cfc-c6e7-4d3e-8a35-4512f5219175", "value": "T1C7C422EDFFAD2622CC140C3500EE2E55BF38D6647D76E383405A4A6E3C66B6AB432471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044517, "uuid": "e5b536f1-2399-4428-96df-a062790d0d09", "value": "22103fe291d736c62df924a9fa661f63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044517, "uuid": "4b371917-709b-482d-969d-1e0905ee9588", "value": "12288:VAZ1UTYSwufC5pznPeiPXrJbIXEIJ+esTCmxO:hDK5pzPeiPrJbGU2mxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670044517, "uuid": "c1958a23-399a-45a7-af1a-13300613c20b", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670044517, "uuid": "134b02ca-aeab-4b57-b51c-26cd688ddd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670044517, "uuid": "ca90e8b0-f43a-450c-a61b-d550925c3705", "value": "FA74917B3412CF02CEB60DE07292B3B5AD1B9553CF2B4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541b57f2-732b-11ed-9266-42010a9c0072", "comment": "Malware payload (RedLineStealer)", "timestamp": 1670086545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086545, "uuid": "8d155cfb-324d-483a-ac05-53647bca733b", "comment": "Malware payload (RedLineStealer)", "value": "57682ff5c9b8509b8d0186bc98643938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086545, "uuid": "deca2e5c-8a75-4ab4-ac95-fdf6cace4c0a", "comment": "Malware payload (RedLineStealer)", "value": "fb5159650cc086dc7534f932876575bb3ff9c04ec25917495c71330680822018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086545, "uuid": "8e576bbe-e364-45a1-b2cd-0a431f0615fc", "comment": "Malware payload (RedLineStealer)", "value": "20076d4498ab35edc8a79fc94492ce37db99095d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670086545, "uuid": "034bf206-6201-4ee7-83d0-0199622e954d", "comment": "Malware payload (RedLineStealer)", "value": "9d618e4b6d7c4160214379c6da5f5039f6693f758995b9568cf8de2299d0f844b6cc8712272cd60815c71feb910e9c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086545, "uuid": "ac122133-c90f-4e9d-95ac-0522668b1442", "value": "T1A0F4AE1135818036CEF23D310969A37256AFF4B26BA25BDF1398DA7E5F306D06F3512A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086545, "uuid": "b5ce2945-bfda-48f0-9479-f5e78df96f6c", "value": "b889316d3a8b1477c173216ddf567051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086545, "uuid": "837d57e7-5c4b-4738-9ddc-963b03944e8e", "value": "12288:wDjQVrPbRp8pKx7BRL7OL5MhY18TNntqs6m5oYbZLOxt08H29c2XlLiuCje1keHb:gk5bRpyKx7/L7OL5HMJbZUG8H29JGQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670086545, "uuid": "f4ad1cd1-4cff-4796-b97c-215474ec1037", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670086545, "uuid": "8e18c431-0da7-4cbc-8436-88f35ebdf72a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670086545, "uuid": "19a9914d-16c3-43cb-b0f9-bd1b62d488e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "583f0c3e-72ed-11ed-9266-42010a9c0072", "comment": "Malware payload (GCleaner)", "timestamp": 1670059923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059923, "uuid": "790594de-9961-4bda-98f3-1472a13f8c23", "comment": "Malware payload (GCleaner)", "value": "b5b8796a1f26d569018f87dfb9f9ebba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059923, "uuid": "586e1ec0-03c0-4d6d-a30d-377d45dee6ab", "comment": "Malware payload (GCleaner)", "value": "fd9ab5ac2b75f9de0d46eed19786f6bab6f578192ba312d7be91b797b80dbe1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059923, "uuid": "c872f83f-6aff-459b-b8e9-4dbe41eb6ebd", "comment": "Malware payload (GCleaner)", "value": "40e899a60a6978dab3a914942b6244f9058ba31a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670059923, "uuid": "cf6e3328-8c63-4f7e-b8fa-a1109a009ed5", "comment": "Malware payload (GCleaner)", "value": "26147b2b551f9cb449720ffd0a12306dc1d3551c3a209035d7fc6a6821ecda8ea269725f5e513502acb8470ce0c08c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059923, "uuid": "3720bfe1-3472-4dcb-ac38-f120ff0d4dac", "value": "T179F533BAF1ABDD3CF5D60E79CDBA8EC84D1FAF6609BC05443779842C2935E681418B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059923, "uuid": "9a2282c3-1836-478b-852f-869a9292c0b9", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059923, "uuid": "12c83714-df72-43a3-8d4a-a44fd90c9c63", "value": "98304:g4gKS1pX84amDaD92uyPcUVceRgeMWNT2vWRE+TJXcyi:JnWamo23xVce7rTfREmJXcyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670059923, "uuid": "96dd8a12-5989-4ea8-a452-9cd519f35c12", "value": 3594354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670059923, "uuid": "feabdaee-b61e-4679-b87c-cb0131026b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670059923, "uuid": "270443d7-d1f1-48f0-9ddb-33c67df123ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521495a2-7358-11ed-9266-42010a9c0072", "comment": "Malware payload (Formbook)", "timestamp": 1670105868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105868, "uuid": "b9248216-a322-47c8-9f20-baf73d4d08fa", "comment": "Malware payload (Formbook)", "value": "d7efd600d714d6d2f6b7fadc6adec0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105868, "uuid": "dbebe735-5671-4a01-9221-c5f19287e0eb", "comment": "Malware payload (Formbook)", "value": "fe199e437de02d997427dfea4e864f386e12887c5ae16d2acc465417cd539521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105868, "uuid": "aa24e6c5-4985-4eaf-89d4-efcd581d2282", "comment": "Malware payload (Formbook)", "value": "ba35f96a741637af1d1319074396f1bf891f13e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1670105868, "uuid": "58355251-e48b-4e0a-adbb-2409b7947b0a", "comment": "Malware payload (Formbook)", "value": "70ea0a319bfbd15d65ce0c9a4125b05eb60dc753817164f159288678a453413bf2ad912713b12a7f0bb69f884c128509", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105868, "uuid": "2847cd30-282b-4f1d-8714-6f2f5abd3d33", "value": "T17AD40293316D5354E7A93BF135E29741BBB0BE791863D42E2A8875DF4833A008F31B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105868, "uuid": "fd58d1a2-4d42-4a6b-aee8-ddde9dcae4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105868, "uuid": "44d94b27-a2d7-4b64-a3fc-ee8e31b110b6", "value": "12288:90zcBpbKbfzdHP/FvT9mzyK8DzVlCxlASlDAMTQu1c66XZp+:9hbbKnlJRKyKUBExjjcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1670105868, "uuid": "bc760e13-9443-4b25-8584-c84f0ede6fd3", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1670105868, "uuid": "f4a6018f-98f3-4fc3-8a88-a945bb76cf30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1670105868, "uuid": "2ce63bdb-4ceb-41f2-a054-993fab02c131", "value": "BNK0002334789532_USD28,770.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }