{ "Event": { "published": true, "date": "2023-02-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-14", "timestamp": 1676419381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fdcea645-b086-4733-817c-80f3854a082c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2172372-ac28-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676352737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352737, "uuid": "39ad3408-0fbb-4248-8de3-94294ac4e9a0", "comment": "Malware payload (Smoke Loader)", "value": "e254d902bc726a628a2a78ef4ca5bd8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352737, "uuid": "966fab40-1ab7-4ac6-9e09-d5509335aa1d", "comment": "Malware payload (Smoke Loader)", "value": "0001000d18a8e5a874392f6deaecceea53779b34dff8608ff0c017cc82bb5140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352737, "uuid": "b9751634-b946-414c-8bec-0fe72b506902", "comment": "Malware payload (Smoke Loader)", "value": "75d947d92caab7d0ca53d87f999271ad0e6531c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352737, "uuid": "4e009338-2f47-497b-b965-ebf7f93efc06", "comment": "Malware payload (Smoke Loader)", "value": "b5ab91321eb58c91a63386882eedbe7d83579c224a749c23aaf8310a095f60fd6d9cf514890f22d557a7dabebd9a7f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352737, "uuid": "1698ab1c-51a2-4048-a808-15254ff98e18", "value": "T12B04CF123990C073E4678575243CE6E07A3F7CB2A7F18CC7325816AE5D313E1AAA9767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352737, "uuid": "85a148ba-b7a3-4111-abec-505a656d4ba9", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352737, "uuid": "46cfd8f7-33bf-4936-aaf8-9dfa40d99e3f", "value": "3072:loUkLEzw35fZIdfxl0Hhiz23Fp/7e0bw4OUsrxH+tVEZ:+DLKw5ZIBUHhiUJ7e0Ejrxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676352737, "uuid": "278abe04-0811-4a06-8dcb-d326bf9da0b7", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676352737, "uuid": "3d5452f9-763d-445e-8f9a-b1e50296d5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352737, "uuid": "b7086c78-23fc-446a-9def-587bbaf32919", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a405c641-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419178, "uuid": "69498176-3910-4f3e-909f-f3f317c73155", "comment": "Malware payload", "value": "fbec342ce6371f929cbb9c93965a81df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419178, "uuid": "660e251a-4d34-4422-9540-8097441825fb", "comment": "Malware payload", "value": "00475eee9cbceb1e96f27e78de2049a573d40e82406f6942f51472459f4d88b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419178, "uuid": "d1da5baa-ab67-4192-9690-acb118b865bf", "comment": "Malware payload", "value": "29779c02f6f1e468016b42282106f802d5a3b511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419178, "uuid": "54e8683a-eed1-494e-8085-7e1f02f2e04a", "comment": "Malware payload", "value": "3a4e256f84ed305ecadd581da4cf3deac4d90524d41f63ebba61b160c6591b03c316798230fbd31e47e1a3531ec09155", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419178, "uuid": "1e167ae9-6f3c-41fb-9a18-b326cc121ea1", "value": "T157934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419178, "uuid": "c54be125-d47c-4b6c-af40-70328541e5e9", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZys5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjg5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419178, "uuid": "61faf9cb-73ce-4f30-9603-4b703aa7a0fc", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419178, "uuid": "efd8bd8d-8f02-476d-8a81-7339ddd9e1d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419178, "uuid": "701f2845-eaa8-4529-95d5-0cbbff07ae2f", "value": "fbec342ce6371f929cbb9c93965a81df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd8206-abff-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676334784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334784, "uuid": "1ffab894-420a-463f-bf1c-c66778d27508", "comment": "Malware payload (GCleaner)", "value": "b55a8c9d7255ebf1cde9e65a67c449f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334784, "uuid": "bf16ca71-df18-4202-93fb-d695eacfd484", "comment": "Malware payload (GCleaner)", "value": "0049f35993e44a8d03f7495890a4d9d2e07c8357beb200990ae4c790879a030e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334784, "uuid": "5cff3f15-6728-41de-bc04-cde487b0fe8c", "comment": "Malware payload (GCleaner)", "value": "9ea6352ab0c5e7378b146ce095361111da6147fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334784, "uuid": "bb138471-561e-44e5-8cce-945bdabe50db", "comment": "Malware payload (GCleaner)", "value": "614a33076bcf5b05a4a3650986b700f3f51e4ddec42c6feee2ccdd8103c7df4d1de26eed8e08b7da12cda717afb43135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334784, "uuid": "fb6a4ae9-a8b1-46c7-ba4e-6b8a7161555b", "value": "T197F5127C7504D46DC280BEB4C83AD4E71CDA2DE3E9A49022B4DEBF3F52792895B1A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334784, "uuid": "3173f335-d783-4e69-8775-66920aed64c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334784, "uuid": "eb1f1e83-058f-4e81-a0f4-a082308f326c", "value": "98304:JHA44ATgusL+OEyxH2gMkhadRt687Ov2MR:dqSOEyV2bkjSOvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676334784, "uuid": "11e173ed-6667-46d6-b6cc-5eddab9b6e0f", "value": 3322366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676334784, "uuid": "d906bc3f-c25a-4ce6-9320-4cd015dd0423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334784, "uuid": "a53dda8b-1178-4909-aa7b-7770b10e6ef1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c576d13-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392939, "uuid": "fdaa645f-595f-4419-b985-5a3b2cbb2c16", "comment": "Malware payload (RedLineStealer)", "value": "03a0d7e8ec3bf7c42d4c474643a773c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392939, "uuid": "63f9a6a1-b515-495d-b9c5-0fadcca2c3d4", "comment": "Malware payload (RedLineStealer)", "value": "00ee45e1829436be207411080fbccd1d736b62a4ede212c5c7d1e15a1b07f9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392939, "uuid": "472b0a18-1046-493d-9dab-e4bb107c75a7", "comment": "Malware payload (RedLineStealer)", "value": "7cd95835743558d29f4f2bc53ce7b46d47b8a0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392939, "uuid": "43ae7452-8bc6-40b3-a25a-de7e81225c72", "comment": "Malware payload (RedLineStealer)", "value": "7abd09d310ce45a9001f6e4683cab226697c6d376b1ae884ce094213da3174705c880e14ffe5a2158520017d89333c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392939, "uuid": "08594134-8a32-4f6d-a3fe-eb23a73c1fcc", "value": "T1BCB40207AAEC9032D8B15BB019F703C30A367D61673C935B668E6C5D4873AE4B63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392939, "uuid": "5311bb2d-cda8-4212-a175-1f42f5ecabec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392939, "uuid": "1362caeb-b251-4e0a-a192-5c96c224e987", "value": "12288:/MrJy909tBZKpJlnmjasqU9H3oDKvnagV2OqfJB29JAcP:Kygt7KpJxBJU9Xo+SgV2l29NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392939, "uuid": "25a5286e-e608-46e9-b2ac-af76191ff865", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392939, "uuid": "52cd5674-baf2-4ec7-a7cf-fbcdfaf3a4dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392939, "uuid": "6df59c98-ee5d-46d9-a896-9c7e4c236bba", "value": "03a0d7e8ec3bf7c42d4c474643a773c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43cb9f5b-ac20-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676349009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349009, "uuid": "7b07f289-a24c-4646-904d-9dcf8ec6e66e", "comment": "Malware payload (Smoke Loader)", "value": "4894b60f2032f7de58f510305553b2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349009, "uuid": "dca808b8-e5b5-4e76-8f17-fef6a9093996", "comment": "Malware payload (Smoke Loader)", "value": "01072c7b310d292d9cd28f034137cad640cf1814f603c8ae97a1d666d0acd287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349009, "uuid": "bcbcc39e-7632-4c47-a590-98d8fa313928", "comment": "Malware payload (Smoke Loader)", "value": "5b3071f7f0a97c7a50ddab8b3df679ae148e9ce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349009, "uuid": "9b459ada-8fe1-464d-9dc4-18889693c80f", "comment": "Malware payload (Smoke Loader)", "value": "8a37a22616c2b0ed69f81af08552c9a7cf37b49cbbf750c1b1bdbda21927274dba0b56a52768cee614323f0cbf5ed075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349009, "uuid": "2433746a-3b68-427f-b440-8b38a8092dc8", "value": "T18514BF12B3A0D472D56F4A318C25C2B0AA7FF8215B659AEB33945B3F0DB03D09E76359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349009, "uuid": "ef6c7b36-a56c-4f6d-b478-6a8801f1f690", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349009, "uuid": "48807b0a-f748-4e2d-bbd6-f5adb9515e84", "value": "3072:vJCu2a5zumQLNoPKnyGT36IoTZo5JXPTLBRYYURVrQdVTgxM:vjJuTkeyGT3luZo7X7LBmYEVETgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676349009, "uuid": "cef0a3ef-5cde-452d-83df-1b15c6eac43b", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676349009, "uuid": "f24d3973-1a84-4492-814d-16b3b450c9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349009, "uuid": "a47f2ca2-051a-49a8-9432-02ebe2bd2a6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4eccb6a-ac99-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1676401222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401222, "uuid": "b1884420-0687-4624-a25d-2922987fc72e", "comment": "Malware payload (VectorStealer)", "value": "f403e2c0ab0b60e77ff753498b80f26f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401222, "uuid": "5b69d6cc-13ce-44ee-aac9-8b98fd702db3", "comment": "Malware payload (VectorStealer)", "value": "0118ff85ec2075d5a4f006c5baec65212ae5b921ca00fdb66859687836b8efef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401222, "uuid": "8b33f2cf-210b-44b9-8c4e-be02b12ed794", "comment": "Malware payload (VectorStealer)", "value": "3fe89dc94f02c7f0ffac7fd501f0e7c5b33535ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401222, "uuid": "fcc43332-47a6-47a0-985e-3c6b9631202f", "comment": "Malware payload (VectorStealer)", "value": "7953c3a16868a8229aeeb9770df5a3de7bf339f88de6bd17f32306ec4cd494090f0e57d04d16d80a28c3b7ebbd4906d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401222, "uuid": "bb9f4889-961d-4a0d-b14a-a7bd5be12c23", "value": "T1683523841FA42F01C4E493F6A43FA9092374B8E63767DEC42C4A1CECB6577D22919B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401222, "uuid": "303f0a20-caa9-4fe0-9808-5c8dcab5fe46", "value": "24576:qjjBabBko/XEuDI38yb52TLnE1knV0vZoiR6An3F7Mp1FJQz:qBmeo/HIT52TERlnGpKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401222, "uuid": "66c7a0e4-719b-4b01-a0d5-6e9e7104df01", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401222, "uuid": "a1709f87-6349-4a23-96da-484414389c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401222, "uuid": "893f2fbd-0491-4ccd-b574-f058f71d605d", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965f7beb-ac1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676348289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348289, "uuid": "b223f04a-ab4d-40e4-9733-a7e94f81583c", "comment": "Malware payload (RedLineStealer)", "value": "db0e9932df2556ac78f4be1dc26704f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348289, "uuid": "c6ff0bf7-4bb4-431a-a55d-312c78517e28", "comment": "Malware payload (RedLineStealer)", "value": "01baeb1cb3eb5faf60a4b502f5b4b50d2c3bc2a8fb19ce3c4b229418260d74e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348289, "uuid": "66d10cc0-c13d-406a-aa15-bec46f524d1d", "comment": "Malware payload (RedLineStealer)", "value": "f2a8f59b3ec489afcb3b6689fda610d76d42743c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348289, "uuid": "1ec3acfc-f3d4-46a0-9c8c-5a9b879a1b85", "comment": "Malware payload (RedLineStealer)", "value": "20b51bdabb64720d449ef139c45ceb8b1f8e0398f436bf723843d155232279acbfd0cae0300d49f802fcf3170b2dc72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348289, "uuid": "3ab9d985-537b-4400-bb4c-232d25170a46", "value": "T174F41257A7FC5032E8B09BB059F603C30A36BC611B3487AA578F7D191872668F1B5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348289, "uuid": "49b2965a-a0dc-46c6-bafb-dc6bc72febcd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348289, "uuid": "42800ccf-ccde-477e-91b9-b4b8c9e31a4d", "value": "12288:JMrjy90wkMrDw+lMVbY2lDRTXR/AhrFL47TM9YS0arzIjtAuChgD2ojQ1:+yk4BMVbfJRl/h7TM9YasxmhgDvji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676348289, "uuid": "bbd25991-5e8a-44fa-8f11-e35a78e27f2a", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676348289, "uuid": "0b4182a1-b057-4334-beae-bdf6d731d494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348289, "uuid": "def0770e-c400-4686-8fb9-0bd6ab0c281d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c467f55e-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676391745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391745, "uuid": "0604e18e-a228-4e55-819c-13e9bdb08ef2", "comment": "Malware payload (Amadey)", "value": "f9fb0c3e80e2056c145b7ed295e607b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391745, "uuid": "58775d23-d009-4007-adaf-cb687673a2ce", "comment": "Malware payload (Amadey)", "value": "029e872b833b576be0fc3c4ccf50fc8ca3e98d58bd94e7d1bf2f64cfba6100ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391745, "uuid": "efdbe76e-45eb-4894-8bd8-f3dd6bad5c2e", "comment": "Malware payload (Amadey)", "value": "3bf0b718e7849dc647900378594395801a10d476", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391745, "uuid": "38f5b4aa-61ef-4631-9af5-289e91746e42", "comment": "Malware payload (Amadey)", "value": "48e719b96b74d6a977b424162b4dce5f54744d27ec5f8f178dc2822889ecc383702a8d6908e3e55884ddb75c855e3a4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391745, "uuid": "241c0586-cad3-4c86-9103-11b7060e6e79", "value": "T1CCF4134BE6EC5136E97957B009F606C306377CB09A38C69A538F5C6F1C72AB0A635363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391745, "uuid": "bdf6c6bc-b903-4dae-b865-ddd41c466320", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391745, "uuid": "6bfbb0e4-48e5-40f6-8502-5f747ba1f738", "value": "12288:ZMrzy902/a60IoZlMyoeSFGaq6ejA0gspcMD5SLG5ztU0VMfhI1w9oM9UnaDZI3p:SyX/ayoZl3oeUbOjAIRDoLGo0ifww9oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391745, "uuid": "3e5bbc17-3460-4ed4-a38a-6df592c9e85b", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391745, "uuid": "74ce1325-0377-4121-8d28-aae099e48bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391745, "uuid": "c21ef297-1319-4709-ac71-637be70f653d", "value": "f9fb0c3e80e2056c145b7ed295e607b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9edf0c4-ac81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676390949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390949, "uuid": "fefb4f0e-8fdb-42ed-9cca-146584325d35", "comment": "Malware payload (Amadey)", "value": "07dada71a84c8dd6abd220ed3ab6c496", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390949, "uuid": "a3b28a85-e388-46cf-aa3f-dd63d8022a2f", "comment": "Malware payload (Amadey)", "value": "039f91d74199bfa03a0cf2afc494894e6eddeb5feea509b524cd3236b8affbd6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390949, "uuid": "98e4a916-cee6-4e72-96d8-6bc4f9bc1f7b", "comment": "Malware payload (Amadey)", "value": "1f0d50ab60f73b8f13ada6ef2ecd2a322fde48f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390949, "uuid": "5fd8681e-6dc2-4a74-8a55-beaf15c8c0da", "comment": "Malware payload (Amadey)", "value": "78cd6ca7eba9cb947556f4d18a3ca692d8e853b09f6682d2c26d94bb4414a6e4ed158fbd533b4648e1a56f829dbb0b41", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390949, "uuid": "76fd517e-c0a1-489c-9ada-82403e7ca1ea", "value": "T143F41207EAFC9022E5B59B7058F246C31A317D715A38835BA34EDC9E0CB2670767A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390949, "uuid": "b5676eb3-bde3-408d-b586-85431bdf712b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390949, "uuid": "f22b61e1-5a70-4999-bf84-f9381f33b329", "value": "12288:XMrVy90bq7TnVnTQVsQxR0SdBDPuQMV8Fi4D/nS0FW3oM3UnamVtOh:iy177VU344PuQiiDfkogpEtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390949, "uuid": "bfcb02ab-fdd7-429e-aa21-3fd7af46438e", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390949, "uuid": "ac28a729-7585-487d-a1b4-9d64abc67d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390949, "uuid": "162302d6-e7fa-4687-ad64-99ff27f92020", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f4b5e7-ac18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676345523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345523, "uuid": "d1b655cf-aded-4f4b-97fd-4f5332da8512", "comment": "Malware payload (RedLineStealer)", "value": "2a64a6e1b1731d305508ddd23b3de3cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345523, "uuid": "2a7e2e37-cacf-4df5-8293-4dd3b0dbc784", "comment": "Malware payload (RedLineStealer)", "value": "04017817b08d8f6912600910ac643b26aa3683fafcb6256485eeba3a916a3d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345523, "uuid": "73ea5201-c762-4563-be91-8226a2663443", "comment": "Malware payload (RedLineStealer)", "value": "0de6d039f964e50995acea625db5224eed43bd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345523, "uuid": "fe1a97bd-4e55-4b77-8531-01bcc4b4b00b", "comment": "Malware payload (RedLineStealer)", "value": "2feb764fbcc58240e9c3a304606bfc6054d8b1a35d09f3a785865f4228dfc0ecbf4e353d32d5ed2d7c8b749a0341b6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345523, "uuid": "43c5ce36-a6be-42a2-a891-c0bb492ff6bb", "value": "T108F41207F7F90025E8B19BB559F642C309337EA12F7986A6760BAC490CB35B0B578367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345523, "uuid": "b1e5e05d-9549-411d-85bc-3cf83cb10bf1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345523, "uuid": "4ab930bc-65f4-4c38-8b36-1402918ddab6", "value": "12288:bMrny90hwULTpVVk4V8Hkz60OaDC4CF/4E2aQdiH5zTbtAufZgc7iOF9f:QyYpVVPCH+RZbE21wH5nJrZgc7jf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676345523, "uuid": "e2e8b744-e49f-4b1f-899e-50e2503715d1", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676345523, "uuid": "ecd26e2d-6f6a-4807-b558-21c87b9cb8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345523, "uuid": "a173288e-a503-48da-8b6b-113c6a298b62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbdc3f90-ac90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676397368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397368, "uuid": "be713a3b-95fa-44d4-9d05-3bb1a350e067", "comment": "Malware payload (Quakbot)", "value": "41a7f6cb0c55a94975f3d731f5661706", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397368, "uuid": "b2c0bb55-0a38-49bc-89f5-06ee9c0d4840", "comment": "Malware payload (Quakbot)", "value": "0415ef433261d715e36a1d6497ebe78dd1fb7dcc45e018e5a95def1572e47272", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397368, "uuid": "6b925544-67b6-416d-9587-716f9e0253fa", "comment": "Malware payload (Quakbot)", "value": "aedceb73661abfabdae94b7e11e89ab2d3b0e6f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397368, "uuid": "dfc4116f-d813-4dd2-bc29-8a10387cf14b", "comment": "Malware payload (Quakbot)", "value": "77f38901db21602ca6c7e65e0ae1256a686ed6b2cb6e8eff6360e5c308aa535d4896cc657cd5b001103d66eb64d1f78a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397368, "uuid": "8d3693f7-dfc4-495b-aa5f-91435be6fbb6", "value": "T1B7947D2BFE4F10F9ED1B08F6C047F77F6E3C53698A20CCA5D8540E59ED656A6400AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397368, "uuid": "ab0dcf03-0959-40b0-9ce1-aaa354e5f746", "value": "4160b8ad2228905966ea106c1f7681d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397368, "uuid": "3ababf70-8944-47fa-a317-dfe07ed7f7c1", "value": "6144:OJZRRRe1q7nXT1BakCSLdzOr2ewln8V7zDaVtfCvVBwBYjWmk9jCLg5HU2fshIA:OJZ701QXT1BaB4Irm8VGfWKYP2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397368, "uuid": "1a2a3dce-d34f-47c7-9fbb-44f87c2a58e0", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397368, "uuid": "e714c557-12f8-4bb3-a915-76474a0632ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397368, "uuid": "eda96954-ee03-456b-99fb-b195f18c5999", "value": "1.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8429f5b6-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392926, "uuid": "2f0e1d5d-be62-4457-ab8c-89b79dfa2aab", "comment": "Malware payload (RedLineStealer)", "value": "76755bfbf13dc253c291104df6b3e147", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392926, "uuid": "5823a45f-db99-43b8-b752-86843f9eb4be", "comment": "Malware payload (RedLineStealer)", "value": "0423f6894af5cdff8c3ea348370c3c9e950fa161b6aa7ea78ae43020d6ad6458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392926, "uuid": "d9c9fcf0-06dd-4911-b56f-6c613b013d53", "comment": "Malware payload (RedLineStealer)", "value": "a6a1720b95d4405f3181420abfd8fc3a54f214a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392926, "uuid": "95c1dc83-48af-4931-b7cc-a9c1bd79a085", "comment": "Malware payload (RedLineStealer)", "value": "2a6a1a5027849e196390ef5ba8da5eb004d3728c656557af8fdcf34ec575ffcd59f246a17e08948a12b0959d41dfc91f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392926, "uuid": "d353ba8c-66f5-4ba0-b557-cede3428bd91", "value": "T181C40207A3F88172E4B097706EF603D30A367D605B7987572B4BAC6A0C72671B63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392926, "uuid": "e64fc9f0-29b4-4cfd-9439-c7f815d88ac6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392926, "uuid": "b7276efa-8723-4059-aec9-788377144b6c", "value": "12288:OMrGy90FsRgFOgVkRarojygqw09kBRWoQ4DDEBfwBb8ma:Qy4sRg487xy6o8tBfw+ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392926, "uuid": "f3a2e2b6-dadf-4e37-8371-50b120f680fa", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392926, "uuid": "b5ed4396-b004-4d36-8408-6d3525186b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392926, "uuid": "c1b663fe-0ff1-4db2-8ea6-0713d5e423f4", "value": "76755bfbf13dc253c291104df6b3e147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd0bf2d-ac31-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676356277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356277, "uuid": "86fb0107-a550-4dab-b59d-9889dcb61b96", "comment": "Malware payload (Smoke Loader)", "value": "314a101c0df4b303d045c248b39afe3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356277, "uuid": "0daec118-c6d5-45b2-87a7-49313dde9faa", "comment": "Malware payload (Smoke Loader)", "value": "043e726ad4de18e0dcaffffea8e9ce32554e408b002eacd6bd35333ccde5a831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356277, "uuid": "d0bd6f2a-c3cb-4c8a-bf1b-2c43284e64f8", "comment": "Malware payload (Smoke Loader)", "value": "9e9132fbae5481d6681a6b364dffc46a94b003ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356277, "uuid": "a810279d-51c1-4745-93a4-0c4857fa61b8", "comment": "Malware payload (Smoke Loader)", "value": "fd7045f6d7a63c967cc2e4ceb8b125dfa580ff27d25283fcdb7c8e095bf4bb814acb90275642b01aa0c2cce3b4e00c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356277, "uuid": "f460d0f0-0234-4ac1-b4cc-caf2e6bf4ce5", "value": "T1ED04CF31BAA0C076E167C1B56531D6AC2A3FBC72A7A0848F334416AF2D303D15EB579E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356277, "uuid": "480d80c1-8c1d-4967-b53e-d4bc76af0cf5", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356277, "uuid": "90b0aca5-43c9-482e-8ecc-e1b427a0e0cc", "value": "3072:/ojXSLnFq5fgE9gidMjHCFrJPg4IX9qd10+p7rq62J2Z:QmLnFwn9ZWUrJYLXmv7rq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676356277, "uuid": "0d24f75c-1c2e-4e35-b2a4-4b7133454d2a", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676356277, "uuid": "56b9516d-2930-4cd9-b940-b9be72bd52b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356277, "uuid": "bf4734db-843b-484e-b5b7-003f7702dea2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d891840-ac2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676353401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353401, "uuid": "7c6bb579-3e30-416e-a2de-6f49e1615bcc", "comment": "Malware payload (RedLineStealer)", "value": "650117340d34b6d366fc050ed5bf8ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353401, "uuid": "3534fb58-de06-4a2f-89c5-baf5e4842d68", "comment": "Malware payload (RedLineStealer)", "value": "04be66795ce33c7cca3c0fdf40b333f8608c08df13b6cdde9f4e86a1f274d8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353401, "uuid": "6b12699e-4efd-4d60-a947-49043ff67c10", "comment": "Malware payload (RedLineStealer)", "value": "5d4a6504800441a1f7b9b8ef2f7547030b712afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353401, "uuid": "6c094b78-c68e-499a-ac19-1e37a708fc3a", "comment": "Malware payload (RedLineStealer)", "value": "c5c43018889db3ecc32b8538c276afd6daf0e46e4edca2d941f6b8cf8273cf48feffa6fd44b1c3b23673b0838a0439b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353401, "uuid": "a715c08e-3cfb-46e9-988c-4356ad841d65", "value": "T169F41247F7FC8061E8B157B058F742C306367AA05B7A83A7274A985E1D726B0E63533E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353401, "uuid": "81e42b6b-4606-4a03-ba40-c75fbb20d9ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353401, "uuid": "bcb3490c-8050-47b8-a891-387aa72bd189", "value": "12288:MMrPy90AOBX3r7mYex7sIVY9tM8NUUmsV9FD4fruKmAAIy3Z6kfWykL/:zyk1bqYex7sJtM8NZmjfr9mA7SpkL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676353401, "uuid": "056bc4cd-4eaa-4237-beef-4e13e571d449", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676353401, "uuid": "5795b32a-48f6-49d6-9cdb-ebbd2fb0e071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353401, "uuid": "9799b783-b5d1-4355-b64d-3ee0b3de0744", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6716450-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676399077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399077, "uuid": "0be5c07a-c77d-48f0-979f-8400c1596725", "comment": "Malware payload (Mekotio)", "value": "790394907e8b891504c5701c25547622", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399077, "uuid": "464149fd-66e5-44c6-9f2b-9a02f5b967cf", "comment": "Malware payload (Mekotio)", "value": "04d87473c872231d983c1ba26e9c2d4e346d3853990a5746210dc74bfaccd833", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399077, "uuid": "c9115cdf-5ffa-4aa5-aa10-3a773862e036", "comment": "Malware payload (Mekotio)", "value": "841b131d263c28dc82cf9588a28060f014ae97c0", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399077, "uuid": "feadc99e-b047-44af-a842-9dd36194b895", "comment": "Malware payload (Mekotio)", "value": "e1e3ddc36aaebe3f531e63fdc8607cf5b294f14bb87f0c75106021543de20d24b48e181b7aff3651ac15682cfd07e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399077, "uuid": "666a523c-7498-4f88-9055-afaaf6fbd13b", "value": "T19076236372468126D1FD85710A1BBFD561F21724836354FB72D85ECE39F25E0A2B2AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399077, "uuid": "5b830001-3565-404f-b928-c8a3f4fc91cc", "value": "98304:UY5HeNZ+aLu65jdqGyW3JVNUG6dbTowvmTgPTXcixOY/n0Kv/JWuji8F60THykGg:R+DpLf5tv3JV96aGmTgPTXcHY/1BI01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399077, "uuid": "13dcef03-0650-4930-a437-611f66b9d1c1", "value": 7507968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399077, "uuid": "608b0f8b-4209-4229-ab0b-ee0c6e954a29", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399077, "uuid": "27791f52-9a46-4919-a1aa-11080a75af28", "value": "FACT63eb9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0de2ca5-ac8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676394826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394826, "uuid": "57ae8552-803a-4bd1-b696-b113f09c844e", "comment": "Malware payload (RedLineStealer)", "value": "f1ee561048f04bc29ce76e66a5ff4a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394826, "uuid": "984084a8-b59f-44c9-8e7e-d019502d03cb", "comment": "Malware payload (RedLineStealer)", "value": "04ef0b7f8695a2c184f18a85b64cc5aec7512a55f9a7fc73e86d4a55b88bb52b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394826, "uuid": "bb91f451-346e-40ce-8665-a3a7d6bb7b4f", "comment": "Malware payload (RedLineStealer)", "value": "be93a771b6d66e343f5dc33567e9214f52144a96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394826, "uuid": "6f5c5e15-4cd8-404f-a0c9-c99d9191c0f3", "comment": "Malware payload (RedLineStealer)", "value": "8b7a3458eeafdd61cc2b5cd02b5b4c831f5c9ec2b2b3154b0ff52bf7f159fd9813e974dc60a7da195cf1b2db6ff7552f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394826, "uuid": "bcb0f0ab-b4ab-409a-8765-d7ed36235a9a", "value": "T129F4125BE6FC8026E871977428F603C30A36BD611F34839B678F9C551CB25B8A676327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394826, "uuid": "dc0e352d-cb08-4417-8d34-12e537b06cbf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394826, "uuid": "c08110d4-4417-4a7a-878e-15e99c0255a2", "value": "12288:sMrTy90YvGwUm8BxczwuBSiTt30nFQ4mivPLIdmRZCPUckVAg:nyuRm80wGpsmi7gmRZCMrAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676394826, "uuid": "47a46beb-7412-4979-b3f0-83b0b6c025ae", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676394826, "uuid": "bfaff4a3-c436-4b26-883b-f22c7575a3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394826, "uuid": "81a8ef84-7fb7-43c7-8eca-3431577970c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ed54cd-aca7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676406912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406912, "uuid": "e19379f1-195e-4285-9704-c3a6ca08d577", "comment": "Malware payload", "value": "20db25a9fea3c1be7c05243f4a785f47", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406912, "uuid": "ada58bc3-27c3-4848-ae23-5724258d683b", "comment": "Malware payload", "value": "04fc208575dbe86f6239f612c8eddb0d9587b9c5a2e20ba5e96190f28ea61ce4", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406912, "uuid": "c1d4b98e-9638-4a48-b00c-6324c832ffeb", "comment": "Malware payload", "value": "93c957661c6fa16cf3444baf2ce5ded53e46feee", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406912, "uuid": "944ea993-77a5-43ae-9241-dad273d1a39a", "comment": "Malware payload", "value": "a63f02ed6d569ed5e8365246ca19509c6ff29e680cb6eeedcd8e81360fc567be98e8b89e9775316b0a16cfae53377411", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-91563", "colour": "#0DFF2C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406912, "uuid": "c7b8f97d-053c-468e-a781-2c628b0c66ff", "value": "T1BB9533E3346D4F0748F3D91AFFA6AA34B09D0D94676054F0365F6DA814E09B32289BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406912, "uuid": "143971c7-c4e0-4d76-8f1a-5354e56eba8e", "value": "49152:SWDAhMeJFuQzcRKrAXNWNCLByJNg8CzPFQrWMlMbKZVl9V:SWDAhM6FEKrA9iCLByJJgFkiYl9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406912, "uuid": "1a7d7690-97a6-43a7-9922-449584829d06", "value": 1913886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406912, "uuid": "59109bd2-1e2e-4edf-8bb9-bbfc2ed1770e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406912, "uuid": "d205c036-7bff-49e7-868c-d24d2bef60f7", "value": "Loader.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c8b69b-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676393296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393296, "uuid": "766d8523-ff3e-4e89-871f-d87cd225de4f", "comment": "Malware payload (QuasarRAT)", "value": "7d9d74f288692c926db35569320ba58e", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393296, "uuid": "ed0ddab3-7fed-40f1-81ff-daca7e21271b", "comment": "Malware payload (QuasarRAT)", "value": "051851a940f92112ddf290124d2cea4acd2d0d1f2522c8e942faef9ed6fff244", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393296, "uuid": "84b714b0-3193-480c-b869-f366356f5cc7", "comment": "Malware payload (QuasarRAT)", "value": "e4906248df2ede9c6dc139bae06dd07400713da5", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393296, "uuid": "e3c79420-06fd-406a-a019-ac7ecba84f45", "comment": "Malware payload (QuasarRAT)", "value": "3271f58a7082783e40c94a691796f9de83d04cac6b84c953590bb47b03dfeba529c909ea70a66b1390fb18aa47dc54e3", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393296, "uuid": "0b65527b-271e-4b88-92be-9a8f53c025ed", "value": "T103B37D9676D5E816DA44573A4CEBC3E13662FC41AF66834B3285F71F2F327C0C94221A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393296, "uuid": "32f84227-756d-4ffb-8fbc-ec4e8aa40483", "value": "3072:Vk+xEtjPOtioVjDGUU1qfDlaGGx+cL2QnAdyW8X83qpL71GOPEwOyV/n:VlxEtjPOtioVjDGUU1qfDlavx+W2QnAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393296, "uuid": "d9265665-9abf-4250-a872-9f65a481a391", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393296, "uuid": "0dca5507-707b-47cc-a0f0-bea30c2cb5ed", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393296, "uuid": "e1e58839-3441-498c-9f05-d76082bac7b1", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccca3b7-ac65-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676378928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378928, "uuid": "91f557eb-1721-4389-a2ec-61fc737002a7", "comment": "Malware payload (GCleaner)", "value": "6f279d16116b4cbdf2aa2ce6f52f3e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378928, "uuid": "a18c5e51-6261-4751-b33c-33deccc0c851", "comment": "Malware payload (GCleaner)", "value": "05482bf81c847bd283895680740d14faed3e926a42d26ddf65e04c122e254bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378928, "uuid": "3401702d-cc95-46b7-98b4-2839ca14ebab", "comment": "Malware payload (GCleaner)", "value": "ccf40c593537acc6e2caea710dd8726b85a507ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378928, "uuid": "c3d645b9-2e86-4d55-a718-2a8de2c75052", "comment": "Malware payload (GCleaner)", "value": "32a75060ef7088da34175b1e7d93582a89588d83dce22a8d50b60797c44f65b7b905dd8069bb28ac9fd8fe0142803bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378928, "uuid": "2ff9bcef-84a9-45e0-9518-23d7e41d70b2", "value": "T12DF5127C7145C86DD680FDB88C26D8E74CE66EE3D990A16270D97F3F95BC2889B0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378928, "uuid": "31564d73-1fb5-4d25-b692-9c8f3a14384d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378928, "uuid": "1d4a3afe-8a12-4fda-bea9-a6645543a0e2", "value": "98304:JH7ed8erxUJh4p7IsCSiJdzT2fquuv2MR:d7e6erMzxRquvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676378928, "uuid": "5c3a7b0d-2515-4599-8707-3189c3e3c307", "value": 3350303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676378928, "uuid": "955ebd3d-b3c3-49b9-995f-4f4c6cdf4195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378928, "uuid": "87b879fe-2e2e-48b7-a929-98b7731b2662", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd438066-ac58-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676373265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373265, "uuid": "9e012cec-3c25-43cf-be9d-0733ed44f345", "comment": "Malware payload (RedLineStealer)", "value": "73f6fcff9f46ef3ef48de8960ac597aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373265, "uuid": "406f6042-55dd-4a2e-aeb9-46af9eeec03e", "comment": "Malware payload (RedLineStealer)", "value": "05e60dba8ebf3f21e915e2036884464a6ab5b651e1f2acb8a67011a6ba895397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373265, "uuid": "59568fa9-c42e-4cb5-adc9-56be41eb758a", "comment": "Malware payload (RedLineStealer)", "value": "e578e55f57b451d94284d72d0bad9835587320ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373265, "uuid": "b1212ee6-d9c2-4173-a242-6db93fe6bf5b", "comment": "Malware payload (RedLineStealer)", "value": "6dba12e284db5db3bd7e7fc109f15153b12014de488c80171c99d7029498b2683c11083ea87786da7551ba0727fed1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373265, "uuid": "dfb061e6-2bf9-430a-aab0-5af13255a812", "value": "T142F4120BEBFC9471E87097B029F607C31E377E609E39839A264B5E690873994F535722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373265, "uuid": "187a31e9-a688-4a23-8214-b07d87354704", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373265, "uuid": "596d10fa-105b-49bd-ad93-19cf63eb773f", "value": "12288:oMryy90a8FFQvKuOsoFt5FM4HGGfLRSc7tJXMv+c11/mx+NIzQ:aydYfuGFtLHbfL4sJcv+3DzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373265, "uuid": "cac7b43f-dd4b-467b-ac6c-db845ddeea79", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373265, "uuid": "ae88b2e6-10e9-45bb-8ec6-9772cf03c5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373265, "uuid": "3c6005b3-4b21-47b5-8e99-dabdced9f028", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8820b7d-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676359513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359513, "uuid": "d73451c4-9315-43a1-ac51-8f4c4d77bedd", "comment": "Malware payload (Smoke Loader)", "value": "f64d797598ba1a14fc5e55c448956b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359513, "uuid": "49dacfa3-ea04-4304-8b4f-42f1cc737107", "comment": "Malware payload (Smoke Loader)", "value": "060208ea4e6c1ca1d59ca879f1444b261d1df8e60d082305978ae3343325f5ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359513, "uuid": "515aba0e-8f08-4441-b071-10c094effd68", "comment": "Malware payload (Smoke Loader)", "value": "46b25738b2f4932ba2e2f27632c4b00d12953c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359513, "uuid": "1b606724-c258-40ff-998f-c8e890a36b04", "comment": "Malware payload (Smoke Loader)", "value": "0fb76f68bfca090469688b434c66a6a4df6a7e8f643488a08a5234ea869e1a48c479c226a6ddd749f41ee093d7b0a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359513, "uuid": "933502f3-05ca-417f-8467-08b537239852", "value": "T1F904BE3175F1C072E4A7CA756420F7A06E2BBC7367E5C08733440AAF6E713E19A66366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359513, "uuid": "f0cf9f62-bc45-4036-847b-c478d36fd95b", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359513, "uuid": "83959a8d-47bb-4e7d-b68e-dc0b54c775e8", "value": "3072:GoCSLjLbcbv5fUMe5npg09obqvYhgdBnY3C/ZdtCqbvF8PZ:lCGLb0hrYnzKmYmXY3C/zt9vF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359513, "uuid": "e84e7a55-f102-4f04-918e-52a6bd7edccc", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359513, "uuid": "7d18be8f-3525-4f52-b8e8-29fb011aef88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359513, "uuid": "f6f0a172-a8ae-4cb0-b3c3-e3346ad0f884", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a22df15-ac06-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676337826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337826, "uuid": "660227f8-9a1c-4f86-bc5f-ea84ccda596d", "comment": "Malware payload (RedLineStealer)", "value": "314f893c32a67520635a7e3cdb64df4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337826, "uuid": "907522bd-e12c-4901-89ae-5ae4dd371f25", "comment": "Malware payload (RedLineStealer)", "value": "06175d98d551c995e69b1ee8b6a7f278c3cef675ab65eeaf0e16c22c800d6066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337826, "uuid": "a9fcb5d2-3290-4e1b-926f-2af949f8256f", "comment": "Malware payload (RedLineStealer)", "value": "1a743c6b04843c733156e8a61b0885988cdefe93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337826, "uuid": "68aa977d-5fe4-4531-85eb-0961508f57b5", "comment": "Malware payload (RedLineStealer)", "value": "b55b02dee0df17959cbb66f82b2a264c2bbe74c86f0a62f7e1ac13aae2e54cd79a5c11d13aef4dff485a51c64e9857bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337826, "uuid": "91240c63-bd2e-40a4-b88e-105e89a56205", "value": "T16CF4120BE2E89072EDF5677114F506E32B317DA05A38865F664FBCAD0C722B1623536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337826, "uuid": "dcd2f6c4-0917-4760-873a-d37d8bc229a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337826, "uuid": "ffc22707-79d9-4046-81db-5fa39b876141", "value": "12288:zMray90EGNKSndhBHkT1mOeFM4FF1aHl6f1eJ5AnmzxKQeR8UNaPD6QulNCPO:FypGcSnYMF9va4+5AIKMP+QuLCPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676337826, "uuid": "f2cfcd5e-48e8-4503-bf4a-3a28c4455bff", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676337826, "uuid": "df6b21b0-36eb-4de6-83e5-b41d7dd4a3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337826, "uuid": "243f5a4c-7136-42c9-82c8-a3f7c5575d8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafe9f97-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399863, "uuid": "06037854-fde9-44d5-bbcd-e864889fbd6f", "comment": "Malware payload (RedLineStealer)", "value": "a2b7ffdd7412443354f08f21331846d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399863, "uuid": "16c0d269-decf-4f79-9359-fa29fdc31722", "comment": "Malware payload (RedLineStealer)", "value": "06f9945b722aa15c01b27c5d31faa3747f915b7b4f5a9071e535cd0ab2295b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399863, "uuid": "d19c92c9-d846-4f7f-b847-86d0d714ca4b", "comment": "Malware payload (RedLineStealer)", "value": "8002cf906522a37e6cda8bc700a165de11c1e7f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399863, "uuid": "74fdc271-cb88-4dd2-a576-f15923c414e4", "comment": "Malware payload (RedLineStealer)", "value": "81b93d4ba0a189f0af4b0b10d1a5fc5c65eaf9a98a922d9b1d481d231387d39fcf1534291e66673093b4377d203cd0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399863, "uuid": "c747dd65-fa8d-406f-a7fb-04b4f227da1a", "value": "T11DF41207B7EC9532F8B4177015FA03D30A36BE209B38875B138A2D5E1DB25A4B674B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399863, "uuid": "204ab7ff-6240-44d2-b1bc-d30c9345f415", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399863, "uuid": "1497585f-2cd6-4def-8462-97db64ee62e0", "value": "12288:mMrgy90UXW6eDnc6cTdDEbjIAO59iHAaMD5OSH5K+mb9kc25HGeKCEi65p25:mypUczTkcB9LPDQSHY+I9W5HNTEiQp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399863, "uuid": "4270f840-4a74-458d-8075-7a3bf57aa41c", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399863, "uuid": "a903c8e3-806a-4210-9899-47d97f48efb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399863, "uuid": "28e09d98-9f00-4660-8dbb-bb8dc2024d51", "value": "a2b7ffdd7412443354f08f21331846d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3391e2c8-ac03-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676336526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336526, "uuid": "00f1a1eb-91b7-4601-bcdd-5fd7eec598a2", "comment": "Malware payload (GCleaner)", "value": "1fe94c9b44922b06e4778a6ae72918d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336526, "uuid": "3f7e5365-e939-4556-bafd-472d41fffe2e", "comment": "Malware payload (GCleaner)", "value": "072a70d466b8d0df18248257584cb9f3c01a4382f7782dd8d9cf9e637e6c865d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336526, "uuid": "72d14985-92c4-48c0-b4f3-589b4bfc0765", "comment": "Malware payload (GCleaner)", "value": "d887113e9f28478b2d84deb47adf175c579b3d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336526, "uuid": "1435a870-6a60-4e11-b393-b53e2596f322", "comment": "Malware payload (GCleaner)", "value": "1e46ae835d3f79ee46d6863bc3f3381718fb1d40695aa4c4d0f5d2e7885dd525e14e028bc478cbc4d4e8a5dc44496761", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336526, "uuid": "c52b33f3-917c-4b6e-a66b-b6f98b9dead5", "value": "T168E512BC7101D4ADC280FEB48D3AD4E76CD66EE3E9E4906270D9BF3F66791884A09513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336526, "uuid": "fa3bc790-a9af-4297-90c9-bb84a06ef424", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336526, "uuid": "2e8b5cb1-76db-4438-bead-93346bbc1386", "value": "49152:rdHk/pPDZTFc4aSTw4iwpc4gaR2+pGs0uqg14yjt9i2TmqgHSjnmE2SS8xvkBGLV:JHcjTwan/JjviYmtunoT8xa2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336526, "uuid": "4a1c4d37-35a0-4831-8b7d-9f5ebf9b9147", "value": 3304011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336526, "uuid": "a4e586bb-a6c8-413a-ba19-4d641770eb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336526, "uuid": "4be6fcb9-ebd7-40e2-8c53-b38196a3595c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c270bd-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676402110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402110, "uuid": "aa0e33a7-a105-485e-a312-6ca4c7eb305e", "comment": "Malware payload (RedLineStealer)", "value": "16e8a41376df2c7c09112f703b9c9b53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402110, "uuid": "decd8ce0-e495-4470-96e9-9cc88fb72518", "comment": "Malware payload (RedLineStealer)", "value": "07830ad0a417bfd9f29db10c13c39677f680751a0ce70830d119a77ab68e1cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402110, "uuid": "6394a0d1-f225-4874-89de-643f26a5cd3b", "comment": "Malware payload (RedLineStealer)", "value": "d1776f96b9e3596bc4e84d9d53c09e431ff67ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402110, "uuid": "1d43b408-f823-440e-b246-e52cab42ea9b", "comment": "Malware payload (RedLineStealer)", "value": "ec4d3d0e2b2bcc8ffac8ae3c5b749af4957a0e1c282349e721424317020b42061b5a6c7588853643b91555689cde5754", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402110, "uuid": "b8fb9b52-a50f-41f7-9c64-1a0d740ed580", "value": "T15C44F81DAB145357EC93A0FB089D4E60382226796A8F741673C4E4DFA3C7B7D21EE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402110, "uuid": "9cc10dda-237e-4d6e-9516-fe041c7ed065", "value": "8a29bd563b5a111b3402a07404ffca08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402110, "uuid": "7686fc00-9650-4351-934f-7b5f4d86222d", "value": "3072:vcBjwoeaGCutcK2CgC8HZT2yNYSvYKfQnS8XmV3ftykru4paAsGVz60:vCjqj2CgHZ55QRSDttdru4paRYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402110, "uuid": "b3863dd6-3f0e-49f4-8a5f-7fa768f3ca38", "value": 272480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402110, "uuid": "db3bd0e8-29e5-466d-b461-452d23aaa077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402110, "uuid": "1b5553c5-dc1c-41dd-bf8a-cb46551a2c17", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7e7772-ac26-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676351626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351626, "uuid": "fb9ca24d-ce32-485e-bbd5-7e2b67ee409c", "comment": "Malware payload (RedLineStealer)", "value": "c72f3ba058e3fac249b69c30408bae1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351626, "uuid": "5fd99e31-58bd-4c90-b165-8a7198834e1c", "comment": "Malware payload (RedLineStealer)", "value": "07fc2d880b3aebc4ff5e881de359d44eb9943983c43cf7af30c919183c86a7b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351626, "uuid": "af985a1b-1b2d-49cb-a09d-580258cbe176", "comment": "Malware payload (RedLineStealer)", "value": "c29b65bd2530c8c1cf0436655a0a12c1ff0c8b74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351626, "uuid": "59b57b58-7901-419a-8abd-d9e77b8a4533", "comment": "Malware payload (RedLineStealer)", "value": "26b7b92a4431c8e5071e9be393c3880e17aa8e8a222718f4bdb283661702fbf92086649afd1ce981f1e1e3eac97ffdae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351626, "uuid": "761bf42f-b8bf-4493-94bd-ad3162708717", "value": "T159F41207E2E98173E8F497B04DF703D3193ABF906A35875E238F5D591873A60A63472A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351626, "uuid": "12040a86-eb1f-4f38-84f6-5c009b21d9f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351626, "uuid": "b50ded21-5629-41b8-a76d-04421463f616", "value": "12288:CMrVy90inkIzoU96PyL22QNwXY62560jLl3EvDTuJaZJBaXyNQddOPSt:LyFzN6PU2NedN0jFEvDTKabu5dIPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676351626, "uuid": "adaa113b-a805-4f63-ae63-78217006615e", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676351626, "uuid": "0162eec9-4efc-4c7c-9444-a556c522ab55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351626, "uuid": "13d6827e-cdef-47af-bb74-199e8271083a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31381adc-ac70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676383338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383338, "uuid": "0a73b1ed-a0e8-4fbc-a09f-6f1c143fb5c7", "comment": "Malware payload (RedLineStealer)", "value": "77e57bdac70a763d6a2043b12b49436c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383338, "uuid": "e665b4f9-4d8a-4e1f-80fb-cb9df7c8a61d", "comment": "Malware payload (RedLineStealer)", "value": "08164b53aa83981e99aaf5509021b8c8dda3142c5bf9cd5a98e2e4ce69bc9a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383338, "uuid": "c2c935e9-7ff6-4624-8043-34269d97994f", "comment": "Malware payload (RedLineStealer)", "value": "ec18f62a21269f685be5a38648ccd3c0ddd333cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383338, "uuid": "4ecdd449-1fad-448d-a6a7-89950a4a2458", "comment": "Malware payload (RedLineStealer)", "value": "12b548c874525778405828343cb3fdbbbbc9e9e688d61abd06dacc92272c496f0a7ac5b8871ecf818150bd6caa2b0bc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383338, "uuid": "f5d979ed-bc19-4646-8332-9854b806ee1c", "value": "T16CB41217BAED8036E8B1177048F707D30935BE506A78834B164BAC9A18737B4F63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383338, "uuid": "06ebd03b-36a9-4474-a8c4-e2eb1bc2f91a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383338, "uuid": "3ddfb875-1266-41cc-b4eb-e777f8485ebc", "value": "12288:TMrky90oYVCnUs6k6UOqWEv9j8jOHb9L7TOocBx:LyTYk8krbCjsRcBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676383338, "uuid": "8b5b0334-f734-4951-9ea0-f6330d63ec17", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676383338, "uuid": "ea1bd147-d588-4ccb-9556-e3bf57d7aff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383338, "uuid": "d59f3613-0fd4-4400-a331-252ea96b5840", "value": "08164b53aa83981e99aaf5509021b8c8dda3142c5bf9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96b295e-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676363433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363433, "uuid": "20afe90f-6441-483b-b671-b7f4d337951c", "comment": "Malware payload (Smoke Loader)", "value": "6a27c071fb64848a3c41207bf1395a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363433, "uuid": "800f5405-1592-4c92-8155-ad95588229e2", "comment": "Malware payload (Smoke Loader)", "value": "087854dec19cba44934cf24c4aa7f9e7d864f41e07416fe41c7c80f7912d61b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363433, "uuid": "93eac7f9-383e-47f3-841c-eb7e78bdbee4", "comment": "Malware payload (Smoke Loader)", "value": "4dfe2a0770209ae4c59c77bd3fd452441562e36e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363433, "uuid": "e53f73ab-4f53-4c14-a115-f5cc847f65e1", "comment": "Malware payload (Smoke Loader)", "value": "f8ca68d37908037617eca57117dbdc4e1b89c3f2daab2bdfc18aacfed1da7babaece46df32558732091a1e281e575f97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363433, "uuid": "cb44b2fb-99ea-4544-a635-ff178b650159", "value": "T10804E01139E08073F9A786751431E6A06A6FBC72E7A4818F33483BAF1D317E19E65376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363433, "uuid": "0e8a59dd-a334-4ba2-aae7-31e2bcfadfcf", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363433, "uuid": "9c8a4832-baf7-46a1-a702-37b98e926d81", "value": "3072:toamLz5Y5fqKbePFVxrE1qgL3xnocgsTjBgBjQo9sLt/B:2jLz5Gjjdoc3jB2tsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363433, "uuid": "aadbb10b-6595-4248-a206-811a557e7846", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363433, "uuid": "52988ec0-ddb8-4644-a439-a7a7d97e500f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363433, "uuid": "a3274998-f9da-4e63-b450-59c530aa0486", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc86719-ac57-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676372618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372618, "uuid": "9c7b8915-ad82-4bed-9609-d73129d39877", "comment": "Malware payload (RedLineStealer)", "value": "cb4b2d3e87dac40c3a06d0d863fbb923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372618, "uuid": "422c55f0-64bd-413f-bec8-ef2c71429208", "comment": "Malware payload (RedLineStealer)", "value": "08b3a7e03d023d1ac639d8f08b7525c472f397f724865aaf21ff1256cef0ba87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372618, "uuid": "10192369-0e6b-409e-95dc-a48c009f5494", "comment": "Malware payload (RedLineStealer)", "value": "a63bc0575e1a11c0fa71551d7a19165b0b9d41fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372618, "uuid": "578f3fdb-f637-4067-8c9a-7efe4347ec78", "comment": "Malware payload (RedLineStealer)", "value": "fe99419ea5b00b4727eea217a0ec04091f7c7318d0a47fef356a332d15edc2c06d6ff5b112fbe26dfb467e69cc2a839f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372618, "uuid": "aa38d5ab-d469-4c4c-a0d2-e1e041d26897", "value": "T11654F1123AE18073D067C5749430DB606A6FBC71A6A7804BF75416BE2E732E29EF9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372618, "uuid": "5b5f920b-a51d-465a-96c5-2ee7f6ef9250", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372618, "uuid": "30b4d7bd-45b4-4a57-bbd1-ce3f99456647", "value": "6144:vSLndeoFQ6TPlEuSNim5rQckSYkm5grU3jpL9Iqa:vSRM6TPlEuSrrQDfX3R2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372618, "uuid": "a7343b36-cdf7-4561-9a45-cfc44c85901e", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372618, "uuid": "a8eb8e5d-6146-4e2e-8083-f1299ff2087e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372618, "uuid": "b9e4f965-d85a-4d9e-bd57-e3c6de9171b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c84a7b-ac35-11ed-88f6-42010a9c006e", "comment": "Malware payload (BitRAT)", "timestamp": 1676358329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358329, "uuid": "df1b4386-87fb-4151-9fab-e95d3c838a63", "comment": "Malware payload (BitRAT)", "value": "29f24671b31ec4849ec02229d8bea0b2", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358329, "uuid": "663105d0-aee6-4276-bf2a-2e2db47a04f2", "comment": "Malware payload (BitRAT)", "value": "08cfe144396f7fc7aaf3a47e86826d439502e4e80e6a9043bcb026ae2f1e845a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358329, "uuid": "c71c31c5-7eed-432b-94f2-e9257ef4a7a6", "comment": "Malware payload (BitRAT)", "value": "bba17ef1c4c0b02c6f4fc076a6035e86430c21e6", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358329, "uuid": "22861cc0-e3ac-41b5-99fa-5ddb93edce9e", "comment": "Malware payload (BitRAT)", "value": "6e725f6115f435de7d56a6fe6120c22331a246a08f8191dab7f867808e8c7517e41b444984e6d6d23687c31c06312f5a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358329, "uuid": "1bc04c36-8197-4d5a-85b7-75b96ad9e09a", "value": "T1DF668E343EFA902AB1B3EF629FE475D6DA6BF7B33606685E104103064913A41EDD193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358329, "uuid": "38c6f580-b5e5-4316-a1f5-9564c729d9a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358329, "uuid": "1c11565c-eec1-4aa6-9659-a163fa6d34c0", "value": "49152:RI+dckN2zRMPlPot7kTg0AMv54vzp82GjPKa6:RI+dc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676358329, "uuid": "209a7cdf-fdf2-4e5f-bf91-89bbb399f59d", "value": 6692864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676358329, "uuid": "c03ea45d-7e63-4439-913a-a95b81abbc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358329, "uuid": "90d99b89-3ff5-4279-85ce-ad000cb0f4e9", "value": "INVOICEXls223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd623150-acbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676415812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415812, "uuid": "54182a4c-1f5a-4d33-a105-3af45400124c", "comment": "Malware payload (RedLineStealer)", "value": "f4b49bcb7012016fed43d9165e13bbb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415812, "uuid": "e5b8493a-29c6-41f4-b7c0-99747e8709b1", "comment": "Malware payload (RedLineStealer)", "value": "08f1df140b293fb1fe880dbc3afa103ba6fef2c952745d6f129a21e117786f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415812, "uuid": "b6abb9bd-fc93-4e60-b394-be4147d9ce12", "comment": "Malware payload (RedLineStealer)", "value": "a00e758f3a2a1bee30422312714947db0142cf80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415812, "uuid": "421947d0-cb1e-4d18-b586-ba7793fa7d0b", "comment": "Malware payload (RedLineStealer)", "value": "527ac1742359affc72a49c776d80f59d2a58ec0c6f6c6ca52ce95cf3c57a82f84acfabd34342ee00c3e286b8d8ca326d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415812, "uuid": "07a46a31-38c5-413c-b1db-06e812ce521a", "value": "T17505124BE6E5D026DCB417F01DF703C709377ED15B38831B2A8AAC5A2CB26A5A235357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415812, "uuid": "5c31b94b-008a-4169-8881-e80efee39888", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415812, "uuid": "fce1822d-28c1-4dbd-8baa-c9912ba6d78c", "value": "12288:wMrZy90KX4T04fXBKHsou+TCueqHs/yGM1MUDtBNfOV7UcFeURvZZ6wxqqlQPnY:5y/4vBKHszLKLxlBBNOBUuJ6wDePY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676415812, "uuid": "0a67728d-f46f-48fc-82e8-bb0b6909bba8", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676415812, "uuid": "8c0ff818-371b-4231-8873-77e24e126769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415812, "uuid": "2e65bf42-b4cd-4aa9-9b47-fa578d405305", "value": "f4b49bcb7012016fed43d9165e13bbb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1808bc57-ac46-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676365256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365256, "uuid": "b22c84bc-bc5d-4856-a7aa-235457de53b4", "comment": "Malware payload (RedLineStealer)", "value": "b12d2eada44cabee8de1093f2f2d851b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365256, "uuid": "f95a3368-870a-4f1e-832d-cfd864ac7e57", "comment": "Malware payload (RedLineStealer)", "value": "09205decb0fce6595928ec21013301bdc3650736d932c70c9a7645f9b6385998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365256, "uuid": "e9d43452-3b88-4d9b-8819-ac09d0a3fca7", "comment": "Malware payload (RedLineStealer)", "value": "75688fdc7b760e3d61abd1c63c43a82061c0a5d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365256, "uuid": "d5f8dd4e-f6c8-4e2b-afc1-e633a83d447f", "comment": "Malware payload (RedLineStealer)", "value": "8eb2602adc2bfcb91258df58b8f187c11653a521ec6d5df1b003e28a632f89a72f82dce60a7e5e28f8758a2a4070d5aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365256, "uuid": "007b8689-4e72-419d-ad54-dceed0c7d943", "value": "T177F41217E2EC9565D5B50B7055F603D32E767EA01F3883EA734E9C2A08B3660A23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365256, "uuid": "8dbaf893-6a1b-4fc5-9a68-df6664b62b7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365256, "uuid": "973adf27-206e-4a62-a469-14e04dfd4176", "value": "12288:bMrjy90v4ihtA/AONDBKtpHb9fMTVqCFq4qHC34GCzbVn7sVzTSBM:oySPcDgnbuAaqi34/HVn7YOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365256, "uuid": "5710277a-c3e7-4129-a919-83e1e5096013", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365256, "uuid": "99109349-c6f9-4286-aa23-99ef20bb9ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365256, "uuid": "ceb10aca-cda7-4b6a-bcc5-29159964b5ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfbbcb2-ac52-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676370741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370741, "uuid": "cdd06614-3a3c-42c0-b245-a7712f8e75cb", "comment": "Malware payload (Amadey)", "value": "bea68b2052a1cf639ec41c1e81b565f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370741, "uuid": "05a7a05c-efae-4321-ab61-610ffb85a208", "comment": "Malware payload (Amadey)", "value": "0a0d79b691defcd77fe0b4e93aa3058b2e61185c8ac15e913de33aa160b111f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370741, "uuid": "830b4ba5-19cb-4a3a-bd1f-611a66eadaba", "comment": "Malware payload (Amadey)", "value": "b7bbd7fe16b1bee07a19ac6135f0703cc6ed932d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370741, "uuid": "8d15faf3-1b7a-4dfc-a71b-c877d5d46206", "comment": "Malware payload (Amadey)", "value": "659a3b851cc466a17fbedb98becbe2baf7150a66b57a0598e4f0abdee655ef6b4850784cf94d44ba7809cfea06d9da7f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370741, "uuid": "566c6b39-d188-44fc-9cf7-1ac4d9208720", "value": "T17CF41257F7EC9163E8B087B018F642D30A367D905A358697674FAC9A0C73A60F238767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370741, "uuid": "7e76cbf9-6bb4-4779-bf35-62daab9b1b0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370741, "uuid": "0051842c-23f3-4d5f-ace1-94255cd22554", "value": "12288:jMroy90lHvFOi7R6oolQaOuQt7aFf49d9PkrXMvLc11/7bASnh:DyUvF17nolQaOuQxh9dtkrcvLk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370741, "uuid": "89737c65-258f-4d94-bffc-8ce5eabc6510", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370741, "uuid": "7ae4ca4f-a3a5-4c58-a40e-f86e2d5ef065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370741, "uuid": "4fcd4a59-84c7-40ee-954a-3d23a63cbb78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49928fa8-ac79-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1676387244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387244, "uuid": "c46b807c-9117-40d2-9e7e-fdbb8840878e", "comment": "Malware payload (NetWire)", "value": "1f62661bef1758808128adc9a1988f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387244, "uuid": "48841da2-385a-45fb-abfb-fe50ca6b436d", "comment": "Malware payload (NetWire)", "value": "0a165add91ed3c12af0e51039d67e5522ac4304a0eae5809ffbf85c957e60306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387244, "uuid": "9cd55ec0-7a0c-4174-b4e1-6be8f74ec09d", "comment": "Malware payload (NetWire)", "value": "a06be5f1bb80108a2c8222122836d214a68a46ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387244, "uuid": "5b73b9e9-3a5d-48de-8bfa-3b587575869d", "comment": "Malware payload (NetWire)", "value": "16bc08ba4440a78daa8f5864b60448030f28a74abb108e76dbc2066bb2fa3b4c1c2454929a70410f95778c133c326f07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387244, "uuid": "15927c93-0cd4-4ec8-b3bb-85a5c3bc217b", "value": "T12BF30719FA8794F6FE0B1D31919BF33F0B757A01C130CE92EF541E86EA23C26151AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387244, "uuid": "3f71c665-5f98-4bdb-8cf1-0b8580e09738", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387244, "uuid": "7c440e5b-ce0c-4828-9bd1-1fd8569c952f", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvPYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/PzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676387244, "uuid": "8541159d-7224-494b-804f-a344ed1ca648", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676387244, "uuid": "1a76eaa4-85a2-4f2a-ada3-970c4f6218c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387244, "uuid": "4d82d32b-6a03-4180-becc-bf12cec93821", "value": "1f62661bef1758808128adc9a1988f7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408579a8-ac0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676341273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341273, "uuid": "53c4caff-8434-48f6-9933-7f04ac71dbbf", "comment": "Malware payload (RedLineStealer)", "value": "122e46d5e980803a42981cb4efac37bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341273, "uuid": "3b50fe2c-7c99-43d9-885d-1ad5280017ae", "comment": "Malware payload (RedLineStealer)", "value": "0a43ffd1f4b22fc69b122739d899cde660df9f16251b8c3c69349fa1c2d5fe5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341273, "uuid": "79de1693-8f37-4ef3-b829-bc9356713dbc", "comment": "Malware payload (RedLineStealer)", "value": "17cbc3474da62be61fff043c5286319bff6eedd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341273, "uuid": "661890d2-06d5-42f9-a976-fac9b8c75518", "comment": "Malware payload (RedLineStealer)", "value": "8e8bdc31141012737dc2f246c6b14d9264228aff88f146873221e8c604c99109a716ed900b8c420939e9d85c20a95cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341273, "uuid": "ab22e755-4bf8-4b50-9340-5762606db056", "value": "T1A1F41213B2FC8522ECB1577059F302E31B36BD916A79839B234E9D5A0873AB06635377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341273, "uuid": "82a013bd-1d2c-4dab-8040-3fd46932298d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341273, "uuid": "56d596ad-8914-4511-9b6f-13ed79eb2207", "value": "12288:oMrly90R1vhed3VAptjex9XrHES2gnSpBHlLmyg7ppQED2wd/vQVRSGSm0woR:tySoVOMbr5fSdLmb1iYVoVRlSmPoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341273, "uuid": "b46a512d-11fd-4e3c-a4bc-3b990177bce0", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341273, "uuid": "a14abbd5-cd78-4975-8bb2-e09bad041a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341273, "uuid": "3fcc88e3-cefc-4015-9979-60d6879979c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb004fd-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413398, "uuid": "d33f4bd2-7a7b-443f-9674-cecdb4bf1db2", "comment": "Malware payload", "value": "6b41ec9f763d1af0491c7475819f37ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413398, "uuid": "11277e9c-0921-46da-b797-e7b9cbffdded", "comment": "Malware payload", "value": "0ac6dbba9979889a9567f2dad5bfed67fad597890cafce3775e4d58f16e8c7db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413398, "uuid": "46368a57-258a-4562-820e-44bf806b5511", "comment": "Malware payload", "value": "5ec7a6c7e68ee3c2dd450c3a7ef078bed7b108b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413398, "uuid": "42f6d0a3-f35a-44d9-b80c-5d2e07392075", "comment": "Malware payload", "value": "a835240c9ecd9177c3296e799ab126c9b415d191974bca75c5e901d7f6d45fa77478e877f80fcd747b5aeb9e70f4ef08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413398, "uuid": "562d92b5-7d9c-4700-bc43-805c742fbe0f", "value": "T199934B32377A4A23C4E6643881E78737B3F79B851D30411BBA946F887F5AAD031937A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413398, "uuid": "2f1ebef7-2948-4026-a146-63244cd6df58", "value": "1536:RMtmq5+UhAgokgSUyAVv9Ks4OL92l5sdxt/+DQnqt+Aecm5jSa:RTmokLUyQvB4fsdXHnqZeDYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413398, "uuid": "b7910c7c-e861-4354-856b-3e87365e25e0", "value": 97283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413398, "uuid": "f22b1b59-0821-4d7e-84eb-16269a79e1ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413398, "uuid": "2e967d18-b75a-4790-b76e-c768398f044c", "value": "6b41ec9f763d1af0491c7475819f37ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f372c632-ac82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676391394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391394, "uuid": "ccc93890-ec2c-4ebf-aff5-c08dcb33013d", "comment": "Malware payload", "value": "3192f7c4ed84126690cad40abfcd84e5", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391394, "uuid": "e634ba3f-2ee4-4fbd-9f70-147edb30c5e4", "comment": "Malware payload", "value": "0b77c4eda53491d8e97f4c444b30579850a6396a724eda28288fd8a54cdeafc3", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391394, "uuid": "00f9c12d-612d-4de3-bcd7-dc7008b39cef", "comment": "Malware payload", "value": "058387a7c225db2583a2e55b2dd6dceb130be6a0", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391394, "uuid": "63766e76-444b-4bac-a153-96efdcce623e", "comment": "Malware payload", "value": "80d708d78afd418702ab7acc922bad7c7d00412364e4537a92d2f74118b4280b471fce1035fcbb7d310bfd4a2556a6a9", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391394, "uuid": "2819b6a5-0ad5-423d-936b-971c48a78415", "value": "T1C144C11662F18166E3F65F319BE30F41A6A5EE21B691871F8A8A004E0C13B41DD76F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391394, "uuid": "96ee480f-52cb-487d-bf7e-5d52abc56653", "value": "6144:7E2Wx+5mj862Wx+5mj8R6c2fI0pxmSDmST:7E2l5s862l5s8WmSDmST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391394, "uuid": "8b98e518-28e6-487e-9f84-c8a3a07491d6", "value": 265373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391394, "uuid": "adbdb80d-6897-4881-b255-e9ef2327f6bd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391394, "uuid": "af104111-04f4-4bdd-ab01-071bd182c472", "value": "Feb10_Document-139966.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5ac179-acc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676418204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418204, "uuid": "72a8407c-40e1-48d3-b559-e65c72bc22d2", "comment": "Malware payload (RedLineStealer)", "value": "17e6927fa464db916f9a01856a1977e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418204, "uuid": "7b59cb1f-fc79-446f-8013-3e370e4dc90e", "comment": "Malware payload (RedLineStealer)", "value": "0bd4fe0b82890faaea8667abfd11a4c6af2147eb4ee6b943fa706c21fe9ef32e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418204, "uuid": "b71b6c93-7813-4366-8980-1e2dc9c258ac", "comment": "Malware payload (RedLineStealer)", "value": "c342474da4d3da37638dd4182e60dd781ce3bffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418204, "uuid": "3bc4a57b-9346-49fc-a656-697661894dc7", "comment": "Malware payload (RedLineStealer)", "value": "a9f3670f44cc4f7110659c24f365d8dbf2d8b2c1838dcff619167036467ef8f35314d15e43920165730b329f73863083", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418204, "uuid": "56130763-97d3-47e9-a715-abb0c7298cc8", "value": "T1D605134BE3FC802AD5B12BB018F747C31A36BD501E3892AA374E6D851D732A1623576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418204, "uuid": "4b30c2ee-f90a-497a-bc75-9f726c119c96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418204, "uuid": "50244583-7d98-414a-993c-187da828d969", "value": "24576:lyQcsRVh82RScUgsqlAvqkKxWjB2YssH:AQDD8LOlAiZg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418204, "uuid": "9d3c3bb0-632c-4cdd-8179-d81eefeee8b6", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418204, "uuid": "b8cf952d-9a33-49d2-ab8d-44ee5c73d37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418204, "uuid": "d96131a9-8d12-4054-8047-82edbcd3c525", "value": "17e6927fa464db916f9a01856a1977e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b2507a-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676412797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412797, "uuid": "2f178b28-e039-423e-ae17-8d9ceb381ada", "comment": "Malware payload (RedLineStealer)", "value": "ac83657f02dff63c790b80a66ad3d4e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412797, "uuid": "67e13327-6949-4910-80ac-ca03fa644ca3", "comment": "Malware payload (RedLineStealer)", "value": "0c03276ca27012cd6a8889664e261b98da41b0f80f587db4b3d97ad6a76690cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412797, "uuid": "8b5c1d94-d437-4932-ab04-e0dc1338b680", "comment": "Malware payload (RedLineStealer)", "value": "7e9a2f828a38ad058bd619137f66266ddc664c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412797, "uuid": "5b37b7e0-59d5-471b-bb58-c50275c67e99", "comment": "Malware payload (RedLineStealer)", "value": "372018cad4449caeaabc3b67f2fbdb788d3a4ae253b309fafd0bd7bc7a6cef957b9bbf80541aa562bbd077d2fdb7c4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412797, "uuid": "8d5207bb-df61-4454-81b3-5066e2fe47b2", "value": "T16B54F1D27CE1C072D56B80704934E7A04E7FBD71A2E5C54B7388CA6F6E602D1B6A8367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412797, "uuid": "cdc6498e-337d-4ab4-bfe3-2f2014888c35", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412797, "uuid": "fd579f24-cb17-40d8-9a74-f08daf4756fa", "value": "6144:mLsYcKYVe7xZCptofhwqkasx0XBvnZWf0G4EThJfh:m4YcVe7xE3zvae0RvnZWfhJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412797, "uuid": "30152eff-c208-423f-b7a3-5f8649597c40", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412797, "uuid": "52f05bcc-b547-41c5-a5a7-41f697d5738a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412797, "uuid": "f15e3b2e-23fd-44c8-9d5f-cae55f3789f1", "value": "ac83657f02dff63c790b80a66ad3d4e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ecda28-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676363270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363270, "uuid": "20b1728c-3ffa-440e-a9cc-b5b61fdced38", "comment": "Malware payload (Formbook)", "value": "5ed3c62161b6eb9fc1dae4752652bcc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363270, "uuid": "c00cae34-f2e0-48f6-93e8-f433c7e94d8a", "comment": "Malware payload (Formbook)", "value": "0c2e6d5acb82c3c9a5d9aebd50ea3982f10dd70eb516e639b4f8c12d6453c5c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363270, "uuid": "254ae02d-a550-4f71-9333-1684171c357b", "comment": "Malware payload (Formbook)", "value": "aea9c05c040647402ed98531857e20f4c0e5b56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363270, "uuid": "1119b940-cadb-41d3-ac80-0dd4348efa9f", "comment": "Malware payload (Formbook)", "value": "414ba405dade425d4c8bccc46b563cf9b16df9756ae1f63943f51537e4c76783b28df8edead81ce2434941af23c00239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363270, "uuid": "0623d0a2-ed9b-4c85-b487-69466a833abc", "value": "T13354120DFDA28057E893177369BE57259BFA783948D8914B03145E4DBE6F2408AAE323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363270, "uuid": "3dc44e57-833a-4aad-be0f-153e06993b0b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363270, "uuid": "4d79710e-36e2-4ce0-a946-ebf094f08879", "value": "6144:vYa6Ue0kIR7JHf6dmGm5AamL5d9loiFECiv9CtuKtgcquEi:vYSem9Hf6dmNiF/LGZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363270, "uuid": "ca498d52-31a7-4f75-9e37-cff6f0a79a4f", "value": 284155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363270, "uuid": "81d7ecc3-9b1d-4c2f-8669-dcf769bc83ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363270, "uuid": "f3c12341-2165-48b9-81be-ed253ebe9f81", "value": "SMSHS23020008 SS2302528.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e76926-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676375106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375106, "uuid": "7fcc7f10-049a-4a2d-a643-a0779d8a7832", "comment": "Malware payload (AgentTesla)", "value": "ee47239bae0ce3c4b2050666fe5d42ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375106, "uuid": "1512404b-350b-46cd-aadb-f70b38162395", "comment": "Malware payload (AgentTesla)", "value": "0c4df20a04f259407996d46b7c24108e557bd7cd879260c839d957d7069ddf40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375106, "uuid": "6c8d4dca-1e2a-4871-9bca-77e61777f7dc", "comment": "Malware payload (AgentTesla)", "value": "5411367779c1038f6b526e9b5531fdb949e0cbd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375106, "uuid": "d8f809cc-fc13-4fe5-b01a-190f823b9476", "comment": "Malware payload (AgentTesla)", "value": "99aaac37fb33e9b0d10b3da62942986f56a4e3c6eaa4fffa4075e5e6ad5153d3a1a4bfae9bcffb4f2b4b2eb193aae053", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375106, "uuid": "9e810a79-60a0-4cf7-80cb-783e5bce3b66", "value": "T108C41251126833ABE7B91FB128B822861735662EB511F38F1CCA50FD1E67F024661FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375106, "uuid": "c10d7a78-a8d4-4945-b752-cfd73c811220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375106, "uuid": "960d2749-f731-4d81-abd3-b648b9f1fbdc", "value": "12288:oFFZ6IWSF89v4os2f9s+FcvUmD2kIqQX+Ksb:K6vSF89Bf9sJykIqQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375106, "uuid": "958e1cec-98b2-45b7-8a8c-729622dc301a", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375106, "uuid": "6338bbd8-ca6c-48e4-87d7-89db1e4d163a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375106, "uuid": "3c8ff4c0-23a0-4db7-91cc-70cdc48c869d", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d456ac7c-ac78-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676387047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387047, "uuid": "a562bc97-ae7e-42bb-a62c-e7e0b8cc217f", "comment": "Malware payload (RedLineStealer)", "value": "6296af9aef65a94e105b976457c107b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387047, "uuid": "dbdab1f9-b537-4526-ac8e-bda6bf7c3a7f", "comment": "Malware payload (RedLineStealer)", "value": "0ca4af290ff2840e78ff74a632b6534f1fe8aed9bde564911993ceb569a4d76b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387047, "uuid": "843ce6cc-c986-4bad-9261-1f277fab3704", "comment": "Malware payload (RedLineStealer)", "value": "77af8edcee2b76a7f2901ea2ba160423a805cbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387047, "uuid": "dbaea993-fb73-4332-aa8a-16edae49f9e9", "comment": "Malware payload (RedLineStealer)", "value": "aa5572caa0dc4c4545e15930e1a420912bdaaef96abad631af88344f4aff1253d13068dccc059e77a994ac68d9c30085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387047, "uuid": "99884281-6af9-43dd-b8d7-d25f4967b4e9", "value": "T1E2F4125BEAEC9032D57547B018F602C30E777DB1673886EB278E6D2D08B26A0D671727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387047, "uuid": "b7fbc754-cffc-404c-9e2c-9172c4b9ada8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387047, "uuid": "96ba19b3-8107-4d8a-b067-15a4ee520396", "value": "12288:nMr5y90RxxY7yJAOBQTbI+TmImNPS6FA4v1PfEfMoMlUnaSF+AD8rcex+:iyUJJAiQTbdlKvBfDoyp8NDqN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676387047, "uuid": "f153140c-fd14-400b-81de-99bee7b21b85", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676387047, "uuid": "59a9bc47-0ec5-4e0c-8dc1-8109481dfe9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387047, "uuid": "42fec564-2caa-4e0a-81f0-1ce366888cdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea4a88-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413375, "uuid": "d0720bf8-0e4b-4924-80fb-856ea7f96e2c", "comment": "Malware payload", "value": "801d999dcddc5de2b47fa75b8a453117", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413375, "uuid": "4db78090-8785-4191-9dd8-dcf8cf05eede", "comment": "Malware payload", "value": "0d0d36a01a53ed3f1990f486bd9a9b31562c41f57078d4c3f60345e15d5c3bd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413375, "uuid": "94cae8ca-d279-4347-a3c3-aeae5c4d0fe6", "comment": "Malware payload", "value": "9a1ece22801caa931fb9e57740ede20118040983", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413375, "uuid": "6b9b63fe-3553-43d6-8f92-902e9052b19e", "comment": "Malware payload", "value": "23294eccd32fc6da925827ed074dcccc65e7e636484cdfe393f35ce78592a0710e26c359fe1930b8cc3e20f2ae6315c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413375, "uuid": "fcddb480-dd8b-411e-b73c-0a178d8eb801", "value": "T1C9C3845A6761CEB7E85ECE3B069A460110CD9D4A02DD6F2F72B0F61CE3AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413375, "uuid": "2adff135-ce86-4232-8b01-1a0ea57b358c", "value": "1536:GeSIeTAnhJDae/NfeKOpyzLZ3UX1y6wo7I/xXwlct+vg8:G0PfeKOp4LrKqRuct8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413375, "uuid": "a547b6ed-a353-465b-8248-750076b2a6eb", "value": 119162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413375, "uuid": "251ad17b-0c42-4365-a66b-f16ea1da5384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413375, "uuid": "96e078c9-f8c3-4c2a-8c32-db19b7946208", "value": "801d999dcddc5de2b47fa75b8a453117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd179b4-ac7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676389261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676389261, "uuid": "9187edb1-4599-49e1-86f4-bfcf46447397", "comment": "Malware payload (Amadey)", "value": "92c134237dec1edb733ab17c6675b54d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676389261, "uuid": "89654c82-e4d3-4a3f-a951-b7c7d1081ce7", "comment": "Malware payload (Amadey)", "value": "0d6225bef4a2780af727ec555e0f1b9ab4ff5ffebc07cc261efc1bae31cce50d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676389261, "uuid": "653c3009-e7d2-4b9b-bce5-506a22e2dae1", "comment": "Malware payload (Amadey)", "value": "0f7f298b8514402d52c948100d26b16efb5f11cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676389261, "uuid": "3d27f6a1-d1f4-41e3-8587-fc890e0329a3", "comment": "Malware payload (Amadey)", "value": "07229655e3efae03e3c439c9fe9245355f9f52c974b3abf0aa0d2bbc1726ffcb29506c54c10f1d7943bc13ffe0e07545", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676389261, "uuid": "15919485-769f-4ce5-86c2-f589cf724b6f", "value": "T181F4121BAAED5131D9B557B019F603C31B367EB06B388397274A9C1E1C73AB4A236317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676389261, "uuid": "53257a10-c712-4b88-af00-ce2949a2ad13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676389261, "uuid": "af62004d-25c3-4ea8-b3cd-77b61a89f92f", "value": "12288:/Mr5y90gGnfy4LPuolFB32KEhJoFc4lkX+v7++cqE+gKrOi8oM0UnaSKvYk:Sy1UXL2olFl5AJwlT7++PEvKrOi8oDpX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676389261, "uuid": "0be00424-c62b-49c3-b532-e6958f200d2d", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676389261, "uuid": "b62d887b-46ee-4dcc-a7dc-0d9446634062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676389261, "uuid": "171a3112-f2ca-4d4d-88e2-0b53948cd51d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925088e3-ac3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676360737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360737, "uuid": "320d1a2d-e012-44a4-8216-697bed8c6986", "comment": "Malware payload (Loki)", "value": "59d0e1dbe8b7e7a3e41f49f0f114cf5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360737, "uuid": "1f0fa56b-e501-4cdc-8313-d5ec9d6099bf", "comment": "Malware payload (Loki)", "value": "0d7657dfe01e296e3de4f00364dea848eda8a6e491f7beceb707b3e251bd68fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360737, "uuid": "31195c83-785f-4b29-ab0d-d0dc0aab9253", "comment": "Malware payload (Loki)", "value": "37361dc1ce78423a98152724ea7c01dc60dc6400", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360737, "uuid": "c7fd6bb7-b0d4-45dd-9a62-1a8365b57113", "comment": "Malware payload (Loki)", "value": "7c52e4563ead54bb5c4f2cfd1d7086f12088e171860046b6b837511922e3f05a6f905dd7e3de1362a8ca8a60f16157ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360737, "uuid": "f223b830-9da9-4694-8ce2-903828c5ce20", "value": "T110E4124A9E699A11F9F48FBC0B3EA56C4F342CAC17F3E5781AD544EA6023753C40A673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360737, "uuid": "b70be463-8b65-44ea-b26f-0c46559a97cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360737, "uuid": "cad9474b-a2d5-4e6e-ab41-01268d85c4ae", "value": "12288:3C5KlS71Vd8AYC0NDmzyXFSVfDdCc1EIuMeAU6ch6q6:3bS7jVQrXAfZPoAMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360737, "uuid": "d8f55a73-6928-4009-a055-2bdc914a19f8", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360737, "uuid": "c7bd2bef-d25c-48a4-8284-f869b2808749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360737, "uuid": "d056f655-c8a7-44b4-bc6f-72eaa38df3ba", "value": "SOA012023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56eb583e-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382112, "uuid": "73e7e561-54bf-4e56-a1ea-720553fad7d8", "comment": "Malware payload (RedLineStealer)", "value": "61cde0ed2e77da5faf0a6ca587c0ed3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382112, "uuid": "32164e17-9ede-4534-8e74-592181ade88c", "comment": "Malware payload (RedLineStealer)", "value": "0e170dbbda54f4cbb21a3007eb3ec5bbe4a8672e6064d6333feba3bcc65b497b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382112, "uuid": "bb977af0-3bb1-49c9-9551-bbce4dd097d5", "comment": "Malware payload (RedLineStealer)", "value": "d44a65f50d99504fb73f9cd0f549d5f964b62ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382112, "uuid": "ac943b46-9d69-4725-84ce-ca81d753d3b9", "comment": "Malware payload (RedLineStealer)", "value": "ac85702ffaedcfcecb512bc4f7b73725111dd4f51e4e35256e38796c50e6c0eb9477b57966b6a1bf9bbdd8a1fecb601c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382112, "uuid": "63e3af32-ec62-46b8-a2fe-fc49dcfaec4f", "value": "T1E1F41207FAEC8463F4B6577018F607D30A3A7CE15A38829B274FED190D726A4A43576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382112, "uuid": "73da5a17-49d2-470b-b542-89a2c83942bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382112, "uuid": "603afeb9-1c22-45f4-8442-0ebede32bd00", "value": "12288:xMrky90pvTJi9UfNaO1G2EI4SaMD55ws5YKhcMxPyahKLXMvic11/HPW0qJovtrk:5yOVcOG2QSPD7wslJPRkcvikAJoVrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382112, "uuid": "92e50024-0afa-48f3-b46a-f67d9f3202bf", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382112, "uuid": "6ce2414b-5608-4bd3-9076-5f2fa59a71fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382112, "uuid": "560fb131-7863-45e2-928f-a86112dfa5de", "value": "61cde0ed2e77da5faf0a6ca587c0ed3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1725ea-ac74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676385079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385079, "uuid": "729e956f-ed1e-447f-8068-cb6244200fdc", "comment": "Malware payload (RedLineStealer)", "value": "6962ed9bcafa1728abb1bfd64ace7891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385079, "uuid": "40c7ae04-60a4-419b-8c23-9d8c17137741", "comment": "Malware payload (RedLineStealer)", "value": "0e5bde66286ce0ae6c182e93aebde1f2bdaeb6c250bd0fc52dcf9952ce234d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385079, "uuid": "95f57815-1582-4f8e-b8e9-846efd0c8cb4", "comment": "Malware payload (RedLineStealer)", "value": "227e00d6f6476696c665167e6230bec7ec17c792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385079, "uuid": "222f091d-7075-4fed-b9a7-16c225efde3f", "comment": "Malware payload (RedLineStealer)", "value": "72b15bf7006a5ead527a96e0066f4bf486a1759564ec5cad89ea48ab582c852f954a55cca409fef4ebe607a169734c34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385079, "uuid": "5e602df4-902b-4b8c-8a50-48936cea5192", "value": "T1715401127CA0C072D59BC5785931DAA8ED3FB861ABA9C1CB37541D6E1E309C2DEBD306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385079, "uuid": "9f3aaf95-3a1d-492d-b91d-609b34a0c595", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385079, "uuid": "19cb3271-cbd3-4cb2-9238-44f7d6d724ef", "value": "6144:5ibLMHnCgeJJe2SFGVSro9iMEWQuQIrDJ45LvAmJijRC8d3+Sk:5ibOnJeTGI9iMALA1Ld3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385079, "uuid": "7a649d90-b343-4947-ba3a-17e23fb932c2", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385079, "uuid": "984ef788-0abe-4818-9993-92d74e18e085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385079, "uuid": "5b6319ae-29fc-49a2-87b9-b710d2020194", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9328cc-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676412780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412780, "uuid": "9de39263-8c2b-45be-8f39-a1b9b663f387", "comment": "Malware payload (Amadey)", "value": "d386f367493f4df0c0cbdbe28e62eb7a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412780, "uuid": "29a0974a-dcc0-42e7-ac15-aecd3f7e8fc6", "comment": "Malware payload (Amadey)", "value": "0e803c96ba0b852cf15a4475490b36a94824418deae9a077f01b979bd1100ad3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412780, "uuid": "5da21ce6-ec2a-4785-956b-3a223766154f", "comment": "Malware payload (Amadey)", "value": "0b80f5a5bb150dcb7973b1a7a3d1a7dc5f590418", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412780, "uuid": "80928a80-17ec-4fe6-b38f-04b78681956b", "comment": "Malware payload (Amadey)", "value": "19aab6e1cefe9039728ca96b5a30b24d36f78dc0bdf73a73e1f3e9a244d89d33933414ed539cb273e529b844b55985af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412780, "uuid": "aae25d58-6e41-4cee-b868-8fb4fe69095e", "value": "T14B25224BE7E89023E87857702DF603D30A36BE915E78936B078F9E195C726A0B17075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412780, "uuid": "e569b87e-5fa2-4ce0-95fc-c9b2c01ff0d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412780, "uuid": "be6be066-766e-4f89-8e87-339b6918d3a5", "value": "24576:IyQVw+Zf2iy9n0vPOFcnINx9mOy9eYineaupKL:PSwA219nIPkSILMj1ineaug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412780, "uuid": "9d980ef5-ef4d-4194-9aa3-edd056dfc2da", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412780, "uuid": "e7f80c12-5d33-4794-a3b1-1485bee6bb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412780, "uuid": "971e8e1b-4a80-402b-b6f1-b408183f4dc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234d7d33-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392334, "uuid": "eeb600d6-6b27-4c58-a3cf-8342e90133aa", "comment": "Malware payload (SnakeKeylogger)", "value": "6b49c2f7324d058d4249321c5a68e009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392334, "uuid": "e4ca6b9a-3356-4d14-8186-c47c704b6ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed9aff27c95fc0b9915bcf964e5e08f0e4b9159bd4ed39cc2a3be64503ae27c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392334, "uuid": "b71a33c7-5f87-4778-87d5-c5e5a98429b8", "comment": "Malware payload (SnakeKeylogger)", "value": "15a77a09528e878e86f8c8b3a1fc78282f5d0f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392334, "uuid": "d033ff5b-f6da-40f6-bd5f-a87a158c215c", "comment": "Malware payload (SnakeKeylogger)", "value": "07959f82ce7783c56699ed8886d61b1e25b98a0fc8fd04dada8ba68e68b1eba3df9769045aa6cdb1851a96104f9e8ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392334, "uuid": "63583f9f-46c8-4f53-b680-99a288135612", "value": "T1E5C45A8DC5BD4312EAFD0F7DB19F29480DA0054A266D093B97E7F880E17326A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392334, "uuid": "8a27f57f-c8e9-4f1e-8e51-fdbab3635af0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392334, "uuid": "5392aa40-340a-4f47-9ffe-d566eb367c61", "value": "12288:s1eces89S1ccMnrF/F02W7UPD2jaCQMEGKf:Tces89S1UX0p7kDLCHEGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392334, "uuid": "30378e04-c0b9-445c-9843-e9f185aeb256", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392334, "uuid": "b3915b71-036d-4eea-9ae4-b68dedff52b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392334, "uuid": "04befd66-c6fa-49e6-8ec7-ffc9b4253b30", "value": "6b49c2f7324d058d4249321c5a68e009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfa8bb7-ac53-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676371115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371115, "uuid": "321d800b-be45-45b6-8f41-9c1fb07c65ed", "comment": "Malware payload (Amadey)", "value": "bbc49def91e4efb97a867d1d7dc37003", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371115, "uuid": "ba2218a6-c083-4c5f-aaba-92d121c3246b", "comment": "Malware payload (Amadey)", "value": "0f24e197937cf02ef152ed9ff10f2473016ac0c777dd915efbbe3787ed98b3ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371115, "uuid": "4647f03f-bce7-4dbd-81fb-5c51164a1e75", "comment": "Malware payload (Amadey)", "value": "f405558e2228e12858775afd923af11031aa1f9a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371115, "uuid": "611b1f3e-1394-4ee1-8e8d-e81bdef79fdb", "comment": "Malware payload (Amadey)", "value": "3c802303b968271adb71c499eb729cf81f432bf0c5d3d035381036ea01716f7406f0dbb1984a811b3db6104c31ae36d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371115, "uuid": "9f945536-7e04-4cc1-a3c1-a104bbc24a54", "value": "T1AEF41257EBEC9561D8B08B7018F602D31936BDB06F38C69B6B4F9C590C72660F53932A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371115, "uuid": "d6941c59-4b2f-40af-85f1-013c603ba15a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371115, "uuid": "e434db81-e880-45f2-b89f-52dcaa6be101", "value": "12288:uMrIy90IeuGfewMGJQyMjmJOMvklFV47Jv53Z1XMvwc11/HbkCtRGmm4:uyauGWIFswOMj7JvVcvwEnR/m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371115, "uuid": "0c1294d3-4801-4c6c-8584-6c4d7ba20dfc", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371115, "uuid": "806edf64-28d1-4831-8c64-eb084034851d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371115, "uuid": "01f20c55-d350-4078-b83d-e7c29cd6b1b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57cefc7-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676393062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393062, "uuid": "4d06d194-655c-44e8-904b-a48a1683a55b", "comment": "Malware payload (AgentTesla)", "value": "8a750fc4e436bcba11010adef0b1bdc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393062, "uuid": "df06cf95-37d8-48a5-98fb-81e42457221d", "comment": "Malware payload (AgentTesla)", "value": "0f56888b169d41864fc185dc20d2a06d51b244bbba8b54661c1683d2d43bd863", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393062, "uuid": "dca315be-331e-4617-8f62-dfd2605d5a67", "comment": "Malware payload (AgentTesla)", "value": "64816260b9df7edc76d4a5faa27b3a291e7d78ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393062, "uuid": "40745bda-c642-4491-b1ed-141a471f7a23", "comment": "Malware payload (AgentTesla)", "value": "1979702d51dc02bd9de8e9ab176615eb0c6ab3ea15967f5a6c0f88c88da2b54017d04b6cce88690425bdd7e03f9f41f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393062, "uuid": "a21259a9-d619-4be4-a11b-3c4aece6a795", "value": "T10A35E007EA7AED2ADC13C57CDC5F148282129C39B914CA0D21C6BB1F9636BF1593EE64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393062, "uuid": "ab1ef69f-7662-4289-b7cf-14e787fe8360", "value": "24576:GPFenvPLFRJb/zFeDxaLwHoBZup0n9P051nTmyZdoohMa:qq5j5OaLwIHua9PKVmyZuohv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393062, "uuid": "e0040608-1721-4e6a-8fba-f7727c7df796", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393062, "uuid": "1f2b6eba-7afd-4b55-8e79-1993d8869755", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393062, "uuid": "1ed24773-49cb-4a67-945e-0b029951e02a", "value": "product specifications.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e3d227-ac3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676361654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361654, "uuid": "63c7e0f9-06ec-4c38-8d68-4a3589dc2b5a", "comment": "Malware payload (TeamBot)", "value": "d0873b5345cb25ddede0cf6597eb219a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361654, "uuid": "f418e4a8-5a87-4668-bd06-c3e743c25d5d", "comment": "Malware payload (TeamBot)", "value": "0f71d4d33e148ae9c2fc6029bf1f8f542536adb9594bf70bd225042adc9310ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361654, "uuid": "fe170acb-f8c5-4247-a147-5816d9ed81c3", "comment": "Malware payload (TeamBot)", "value": "53a4cf53bbf964b8a323171d74c89067bd3c44cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361654, "uuid": "321bf696-04d7-433a-a689-f3fd7de245e2", "comment": "Malware payload (TeamBot)", "value": "8e7e46db599da8fe742cf85cb656529b2515d757ca7cbccbf8c13a2d69372917e9042103fa39701e143246193f66ff9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361654, "uuid": "2a1a494c-cf87-4f90-a60d-408ff5e4c2ef", "value": "T18504D011B5A1E037D0A7857C6D3CD5B02A7F7D7273A6C48332481FAE5EB12E18A69723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361654, "uuid": "50397a92-2e2a-4d72-9feb-4bfc993c0f20", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361654, "uuid": "f4454d3e-e08e-4b8d-b39c-88a10254e855", "value": "3072:OoKcpLshk5flB9pGyBjfiRdu3HV22G1fYyL3uQkZx1MwM290/E1h:9TLshC/r1iqXV2vJYNRZx1Mwb0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361654, "uuid": "48226653-460f-4e8c-ad5c-3e67de410c7e", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361654, "uuid": "10c69c98-769e-41ad-9b38-7882538583bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361654, "uuid": "6b20e7f7-f523-4ec2-92de-76efe630c8ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf2cbce-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676393100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393100, "uuid": "e53561b6-d526-4b1e-aa64-e49633a60b6a", "comment": "Malware payload (Formbook)", "value": "fae81647ac074f66f76aa575978923d1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393100, "uuid": "9c57bc3c-cab3-4504-85da-dc2264dfed5c", "comment": "Malware payload (Formbook)", "value": "0f95e31ffb80e6c07233542a65939b920e4e76070190e4fdabe1e5dbaa03b38e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393100, "uuid": "99c5198d-060d-4361-9953-c17b13b5fd70", "comment": "Malware payload (Formbook)", "value": "3ecee397a696e240f09e4b64b9a0607735554935", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393100, "uuid": "f2b6f05d-0a84-45b7-a438-d46a69d2af2e", "comment": "Malware payload (Formbook)", "value": "94462d03cfb269a1f383660bfb865a3ba7cf1b97d1336214a8b333b598952c361ca7d8a5b64e94ea7e5e600d031d0fb1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393100, "uuid": "f4415e93-b220-4ed8-94d6-6746a75216e7", "value": "T1ED13F65AD78F02A4CF551277131B4A899AFDB33EB35150A1346C933433EDC2E46669BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393100, "uuid": "e5335c89-3ff9-437c-9d29-70bec06afd04", "value": "768:YFx0XaIsnPRIa4fwJMZL/HpkpxSRJ/FIu3N45mgPzE68ulKoepKsvp:Yf0Xvx3EMZDpdhFIu9SPPzEGCjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393100, "uuid": "51998d90-0be5-4cd8-a807-b390d1d01fba", "value": 42853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393100, "uuid": "55f15f4a-459e-411c-a510-77b969d97166", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393100, "uuid": "aef99b13-4081-4ca0-834b-d46d91b128cf", "value": "RFQ 705125.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddc381b-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676399089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399089, "uuid": "aeb3cabf-f7ae-4f9f-b45d-c7d0778adf7b", "comment": "Malware payload (NanoCore)", "value": "931fc81cbe6c2708a24936b6617f70c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399089, "uuid": "1c33f93d-c75b-4f52-aa8f-790cb2855460", "comment": "Malware payload (NanoCore)", "value": "1022fd7bb8a53db67ec92455655a5e6306e26c5fde15db264e8bae312c6cf36b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399089, "uuid": "453632aa-bb32-4f6b-9dc0-7b532081b876", "comment": "Malware payload (NanoCore)", "value": "a6d6a908909bfed414e8d6dc283750587208727d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399089, "uuid": "4e1a0a77-5f42-446e-b714-d65518911a8e", "comment": "Malware payload (NanoCore)", "value": "e58fb2e2bd013c2ed0900463c235b328eb05597e659e504cb0be897274dd566f93494679197bdead4ba31ef18e96ccfc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399089, "uuid": "3302dba9-5068-4fa3-a620-338c6a585b1c", "value": "T14DD4BF778933BDCA637C68C480183D856DBC3EC35228A9ACDD4C6463E5ED165CABC5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399089, "uuid": "2367bb34-d5fb-4e3f-9626-0825311f3695", "value": "12288:FSKFi9mnp67w8LVbtuXshJ4nwFRqwEtOjG:FSKcmk88LbvgwzqRtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399089, "uuid": "61389864-aa39-4e46-9e28-c6dd0150015d", "value": 630526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399089, "uuid": "34531189-a1f6-470d-9d55-06d593f21181", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399089, "uuid": "91bf5862-7faa-458c-93f3-7ce2be32bc9d", "value": "doc file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0ffff2-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676386359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386359, "uuid": "3f835dc0-611f-43c7-8ce3-664856e2dd56", "comment": "Malware payload (RedLineStealer)", "value": "3b1aa3b1b624f9a384421778e3366734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386359, "uuid": "5ca82d62-d1c0-4d24-9c0a-0830f3049e2c", "comment": "Malware payload (RedLineStealer)", "value": "1053ec7687ccde76529d670ea59594c154eccde308075ea6a2eeb2a623b7a776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386359, "uuid": "a5a5190c-30fe-4595-b171-168168655673", "comment": "Malware payload (RedLineStealer)", "value": "46fee1aa704f0cdfd65170b5c564640cffca7842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386359, "uuid": "c2abac35-dd6f-4bc1-9d0d-a4a726766ae4", "comment": "Malware payload (RedLineStealer)", "value": "4d8ee28e1d86fa33d22e2843b9ec67069eda7eec5bc5fa3d6b7bc89ac7d7cc8d5efa2b067c00f64f7ade9887bbab0468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386359, "uuid": "7fffc76a-524d-4970-83fa-15472fc3de17", "value": "T1CBF4121BEBFC9026D4B1577159F603D31E33BEB06A34879A274EAD6E0C626249734723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386359, "uuid": "b82e60bf-5369-4ef6-9f9b-f22d6c46d56a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386359, "uuid": "d7ff9f55-4703-4285-a2b0-74c0a625cde9", "value": "12288:UMrky908YHXSoD2hugwzl2awKrLRsWCZFT4dzFoEfhVoMlUnaMfiFz0/:YyoHCi8uzMadG8deIVoipYszK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386359, "uuid": "43f79de9-2ee6-4ff4-81b9-81d64b441849", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386359, "uuid": "31533dc5-a089-43c5-a28f-9519b8c0b52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386359, "uuid": "29454615-9429-43f0-8efb-b2fbbe86dbf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7040e4b-ac62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676377522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377522, "uuid": "4a0d5f85-45c6-4a0f-8dce-72b2ae6d1c52", "comment": "Malware payload (Amadey)", "value": "da2a7afa4fd488179660bef2873111e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377522, "uuid": "0d6da70e-3f53-4249-9892-5cf0af03f8fa", "comment": "Malware payload (Amadey)", "value": "10d7c4e3c5bf79685611733ad820b678fa0317755ae8323366f24bb8f9546bab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377522, "uuid": "6e623def-d8c6-4d80-aa13-66d5f7de8c9e", "comment": "Malware payload (Amadey)", "value": "5b5667d60734f43e37920d81abd003a578908bfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377522, "uuid": "0941977a-0c46-4a24-ba66-a4b892d2319f", "comment": "Malware payload (Amadey)", "value": "dcee78d493b02826ef2ec0874941c855916940bf5fc327484993f642dd64204d23384f9ad6ac42f156fdd649b38982ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377522, "uuid": "a65cbcfb-2616-4269-b12c-fd5b12821d77", "value": "T170F4120BF7E89062E8E1977028F707C30932BEA15F74439B675BAC560C72674A639727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377522, "uuid": "c4073f8e-3df0-4161-9c99-6172d5086505", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377522, "uuid": "02ffc2ef-2d8e-4f62-b654-e7960fdaa963", "value": "12288:ZMrvy90FSlT44y9v0EM9dKX1YA9xFS42TagUjxxe8j8A4ewbVB7Itr:2ygKwcxdB6B2teuBAlEBkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377522, "uuid": "583abc99-1a1d-412b-988e-6856bcddf4a5", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377522, "uuid": "6828853d-1e65-486d-8631-f7080e3a52d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377522, "uuid": "9399ac17-5cdd-48eb-8155-91d7a8cf0118", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d962d34c-ac7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676387915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387915, "uuid": "19e9ef22-f200-41e7-9494-b2bdfc0ab94e", "comment": "Malware payload (Amadey)", "value": "c82707abc070f8ba6badad92a5790dcc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387915, "uuid": "dbb87af3-2dc7-4b77-8907-44d73b94f208", "comment": "Malware payload (Amadey)", "value": "11b2c90d3a232573b7a1de1a2d168150cfd96273eec0928b48cf23dc28419f9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387915, "uuid": "83400ce4-f3cd-4554-88f3-7e22b6f00e06", "comment": "Malware payload (Amadey)", "value": "daafc2860d1d4fd4247fd05669a06a2f37526d5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676387915, "uuid": "c88e6ec3-411f-4145-ac6c-a670a3a8c85b", "comment": "Malware payload (Amadey)", "value": "cd53b904bc056227ee86bab0c23b2a2af0e995ff4425cfcef4f386f471ec9ec11308cd482ff48283745ead91ec67a881", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387915, "uuid": "6b96cbc5-7eb5-4d51-adf5-6993cf88fb0c", "value": "T1A7F41207ABFD6126E9A1477019F707D31E36BD605E7882AA274EAC580C33A70B635737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387915, "uuid": "3a13261b-a54b-4792-9df3-bca56452f60e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387915, "uuid": "fd16ba0a-56b8-4b31-a2c0-b209a2b23b69", "value": "12288:tMrfy90uzRl6NV/hlZqUNh8iEkHZJeEhXaYIFO4WVfB4N3HktCoMHUnaHVVm0Xaa:Cylz/iV/tqUNh878FhVGWVfB4tHk8okD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676387915, "uuid": "95f2065e-66a1-4a79-84b5-c932cbc9c6a4", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676387915, "uuid": "cf11533f-771e-4aa2-af28-313f20178b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676387915, "uuid": "712f631f-3234-40df-b2e3-8feb7e963c62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2296c9-acb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676413097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413097, "uuid": "e845cf9a-d644-4a9d-8f22-2851767ca2da", "comment": "Malware payload (RedLineStealer)", "value": "eb63827920a0460c8420a2698a0aacd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413097, "uuid": "e2aa6464-4304-4108-86a3-24c32bf554b4", "comment": "Malware payload (RedLineStealer)", "value": "11cb0836d621aff8e70f35f86126252741a2041a78a5d493a64eb65dd6c2b2c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413097, "uuid": "349a5ed9-f6e9-406d-b976-22dbe08f4523", "comment": "Malware payload (RedLineStealer)", "value": "ab4dab5ba4ff2bdc8ade5ba04cb40fb688ec4241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413097, "uuid": "165f8ff1-d8cc-4382-be9a-4a117c81c899", "comment": "Malware payload (RedLineStealer)", "value": "d15a16a29fff95e0c303a18335dc99cde09193593d097918bc1fd21dfb7fc9bc2ce4fa7c255c0b7718c6a5343dc8006b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413097, "uuid": "7b974d26-5eae-42d0-ab20-d049a5e5a071", "value": "T16AE41207EAE9C072EDB51BB009F617D30A37BD615F68835B134F9C6E18622A1B630767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413097, "uuid": "98eb9297-b90c-470e-8072-d88c11ef2fa4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413097, "uuid": "849019fa-88a6-4354-a5a0-68b2da7bc3e9", "value": "12288:gMr4y901T9RfuBkPn6zGcWSVaQB6RU8/ibBDeDRvS9hUh2EsUtecnj4N7Oo:oyepRfuU6zpLdoR1/ib+IaRsunj4BOo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413097, "uuid": "462e15ab-4ab0-42a9-b766-dcd6eac9942a", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413097, "uuid": "baebe007-8803-4077-b571-3dffaf475bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413097, "uuid": "fa88a06b-9f5a-4f3c-af7c-746b7cf6f2ac", "value": "eb63827920a0460c8420a2698a0aacd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac6e607-ac80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676390521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390521, "uuid": "6f916887-3c49-4dae-a74d-e3750a3005f8", "comment": "Malware payload (GCleaner)", "value": "da1bf44cd1cc13d3434df23edfecbe73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390521, "uuid": "2383dd1a-349e-4caa-bc54-d7e6500ca970", "comment": "Malware payload (GCleaner)", "value": "1247e65cbd94f0dec524d6ef055dd7877db7f745cdd7e6848364c9da1c52c9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390521, "uuid": "76e9bf7c-fafc-4958-a7e6-d5e3311ff8a4", "comment": "Malware payload (GCleaner)", "value": "060e9e410dfa6273aa10a9445fe7f9089d6e2a69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390521, "uuid": "7f72e999-b5b4-435e-b990-72a54816813b", "comment": "Malware payload (GCleaner)", "value": "0ccf66256e0a165cd506afb86edff5e46c41744fdf7a1cd6304e5f81425aa1220ecc1e087fd01fd9547d74c595050e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390521, "uuid": "7b98e5b8-b3b7-4a30-b629-e5a41aae6684", "value": "T1C9E5123C7105C8ADC280FEB4CC3AD8E75DDAADE3A9A1A16630CD7F3F12791889619553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390521, "uuid": "caad7457-f6d7-4c19-8039-abeb21068307", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390521, "uuid": "e3fc1e43-c16d-4ae8-bd0d-ba8309b721e0", "value": "49152:rdHn/fp370Zq1ApaDcqEHaurtTahapL1INe5CkXMQl6g267W/1HFgYVho8IvJLCU:JHXpr0mgT9tCB/b67cHmYVm8Itv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390521, "uuid": "4b73d1aa-a2c4-47a2-8157-21e046c7e6e0", "value": 3288968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390521, "uuid": "2f80d963-5b3d-4402-a9b8-63f5af2c66f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390521, "uuid": "dd9df0c5-822b-4cda-8814-69349d774222", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae14fc8-ac99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676401070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401070, "uuid": "7254b7f2-703f-4506-81c7-fb45fba16a5b", "comment": "Malware payload (Amadey)", "value": "8b015490b5f01dc00c5018678e6251ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401070, "uuid": "134e443f-dbfd-4b43-b36f-b0b5609a27b3", "comment": "Malware payload (Amadey)", "value": "126eac884b06de29485f5383b95a1b66c3c6550c9d034bef8600dc08eb315fc5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401070, "uuid": "25eaac3d-c8f9-4e5b-852d-ba20429818f7", "comment": "Malware payload (Amadey)", "value": "7375b035f6d013955a27e2058b9f14dc49029843", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401070, "uuid": "dee63f2f-2a90-401f-8054-56749cf21645", "comment": "Malware payload (Amadey)", "value": "20f60d59c194bb565a68c1beee542e8721d5720506ce77076bf93e1ada968524fd63cdd9b9954ae12383a28b4f5cf326", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401070, "uuid": "89b9e45c-a8c9-4a5f-8a3e-018a13030c4a", "value": "T184F41257EBF84032E9A453B019FA03D31636BE605B34879F624F5C2D4872A70753AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401070, "uuid": "a6e58a0e-9716-43e1-ab91-67a3a2c89078", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401070, "uuid": "af5edb8b-72ee-4563-9293-e3b56eae7024", "value": "12288:DMruy90Yg4QKnjeN/kjuQCTBFd4+DQmDiOgkcV5HGXHigi42N:Vy3gVFkjuQim+TiF15HgCgx2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401070, "uuid": "2eda38fb-6c29-424a-908f-37566be4fec4", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401070, "uuid": "ba4b91be-d8a2-480e-850c-facb9f408fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401070, "uuid": "1f5d16d6-51fb-4eb4-8438-82fdebc26044", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b06651-ac2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676354832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354832, "uuid": "e5434286-d29e-47d7-8081-e6b650301d80", "comment": "Malware payload (Amadey)", "value": "90963e369436273a31d7fd9b0339abc8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354832, "uuid": "a1e9a2ac-2acb-4a0e-85ae-b2803b530cd4", "comment": "Malware payload (Amadey)", "value": "127f49bbbf544c1e242e7ae6a09fb91cb2d50b4b38e65840c8e2ea638858f8c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354832, "uuid": "131f5a37-eec7-4128-9658-00a49c1fa137", "comment": "Malware payload (Amadey)", "value": "c3ed20d15e258e1934db4bbfd46a2143d9608312", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354832, "uuid": "1017e386-f2ed-4cd1-99ee-37afba1bb501", "comment": "Malware payload (Amadey)", "value": "bd5584af5dfbe9f02b40fcb42dba879b6cc61e06c971ec350e419ea71393ce1b7a512e510e31e9cfc91dc3458a312e8f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354832, "uuid": "00903735-2d7e-4c9f-9a0f-32b497ff1b01", "value": "T16BF4120BF7FC9465E8B157711CF643C30B32BEA09B39839B174A98590873664B63937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354832, "uuid": "4c33792d-12ab-46c8-bff1-b49476d3892c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354832, "uuid": "41011022-f75a-43a3-8240-c4fe3471b362", "value": "12288:KMrsy90OwNeaOpAVqfFag3aYGW8fZBNFD4ojqkD7paDH3A+bEfOs+:eyIkhpAVqYZYDIBIojqo7paDXAvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676354832, "uuid": "e00528e5-2e49-4349-8b92-80bc7a4f3792", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676354832, "uuid": "26786549-8563-4831-a140-c992bc28a0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354832, "uuid": "b51cdea1-44cf-49ab-95fb-e6683e282d66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf82ee9-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kovter)", "timestamp": 1676350635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350635, "uuid": "d7204da6-ceb3-4720-9d2a-7b9db8808651", "comment": "Malware payload (Kovter)", "value": "2a23a973128a321fd0569d5228ff7a1e", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350635, "uuid": "f0b3e8a6-c7e0-4771-a58a-d70f8383cf69", "comment": "Malware payload (Kovter)", "value": "12d596d72a2d7fd14775f191a6d62d39aa5bd33f521d401b695f491461afdc57", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350635, "uuid": "b4194925-0ebc-4dc5-93bb-49146916b310", "comment": "Malware payload (Kovter)", "value": "44c4770ad2e1546a8435196a6bb35d54e94bef18", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350635, "uuid": "95310ec3-7d41-4ee4-9c63-1fea8d82d102", "comment": "Malware payload (Kovter)", "value": "125135b90346aaceabe3ff4b728c60aecd30bbdb874db5e7a3d99aad406b0c03af218a24bd9b218f6788484e73480b17", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350635, "uuid": "5b89dad8-008f-4d8f-b090-2a10f59622d2", "value": "T135455B39F640D637D42618FCDD0FE2D5A579F2302E381957BAE51F4C88B92836A1BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350635, "uuid": "0f03bffb-6f4c-41b1-8a42-1305753e1c92", "value": "12288:vaSYm5BfDGdDcRfifEBGrrbui47xLHGKdFPH3h/H6U7W:va5m55GFcRfOQGrvuiIxLmKPPH3paUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350635, "uuid": "6eadfa7e-9509-4a42-90ad-68e7379aabbf", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350635, "uuid": "1b8287e3-cbec-40d1-8499-301ad176a8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350635, "uuid": "7c0c54ae-e113-488e-a9a2-0abdb64acc6c", "value": "2023-02-12_2a23a973128a321fd0569d5228ff7a1e_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5410adbd-ac0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676340017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340017, "uuid": "fdab5b14-20f2-4f2b-9668-d620c0d4ddd3", "comment": "Malware payload (Smoke Loader)", "value": "4d0dd1cc7573d7ca0de06f226d920208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340017, "uuid": "4d86e356-f6ae-4320-b708-6345c1c8ff45", "comment": "Malware payload (Smoke Loader)", "value": "13011de24cabd6835ca9a5895ed2dfe7a9419421118ca6f3d51c7a452eec19c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340017, "uuid": "ef5a5d1e-0db0-47fc-8539-cb7aa134361d", "comment": "Malware payload (Smoke Loader)", "value": "934f4b49419db8a6dbd09108024db6c8d879d628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340017, "uuid": "2f277834-4bda-4b2f-8667-766edb1c3c0a", "comment": "Malware payload (Smoke Loader)", "value": "59a76f71c5dce981cef4a9869e2e02776efc849bc877e886b7735c32755ea109d4e754ff6b9be2804815b62e6d280237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340017, "uuid": "b74e184d-2c5c-4080-82ad-abff2a7526db", "value": "T18C14CF13B3A0D472E42645308C69C5F57A7EF8229B79AACB23D4673F0DB13D18A76391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340017, "uuid": "6dc03e4a-a8f9-40aa-991e-85a7f699dbcb", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340017, "uuid": "cdaf4f23-bd12-474c-ab4c-459076813b7e", "value": "3072:lJMuia5zNmyDuuR0Djcjz/wN2e+8wgajX5eerpiADQhV:ldNN1F8jcjz0wBXZp7DgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676340017, "uuid": "abad7316-ac20-4773-854f-b525eb18b822", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676340017, "uuid": "29ea5d0e-4f62-41ca-b110-d32e85d1ae68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340017, "uuid": "168d235a-e6f7-4b86-934f-624919c77122", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc04efd-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419139, "uuid": "61f4c8e4-2f16-41ba-9e9a-88bef71b7270", "comment": "Malware payload", "value": "d1ad0d914039816e7c90d693fb622935", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419139, "uuid": "3c0add1e-bd5e-481f-93b3-55e65fc81abd", "comment": "Malware payload", "value": "1375348b20b4a2f78dc4f54226393ad7bf88dc8bb6879a1fb28b23dd90e44583", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419139, "uuid": "de6d1dc4-f296-4972-ae54-81b7a64778ab", "comment": "Malware payload", "value": "0f25ed799934cf40dd3cfe17fbf88aeca5fbea27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419139, "uuid": "67019f37-9e9f-4af9-a2d5-981e74567631", "comment": "Malware payload", "value": "ece5b321f031cf35d7106fc0869d3b7789fb1d7fa444d1d343e9d19f77d064b04a5bb9a958b62c90e2ba7bc98f5ef86f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419139, "uuid": "25f38282-9a09-420e-8bc3-42d5005e4c51", "value": "T1FDE3C86E7E21ABBEE168863107F36F70C39561E726919382F16CD7181E7124D1C9FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419139, "uuid": "083abf6a-b9cc-4568-8af7-cb9ef8de8e9b", "value": "1536:Dd7jY1TFEq+/7sg2rK4xax+FagaC2rK4HaQxkqHe+0TvvbYPeIFr267UDKSshmvE:SL/y5kBTvvb4SOUDwhmvj3q+13Botx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419139, "uuid": "35aecf4f-3c40-472b-9267-fb9d5abb3340", "value": 148038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419139, "uuid": "1efa8a01-cf7f-4033-9981-bdab17380b0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419139, "uuid": "6212001d-af65-4b76-a481-d1e690548bff", "value": "d1ad0d914039816e7c90d693fb622935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08813923-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676408180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408180, "uuid": "1aa0c33b-61b2-46a2-9c1c-0f990d44e1fd", "comment": "Malware payload", "value": "a9140a5c75744b1cc25c75831c58c532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408180, "uuid": "aa6810aa-6ca9-4a97-8c8d-77dfec21a344", "comment": "Malware payload", "value": "139dc47ab41d2d9123c612053528354cf97a51a0352ac4334ab64a704b0608a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408180, "uuid": "116400d4-eb2c-4f7e-856e-68068f153d2b", "comment": "Malware payload", "value": "783e0e062f6c987056126e43e8b40ca8b119e60b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408180, "uuid": "b2ea732b-0212-428b-a30b-77adc9f73b37", "comment": "Malware payload", "value": "b0ffdce5cb622317d24fdea7914ca4dcfdcb50378202611dc75fd6d80d9566bc9fa3ea520140543e6e6562748dbf4c6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408180, "uuid": "e90a4ce6-653e-475f-90fe-453987bb767d", "value": "T13E2453367D27D213C0E7EEB4AAE67A62EB68E2C31E85824365E0105D1EF5959341FCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408180, "uuid": "92e702c5-8e34-4e10-916c-c83272cfdec4", "value": "3072:OpLFTvox4sew7mrMyyI266MmglEKkNoaapX:OJxi49NilVMmglEKkNoaapX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408180, "uuid": "a2567c5e-2e2e-45ae-93b4-16e88426bbd4", "value": 229430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408180, "uuid": "8e67f37b-d5e4-4cdc-b92d-07aea8a01b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408180, "uuid": "0661aae4-84d9-42cc-91f6-375aa5bf48a3", "value": "a9140a5c75744b1cc25c75831c58c532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c94c56a-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382095, "uuid": "f0a9cfcd-cadf-44f1-aa2f-aa2b1d81052c", "comment": "Malware payload (RedLineStealer)", "value": "5f9f8a568d35f89abf78e16f56253518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382095, "uuid": "7351b829-85f2-40d0-839c-5bedbb6babbb", "comment": "Malware payload (RedLineStealer)", "value": "13f78253f5f90a68fbb6e9d8d43e529a2c70653048352956d7088779f77f3e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382095, "uuid": "952a44d5-ef1d-44f0-ad13-00adcd89070a", "comment": "Malware payload (RedLineStealer)", "value": "963504f23e31635ec83b6afc6b42848c5889a4fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382095, "uuid": "3fa22676-758b-4961-9d2e-693455ba49bf", "comment": "Malware payload (RedLineStealer)", "value": "0015af05a16db0358c58f9661b7bc2f5b84d894c2996a7392e6f3b9561eef9180c307f68d59980e64d4a596c59eb547d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382095, "uuid": "6289cdb6-2818-4d84-98b2-b2f7504ed15d", "value": "T19DF41247EBF98132E8B0977059F603C30736BDA15B38835B278F995A09725A1743A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382095, "uuid": "37c13983-4ed6-477e-b0ce-4cdcc41fcf25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382095, "uuid": "92d413b3-a8ec-4415-b331-156c1ccf8c3c", "value": "12288:HMrPy904Ax/PqVn1tVYE6e9wlZGMD5Qm95YiVcBZcTeXMvZc11/LZk51EMbd8:cyMx/yV1zD6eevzDGm9N5TecvZu21T8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382095, "uuid": "e18c0f9e-bebe-4e02-b28f-2a4c42429c1f", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382095, "uuid": "4194ff9c-331b-401a-b353-8183fd996f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382095, "uuid": "f7cf9d05-1f79-4b0e-819d-e84245dd4697", "value": "5f9f8a568d35f89abf78e16f56253518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a63fff-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401978, "uuid": "c9ad13a1-30f2-473b-8b58-f040fb02a668", "comment": "Malware payload (RedLineStealer)", "value": "9241d02f053e21a404add0b1e6edf486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401978, "uuid": "59b26991-d16a-4b70-b28c-86354264e1f0", "comment": "Malware payload (RedLineStealer)", "value": "14189c6cb21e6321c2c2764e53a98db537326d15cbc6513918146fcf256399a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401978, "uuid": "aa0bcff2-ba84-4cf7-9872-4ea3ccf357a2", "comment": "Malware payload (RedLineStealer)", "value": "30b52eec6842382427d5667f0daf6a87edd9b4a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401978, "uuid": "d452ba3f-67d1-4635-aaad-080353c3cc4f", "comment": "Malware payload (RedLineStealer)", "value": "e903af53005263b56a9d3f27537a9e4c5a884361b572e77e2157d298375b9de2db7d69240b456789d8afca7a4d4f4e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401978, "uuid": "4bffb5e4-140c-46c6-87aa-96f79ec8cd9d", "value": "T18FC4010BB7EC8433E9752B7009FA02D30936BE514B34839B225E7D6E18B2671B675367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401978, "uuid": "e2b7bcf4-ff8f-4ade-b0d1-f8d9098b40f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401978, "uuid": "2f37b1ab-1f82-4dfb-8309-fa3996bb1435", "value": "12288:ZMrxy90ARsmKG0lD5pW0XZmca6kRkcv5HGoKckk6d7QQAM:8yfHelD5dXsca6kRP5H35kk07QQAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401978, "uuid": "41ffd19a-b1bd-41ae-8856-618ecc697dcd", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401978, "uuid": "fcadf193-5ffb-495a-a692-834011d4ac43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401978, "uuid": "080602bf-504d-492b-b40b-b71c44a10549", "value": "9241d02f053e21a404add0b1e6edf486.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2875653-ac4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676368146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368146, "uuid": "11ae0971-4169-4f96-9edf-23fa43278706", "comment": "Malware payload (SnakeKeylogger)", "value": "88fec319b45306bb6bb91d1cce4d8ad4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368146, "uuid": "8ce75b1d-a2ab-4092-ab3b-d4fbc42e6759", "comment": "Malware payload (SnakeKeylogger)", "value": "150cabd834f0db43ad531fedf436d3788b9f7365c32e7d2efebf02583a178581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368146, "uuid": "30771561-0afd-40b1-a0ab-e0c797aa0f37", "comment": "Malware payload (SnakeKeylogger)", "value": "1b080be709d61f2e9ba55f5aced35c1d886a82ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368146, "uuid": "35f721a8-a9aa-49c3-9674-932974c55cec", "comment": "Malware payload (SnakeKeylogger)", "value": "d2bb4271adb969c22b5ea3b69b2d3e9277fd613c541ae936b941a517e1809d2397a7fae29f9e5d5092cd5b9c1283847a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368146, "uuid": "ff9e7976-0d55-454f-8abb-8cff6d69c295", "value": "T111541228B1A1C4E7E4A25A31997A974686F47D23346A970F37613F1C7B37251FC0AB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368146, "uuid": "cdb04fc5-7e37-402e-8a31-4b7506254965", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368146, "uuid": "e5182e9b-7ccc-41c6-b094-a12a1e512552", "value": "6144:tYa6ciPO8EArfqOM67PnkC4nr/uqe2u0xSsz9mb4Y/TYUPaLIP2cJAo:tYG02AbHMSP54nTuy9o4qEUyUPbAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676368146, "uuid": "bd6b4c54-0bfa-448e-9d5f-c743e3a0ac49", "value": 289207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676368146, "uuid": "c0832aaf-c5cd-4740-9b5e-17041ebf9bf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368146, "uuid": "720474a6-8245-45a4-9c39-e5e9955b13da", "value": "Fatura20238278973456789055475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ac0d9-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399954, "uuid": "f991bf9f-4299-4be8-a2a9-052a76001c03", "comment": "Malware payload (RedLineStealer)", "value": "b7bb700e5a7a0c61fb93590366fe6ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399954, "uuid": "1f32fb59-4dbe-4ac4-90bb-c30ade22540d", "comment": "Malware payload (RedLineStealer)", "value": "1516fc2758b409c7d53002665c888d62ac481d89679f4738c7d05cc672de319e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399954, "uuid": "f11c7b58-f58c-4819-aba3-68532d37a1d4", "comment": "Malware payload (RedLineStealer)", "value": "39a45f5aefb163427aa29ffcbdf130017cd52e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399954, "uuid": "8b28e36b-589e-4993-87aa-7cae60d0442d", "comment": "Malware payload (RedLineStealer)", "value": "67e1158c2e24e87b1cb06050cbecb340372e043279031f4b98def2e8d112139c33af0e98720877f8dd56484926f41096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399954, "uuid": "1318e3c4-1a1c-4038-994d-15aad397f02f", "value": "T19F54F1323AF1C032D1A385B19460F65069BFBC7267A0859732782E2F2E716D19E7E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399954, "uuid": "8a962fd9-45bb-45f4-9f43-2fa050a5f7c2", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399954, "uuid": "539d7be3-bbe0-4837-88ee-3713743a437f", "value": "6144:61L4BI9E+Sy5830JNHYnFpbpzMp63k7cqFQ3RIaE:61sx+X2sNobzm7k3RIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399954, "uuid": "dbd81e18-1bf1-44ee-8ad8-f8fcee4b0e3f", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399954, "uuid": "2ff12242-d70e-4b72-bdfa-f0964f5da8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399954, "uuid": "1dfdf344-9ef5-4e57-9e34-33e47c4196a0", "value": "b7bb700e5a7a0c61fb93590366fe6ab9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b77ced-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676401996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401996, "uuid": "2d707230-d98d-4d00-b60b-c6b3e9c0f08a", "comment": "Malware payload (DCRat)", "value": "cb7828d2c749261635d4509ba51904e5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401996, "uuid": "e0c3950f-3908-4953-883e-424aade1f400", "comment": "Malware payload (DCRat)", "value": "151a6ee585c2f164b0adf97bb404558186293d218eda29d8f9ec25f67c706aa6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401996, "uuid": "1e23d07c-fd22-49f8-acd7-2c770c515e7b", "comment": "Malware payload (DCRat)", "value": "14b6c6ad2308ecc71a921876ca684f0ca531a945", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401996, "uuid": "fa200549-87fb-4e9b-83a7-fa9de0fe9d9a", "comment": "Malware payload (DCRat)", "value": "4270c5205bc566b195247e31fe3c53099add0e0bf428860eed52d0ee879dd1781b8162e7ed24ee476b7fc74d1f9e0361", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401996, "uuid": "85f5aa78-ca6a-46e5-94b3-c7df63f52801", "value": "T16225AD5025A81DE3F5EB9EFF2A2156AAF913643F456E270A120DD4F0C92E14293BC7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401996, "uuid": "98e26160-92ed-49cb-83e6-799224862c39", "value": "4daca7182a967075c4a8cd470c438efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401996, "uuid": "5eb98f2b-be3e-4e70-99db-c4d4cc31a5d6", "value": "24576:Z5aInSOZb08lO/uM4bxhD1PTgX9dxsGcj2wIopXAHYq4:ZQIvPXQxJb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401996, "uuid": "ef037d15-dd59-45a1-a080-3272644fa898", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401996, "uuid": "88bc7b85-91a8-477a-adb1-a3c6ee315981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401996, "uuid": "fd2d0ceb-cec6-4ab1-8fd6-e270e34be4ad", "value": "151a6ee585c2f164b0adf97bb404558186293d218eda2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4177198e-ac72-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676384224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384224, "uuid": "cc3a8d16-4edb-4657-9dc3-9857800dde65", "comment": "Malware payload (RedLineStealer)", "value": "253ed97cfe3546d97878dfd58ca24a34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384224, "uuid": "2e9a4f0c-cdcd-4bb3-993e-f507e5e146f5", "comment": "Malware payload (RedLineStealer)", "value": "15a1f09c22580a6cf6bffbc7ced8a140fbccf46ef59c5f2bbb247a89861741bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384224, "uuid": "616b81e2-7630-4242-a774-f1b401519a8d", "comment": "Malware payload (RedLineStealer)", "value": "0fc986f29a225484ff8b03a6d1eeb249773df5dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384224, "uuid": "c0725123-666f-4610-b5ac-12ada9d6aca9", "comment": "Malware payload (RedLineStealer)", "value": "bfbb5b0f28d392c5fbc7c1ee7fe4c985381423a4acf3abb7ee0c51eb66d6d957c3f32c5ef48c6b6c49e5fe4c9a4cb651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384224, "uuid": "369d81f1-0d39-41c2-a3bc-83ea491b56a6", "value": "T1CEF4120BBBE88031E47967700CF206C71A76BD609A39835BA75BAD690C73724B671773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384224, "uuid": "e465331b-8fab-4fcf-845a-3609ebf14768", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384224, "uuid": "a4a00f7d-bb7e-4e82-912a-5ae9b35de375", "value": "12288:ZMrLy90LiAcjiMghPuHkh7jfgP0UFL4jTVXLypYy2e0rglam0/tZA:WyRAcaPNffI2jTRV1rVBtZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384224, "uuid": "fd19cbba-d3f6-4584-8387-93f7d8d0f4dd", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384224, "uuid": "ffe63fff-bbf4-4dd1-b1f1-af4b94a60e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384224, "uuid": "29be7b4f-3877-49c0-b16c-af04f8d6cadd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3864cf2-ac34-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676357813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357813, "uuid": "82f1f32b-4824-4c75-9e3d-8161ec815608", "comment": "Malware payload (Amadey)", "value": "315a1fe7fcd65329e05b9fd9be288471", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357813, "uuid": "2a8cfdcb-3d1e-4114-8300-6fd6d289d97b", "comment": "Malware payload (Amadey)", "value": "15d385f3c313269318c63d4e422171177aa340e802554d9168bc3f42e4bdffcf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357813, "uuid": "3c3bca98-1fb2-4797-b0d7-eb42871fab72", "comment": "Malware payload (Amadey)", "value": "0276fde93365c77170df8c64b5bd913e2c9d89cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357813, "uuid": "8adcc00f-2302-4590-9a53-f8db1a029347", "comment": "Malware payload (Amadey)", "value": "7660d72f59f78388a9f7f06e7b88524b0e9b3a314333fa660ceeaaed9c7bcdaf97c347048a9bf79ceffc097d5d15f41b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357813, "uuid": "07c485e9-831f-426b-9e62-0a7cbf7d666d", "value": "T136F41257F7FCD421D9B547B059F202D31B32BE614A38928B274FAC6A1C32690B67136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357813, "uuid": "34bd30f5-1f43-46d0-ae3a-55d9cd6edb39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357813, "uuid": "6322e74f-cd4d-4097-8347-92126e55e066", "value": "12288:MMrGy90DbcAumeCM7ebRuQr1kFa4S+sC363+AFZoS3B+MdLpY:SyzABeobRuQByStEo2cBH9pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676357813, "uuid": "aa1aa11b-ab9b-458b-8331-f4da9a3dad45", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676357813, "uuid": "cd81a334-b11f-4351-85f8-c08b4cc1a565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357813, "uuid": "4f9c4071-ba9e-4084-a76e-e4604ef0223c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe10749-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676369403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369403, "uuid": "f51935e2-82e3-40a7-9950-d990af21a099", "comment": "Malware payload (ModiLoader)", "value": "cb55c8f2f530fdf3940cdacaed07f50b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369403, "uuid": "d08111ee-fac2-4208-8b89-130d1c5f64af", "comment": "Malware payload (ModiLoader)", "value": "15fde337ddfb3d5665b441b1c2b6391a1584dcf04b28b5316300b52ae63673e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369403, "uuid": "be8953a5-5f29-4d38-ae2d-167ed28ea488", "comment": "Malware payload (ModiLoader)", "value": "0eb2a1b1dce86a772c0ef720ddf2f72c23be1379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369403, "uuid": "5414cb61-5c43-46d8-88f8-bd224f5d1472", "comment": "Malware payload (ModiLoader)", "value": "836222399c41cfdb5a395e795c1e60a68a8c1567682fb0ca65e94562b2cdf376decb5d6226937d7ac58b534ce83899c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369403, "uuid": "680205ee-701f-4e3f-8db9-541b2977a946", "value": "T1CB45261CBDCD0437D373193459061E655925AAB2ED28F8F33EACD808DBF22B1A836D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369403, "uuid": "2fed8e2b-34f9-4ec6-9c81-768ac82e975e", "value": "d1aec4d82386c4595521872a7de3a670", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369403, "uuid": "288c77f3-6ed9-4a43-abe8-7f17e459883e", "value": "12288:oX8lOqFSsZ40z3QjB2lr5fPx7Zh70WoQzV9hBoSFhAf1nAhglR:Q8ltFSQ3AB2zp7pcf1nAhglR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369403, "uuid": "043ad7d3-07d6-4445-a232-6dc10e1036f0", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369403, "uuid": "9f980d89-07be-4006-a25c-2aa864d46134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369403, "uuid": "4a582d6d-fefc-4582-82d5-2d44757a1168", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80504bd-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399562, "uuid": "c49a39c8-09e3-4114-85c6-aee81e71c2ca", "comment": "Malware payload (RedLineStealer)", "value": "8c57cad785753c47bb4bcaa19049d009", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399562, "uuid": "50aef27f-f6a9-4253-b508-2a6b95695181", "comment": "Malware payload (RedLineStealer)", "value": "16422dc80d9f2f3a5caa2cd60a9ab27aa9f74a61d07c63cda81366bdc15c1e2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399562, "uuid": "1160de3e-08f4-4f88-84ba-c49756e40993", "comment": "Malware payload (RedLineStealer)", "value": "a3c74cf4d52ad3377edbcc98e571f6c5d8c79db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399562, "uuid": "c2990428-d820-4026-a0b7-2b7bdedbb000", "comment": "Malware payload (RedLineStealer)", "value": "f2edd571136dde430cac2935c97e40ddd95a41ffe012375d535939377dec929708c3333471b115ecb52c7d89e22583f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399562, "uuid": "a82c1cc6-b395-41be-856d-75cbf0d7c1c1", "value": "T1F054F12175E2D0B3D55F41784820EB918D7FBCB2666981BBE3140A7F9E203F18E6971E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399562, "uuid": "eb6067be-dec9-4430-86da-517eb06d186d", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399562, "uuid": "d6cce04a-5161-424e-b03c-88b1cc9a078c", "value": "6144:nLFX5cEF4PaGISa1ZqTd/wzIs6yw8CJN4Gg2/F:nd5ePanSaw/wzITB8Cz4l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399562, "uuid": "8104ae39-2c91-4bf1-bf12-01d55574703d", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399562, "uuid": "0aebfa6d-9e8a-4fb5-83bf-af538d430f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399562, "uuid": "ba01b4a1-c484-4c16-8a18-ad77af1b5edd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a340383a-acb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676414023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414023, "uuid": "cb37fe5f-22a4-4d6e-95cc-56f844df9373", "comment": "Malware payload (RedLineStealer)", "value": "55032dd3d6264e92c189cb80acb82166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414023, "uuid": "0a914a49-3c4d-433e-8c81-871dc20b5b9b", "comment": "Malware payload (RedLineStealer)", "value": "167a469b1ac76e077c5594e8b5bd88b77124e2f0483fdbcf451798436f5a9a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414023, "uuid": "39d8b1a9-2c35-4b72-8476-5ad102897a77", "comment": "Malware payload (RedLineStealer)", "value": "820a49bea8673d77b10cceeac19e42125797f982", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414023, "uuid": "73491035-e22e-43b6-920e-4340b0f7010c", "comment": "Malware payload (RedLineStealer)", "value": "a24864e5e23d610729f53d7d0db15dc4c6bb844db394f29db7a80b669f8b05a80931291a77caf9d741325f05a5266569", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414023, "uuid": "e047db94-17f7-49da-bfb8-899eec1dce34", "value": "T1A125224BD2E99562E8B097301AF603C30A737DA06F74878B3A4E7D8509B1176F57872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414023, "uuid": "51abdd45-56d7-4fa5-9934-91bceb5de170", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414023, "uuid": "3bcce7be-8231-439a-9258-1deb87aaf487", "value": "24576:yy4wnvVdSMSBYhIdlnN3k5E3X3m5FlbEfcLjJVeEle:ZrtdLrIdl5k5825FefcLjLxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414023, "uuid": "5c5f6b47-54f0-4977-89fd-81c1da0b89aa", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414023, "uuid": "947335b7-191a-49e2-845d-6c978219253a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414023, "uuid": "cd3aaa2b-6557-457f-b2f1-acb0663dc988", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b08d44-ac93-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676398624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398624, "uuid": "ce5454c3-9415-48be-96a8-91b8cc6a18a9", "comment": "Malware payload (GCleaner)", "value": "22f19d77d94f8e57173ac3071e70e605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398624, "uuid": "29c1c783-5100-4a37-93fa-d27054e1d400", "comment": "Malware payload (GCleaner)", "value": "16cee656cdee5508ad60ac433cae733d0ba656c3be799e39e9a9b2f86fff05e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398624, "uuid": "7c441e7d-02c3-4b32-bb04-e9011621fb9d", "comment": "Malware payload (GCleaner)", "value": "f194310730d96de7cf60d1f88597f8b5e1e2b5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398624, "uuid": "0ad53ce7-cd0f-493c-a253-2c62eb57be50", "comment": "Malware payload (GCleaner)", "value": "3f7233e7164a816d49d8c81d9f2c1d86647e44f21ab5e71dcfffed3945022e68c116b8145f89ab9a0834750b07be1bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398624, "uuid": "c8278286-00bf-44d9-8717-1922929a942b", "value": "T138E512BC7649C46DC680FEB48C2AD8E35CCA6DE7E9E0A06270DC7F3F95791849A19503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398624, "uuid": "acd37eb8-1671-47a6-b741-a2f0582a55fb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398624, "uuid": "bb357160-82f9-498c-81fe-7d193885198b", "value": "49152:rdHhmhodFR3609G2xnIXBbVq1GKwT31T7vU0FW8XS5nPPEJuHxLCgv2MR:JHhmh4FR67YwBbVqyBXDxqPskHdv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398624, "uuid": "a3e30a69-21b7-4e03-b255-620bf9977781", "value": 3200259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398624, "uuid": "3a59d22f-ef99-4ed1-b0f3-521989f374ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398624, "uuid": "7ed7cd59-8147-432c-842c-265878527e01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee796a50-ac8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676395251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395251, "uuid": "1d65132c-3126-4831-be12-164795e908aa", "comment": "Malware payload (Amadey)", "value": "ce55a60e0d976b3ad1645824cc974766", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395251, "uuid": "1b845eb4-24aa-4a4d-bafe-8cc57115286c", "comment": "Malware payload (Amadey)", "value": "17399467b9070e2794293e002a8f1e79f5720ca7f47f5e8cb5ae1a9ba2e50f66", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395251, "uuid": "bd8df812-3aa5-43b0-8412-97906c066aa9", "comment": "Malware payload (Amadey)", "value": "eca8eafff151d070bc268c93d33293332bbccd8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395251, "uuid": "5345c33f-a286-40be-b486-9acc1b79dc97", "comment": "Malware payload (Amadey)", "value": "8e62437d5812e8dbd69166abbddd4acc2d11bd00ca76978c04b61265390d98f92e524140061716390fe7beae0bac4d56", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395251, "uuid": "dfd2e0b8-df13-4868-9633-c26a8e47cb7e", "value": "T1C4F4124BE6FC8461D8B097B05CF603C36632BDA09F788757278F586E1C72264A53636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395251, "uuid": "1ab5b91a-bca6-47cb-baef-31f4a666dccc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395251, "uuid": "bbde735c-3ffc-4292-88bc-4d895d776bdc", "value": "12288:/MrWy90NO0HNZHSbcIBrmFYYFb4yTqeWcGCLpkqbw3piL92g:FysO0H3fIBSWHyTWcGC13X2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676395251, "uuid": "e5d4b704-6d18-41b2-8d56-83b193bffdc0", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676395251, "uuid": "82d3393c-ada5-43bb-9c63-a00c526ef6b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395251, "uuid": "9fcf67fb-eecf-4ad4-b800-0938cfcca0e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0843045-ac7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676388356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388356, "uuid": "bbfbd9db-7ca4-49ca-8c71-b525e1e20b82", "comment": "Malware payload (RedLineStealer)", "value": "d5df08763522b26294eae977ff59fd8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388356, "uuid": "6038471c-7adb-43cc-b568-21abe026ca64", "comment": "Malware payload (RedLineStealer)", "value": "17ea29214ff57990dedad58086f0665a4171f3f402344401682efd2042c74d18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388356, "uuid": "4f194c77-0d5b-4183-a150-3962fedc7497", "comment": "Malware payload (RedLineStealer)", "value": "3381610472f50a400f53e9b33a046c0586486ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388356, "uuid": "22563dbc-2ba1-4ddb-bf9f-3ddc441d987c", "comment": "Malware payload (RedLineStealer)", "value": "f5d17271b5e89bd8c0bf120cd6ecf385bb5af3a71c902c8aa1310efdc0e93c05732f6016c2e8c903d00902284ca518ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388356, "uuid": "017c7180-bc93-4a58-aaa7-1cebfe59bb10", "value": "T1C3F41217FBFD9422E8A653B009F617D31A337D705A3487AA674BAC5E0873670A634327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388356, "uuid": "e524f195-2649-40e3-b655-c8da91cd782a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388356, "uuid": "a01acb7d-4fc2-467b-ae36-6ceda49f3ccd", "value": "12288:jMrsy90VYkVr9kXu58M31/I5rfNQvynR0FS4UzxuhtgDroMVUnaXNOL3V:PyipVCu58H5LavscUzIh2DroWpXNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676388356, "uuid": "fe5e6873-fa9e-4746-86ef-4d0a1df5f2a0", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676388356, "uuid": "f29b966b-4160-4638-8246-88d39b2c1311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388356, "uuid": "5bc4bbf6-5d5e-4f7a-90ff-1262eba6de68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecbe453-ac0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676341511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341511, "uuid": "406766f3-5f92-4fe2-9f6c-480aef88de29", "comment": "Malware payload (Amadey)", "value": "d4b89c06b0346e8133c75bd02e752109", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341511, "uuid": "04efd7e5-79c9-4c05-bfad-cf9640c61ed2", "comment": "Malware payload (Amadey)", "value": "1828c40895da31b25ba270755d27bb9d510c37904e860dab4e17c7dbd5f7d860", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341511, "uuid": "b90bd26d-6ef7-4404-b2e2-8bcf05a93233", "comment": "Malware payload (Amadey)", "value": "a019c8a8a582e904c8e8bb3678c68d2b113996f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341511, "uuid": "b9754ebc-1c4d-4b29-bebe-642828d40994", "comment": "Malware payload (Amadey)", "value": "9aa9d12335da05fb18ffb57f325051d81c000fbe180dea4bbc9dc30ec24c74bfd24f24515ff84922d96bc46933b4cfae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341511, "uuid": "ffdf474d-224f-42ac-973a-d97db0389fdc", "value": "T1D0F41217E7FC9432E8B4577028F603D30B327CA05B74969B264FAD5A0D72AA0A53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341511, "uuid": "2278c970-dfc6-41a6-991c-3cd7a8c338dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341511, "uuid": "ce0f7b2e-15bf-4872-b6be-07b0ee2f6b4e", "value": "12288:1Mroy90WRC+5NFgLQ3DKbwhMCDuQLz/LEQpT4s/laInJGOBqR0RzC:JyLCgWQKErDuQLzzEQpMw4InslRYzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341511, "uuid": "481e1062-ace5-4af5-b5bd-66bf4b1cad52", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341511, "uuid": "fee9de7c-87bd-438b-9617-b6afe6c2552a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341511, "uuid": "8397b01f-4baf-456e-9df9-f250ec487067", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db05898-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413370, "uuid": "417464ff-5ae4-4a2f-933a-25826e654e90", "comment": "Malware payload", "value": "280248787a20a7d9b064775a8cf93d78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413370, "uuid": "809f1219-4426-4cfc-9813-4ff1766ed4cf", "comment": "Malware payload", "value": "1830372ab3a1140994816406663332629eb4f08622de961e9cb66837d5a884fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413370, "uuid": "d977e628-fa3e-4ceb-b3d6-65ed555df074", "comment": "Malware payload", "value": "e74cddeec5328d2c3f7f57dbc482d9d9e0e04656", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413370, "uuid": "5486a131-1b75-4d7d-b6a9-b6328d8ea4c1", "comment": "Malware payload", "value": "26bc9b60fe7e75b67f267a5e9952d66b904100f8d7ae5a5e5c75e0431220719e3eb7a58ac79e0d663c172dd442d7e57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413370, "uuid": "f9e11632-67db-4a22-a69e-cd0b2426f75c", "value": "T14E83F99BB71D0BABC59B5AB12CB737F18B6DED6002B21184910EFF9007B29741532F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413370, "uuid": "842e8a59-aeef-4791-b743-3418b92f00b3", "value": "1536:zhkpXXB3ff5/Z/Ke9LlTEQX7KqpFsYF1PZzdctwHUIe:NyHB3friolTEQXOGzPpetl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413370, "uuid": "99f3019c-f514-4cbc-a45d-1f6384eddb19", "value": 88570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413370, "uuid": "f22a0128-9395-4f80-811c-31cca74014c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413370, "uuid": "c2e23e1f-0ac7-4dae-8eff-ce416a64a41d", "value": "280248787a20a7d9b064775a8cf93d78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e173b13c-ac0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676341972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341972, "uuid": "464583bb-e091-401e-a05d-950d8b5c0e5c", "comment": "Malware payload (Amadey)", "value": "ad8912e152f80c515299c0e37b59c549", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341972, "uuid": "7cef3cd1-c45a-421e-835e-7e22992be2f0", "comment": "Malware payload (Amadey)", "value": "184c9011c107242dca191d36ce36ff4f8e6cf85b8ff1bc05bc3dc835e46ee5f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341972, "uuid": "2974775a-414c-4479-909e-d3885c08e034", "comment": "Malware payload (Amadey)", "value": "134c38abe1500884714d57b861caf4d4c231cc38", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341972, "uuid": "3d03850a-9d46-47e6-b482-4b35455523d5", "comment": "Malware payload (Amadey)", "value": "90b7bfe8cbdaabd4960983f655641baa376d801e80d38256124de1a84bc28b1a188751d546a959a932650e0d71083994", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341972, "uuid": "ac989cc3-75c6-4d89-be17-b8ec2d73711c", "value": "T1F1F41207A6E94032ECB547B16CF703830E32BD715638939B1A4ED99D0CB39A4AA31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341972, "uuid": "f6e1b906-cd10-4d7b-8ef3-e3ea7d67cc0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341972, "uuid": "49f5af73-55ee-48af-b766-d5d52065b37b", "value": "12288:QMrNy90Iu1wtFgin0r9YbGFHsyXTmpxFu4Nn5d4oeqzGWsOqh5xX:Nyq1wtqin0r9YbgMyXTmptNA9qKWJCrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341972, "uuid": "f77a546b-65d7-483d-bd32-2a7c15481b78", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341972, "uuid": "384d3639-376e-42b8-af5c-e805f0b420bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341972, "uuid": "1341e0e5-0454-4529-9073-c52fdb5511a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec97b6fc-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363466, "uuid": "9136d56c-f84d-411b-9ac4-307b9819f53b", "comment": "Malware payload (RedLineStealer)", "value": "84640092d20fe97e60e855edc7fc96c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363466, "uuid": "1470b30f-6358-40e4-a3a0-c2d3ee38ea8b", "comment": "Malware payload (RedLineStealer)", "value": "18b8e4d98289f36117d2a2cac153a7a9231a28b3a7b2ef98b17b7729666a11ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363466, "uuid": "a0a43526-db9b-4d4d-991d-126b625fe54b", "comment": "Malware payload (RedLineStealer)", "value": "51eb37acc8c18ada1d20d8cd3275c96b7110e245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363466, "uuid": "7a411620-9c52-43ff-8ca7-6aa3f8af337b", "comment": "Malware payload (RedLineStealer)", "value": "186af55fbb6d4c6035cf194dac20197d46d6dad72d3cb72605dae886632619f560d40e76c369d24251f386548c81b43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363466, "uuid": "d8df3770-2839-40fe-953e-43ccb1d4f7b9", "value": "T167A4021BEBFC8172D4B457B418FB03C31635BDA16B38935A234E6C1A18B2664A73177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363466, "uuid": "867b2b53-0e87-4e2e-9138-b06b401d80e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363466, "uuid": "a93f22ea-5d18-4137-9dcf-54e17ed7d0a8", "value": "12288:kMrvy90Pqdm1r82FrPF0w6A6/GobSiWzj/:zyZOrprd0z/GxiM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363466, "uuid": "8d2496fb-f1f0-4f89-bd19-7ceaafa59798", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363466, "uuid": "a8bc27f3-1ec6-40f0-82f7-a77f07dc003c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363466, "uuid": "e98d2836-2e79-4163-b29c-dd0eea908c9f", "value": "84640092d20fe97e60e855edc7fc96c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6429c601-ac46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676365384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365384, "uuid": "894e4c6d-664b-4860-8c50-82354f7b3623", "comment": "Malware payload (Formbook)", "value": "210b3e271d976febb9acfcd34eaae767", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365384, "uuid": "528ec4c5-b64a-45a2-aa8c-fc80258716cb", "comment": "Malware payload (Formbook)", "value": "18f3dd99c131c25cba7ca4689fa9fec8b6ea374fea9ccd28f5b2f8fd04324ede", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365384, "uuid": "e7925669-e696-43fe-a250-3438ceff252c", "comment": "Malware payload (Formbook)", "value": "a83af47b6df60f05e7716ac9cc0f3c4195caaf28", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365384, "uuid": "ce5f499f-0b9a-4075-adda-0057a3e71329", "comment": "Malware payload (Formbook)", "value": "58142705ce1ad5596c0a1fff462633b8462ad3d5556b8e47a0649956e173c9db0d917e1b2589ec066ddd1f5282f3bfdc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365384, "uuid": "bfd93b7d-1db8-46c9-8a9a-670ad87d2205", "value": "T1F4B4239427053B9823E572CA3B447B667380F7D8034E8B4C145E36BF96FF6711EAA960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365384, "uuid": "e32a7357-fe78-46ff-a3c0-2829e3db6b14", "value": "12288:/O1DuY1qfcJYjQEJ4J35su0Ds3tWlghj72n0efbZkDgwG:mUY1fgQEJ2t4s/49v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365384, "uuid": "18eb1521-2813-450e-9ce3-68f052043229", "value": 529056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365384, "uuid": "a3b11f5d-db43-48d6-b0b1-4a2c531aafe1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365384, "uuid": "d69fdc0f-5698-4b90-b0c6-90071bfef4d5", "value": "SKMBT-283202109080.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd9bd90-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391734, "uuid": "682a3694-5418-4faf-b7a9-2d923e6cd667", "comment": "Malware payload (RedLineStealer)", "value": "19e196c866a2f17dde262074857f38b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391734, "uuid": "41a2f2a2-6b35-4eb7-b055-8a9c1bf87520", "comment": "Malware payload (RedLineStealer)", "value": "18f87ea211c82cd42006807474b098becbfe5965bc74a3618ec569bab352b83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391734, "uuid": "e61a8af7-932b-4e3b-aebb-6ebe1e99d579", "comment": "Malware payload (RedLineStealer)", "value": "e2ae231a33d8149e2057bca19f091eb59122f902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391734, "uuid": "96fb852c-9355-4cf7-bdbf-e80eceac1454", "comment": "Malware payload (RedLineStealer)", "value": "bceae00304e8a1110e875de90f4f5b6a30cd1a1d367a0557e617807d8f9bf409f630be9197153df03fc3fb7f15a15d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391734, "uuid": "6decdfa3-0d9a-4abf-81e5-ad9e85834abf", "value": "T123B40207AAEC9432DCB1537019F707C307317DB15A38829B678EBC5A58B26E8B635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391734, "uuid": "e72374d0-6340-4966-9eef-1a2d99f2b7fa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391734, "uuid": "e54c2ccd-4a04-404e-811e-dd1ba0b8e76e", "value": "12288:rMrvy90bzr3tbKGvXThin9Hfo/KvnagV0OqfJB2BJAAB:Mys/dGuXFs9/oCSgV0l2BrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391734, "uuid": "2ba9bc29-5df6-4e4f-9c8b-bb09c45e4295", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391734, "uuid": "217904a5-6598-4f91-988f-7f8f93dbb819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391734, "uuid": "3bbadb36-0191-426c-bd2a-34026cacccd1", "value": "19e196c866a2f17dde262074857f38b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a829126e-ac70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676383537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383537, "uuid": "6368ad72-1bb8-4593-8b50-02bbe0850baf", "comment": "Malware payload (Quakbot)", "value": "f3e4187753512ed80b12bc293dab93ee", "object_relation": "md5", "Tag": [ { "name": "1676025438", "colour": "#F74419", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383537, "uuid": "b4969c51-051d-45a3-8167-8a8ed13a641c", "comment": "Malware payload (Quakbot)", "value": "193afdfd46e04b024e0ab9dd1b0a8fe46c9e29463711dd992a1cbfd05f48fccd", "object_relation": "sha256", "Tag": [ { "name": "1676025438", "colour": "#F74419", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383537, "uuid": "15fec980-1937-4811-ba2b-33cc817e4e04", "comment": "Malware payload (Quakbot)", "value": "b6fd55bf84d20f8ceb58627d5e607edb03ced453", "object_relation": "sha1", "Tag": [ { "name": "1676025438", "colour": "#F74419", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383537, "uuid": "234228a8-9dd7-4032-83ad-0b1ad237e5ce", "comment": "Malware payload (Quakbot)", "value": "a98ca5df8e84ebe238c1dbff264a178230b26cdd72a94f2c3981305502ee67148e0e133b03bed841956d1171dc7e9ab9", "object_relation": "sha3-384", "Tag": [ { "name": "1676025438", "colour": "#F74419", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383537, "uuid": "075b76ac-1ee2-4d18-a540-6ab8cd6bbc38", "value": "T178947C2BFD8F10F9ED1B04F68087F77F6E3C63598A21CCD6D8540E59ED656A6400AB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383537, "uuid": "58997604-b422-4cf4-9b45-2719b7711dd6", "value": "4160b8ad2228905966ea106c1f7681d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383537, "uuid": "a3d7a429-6460-481d-b69e-ef953a145aad", "value": "12288:AJZ7012XT1BaB4Irm8VGfw+aWCF+RmdYyA:0Z7012XT1wB4Irz0fw+aWuhYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676383537, "uuid": "e843f229-6cc1-4b02-ac77-22c6dfb76a9e", "value": 444704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676383537, "uuid": "ac94197a-da59-4bba-9141-0236548b7df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383537, "uuid": "9ee2999a-3ce0-4b43-b8fc-f25cf4887091", "value": "09.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90329aca-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1676398959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398959, "uuid": "5a76204d-52d0-4fa5-8729-a3ea39d52679", "comment": "Malware payload (DarkCloud)", "value": "c5f4d7a0730518088702ef973e79512a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398959, "uuid": "8997ca11-f662-4209-a1fb-b5a4547da0ff", "comment": "Malware payload (DarkCloud)", "value": "194f755147e8c616d0218d1e1b4e1e0a5c9373edb5e295665ab46cecebc05a5a", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398959, "uuid": "a78cb722-4128-4ca4-8ba5-265ac2822dd1", "comment": "Malware payload (DarkCloud)", "value": "3f273412895427167ce52d659fac3716536c876e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398959, "uuid": "68d6b219-bd20-42b2-b2f2-c1f92a373b64", "comment": "Malware payload (DarkCloud)", "value": "0813b11e0923434eed0f3857e8d7e5f4203084f86df601e2f29cbc837dc6bf0b92ac265b4d0472d5af491b385c9ce0ae", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398959, "uuid": "e72602aa-47a8-4132-83ae-45f149a9894c", "value": "T1583512027AC256B2D4731E366A7A6B10797D7A600FA9CFDF63D04A59E9312C0D6307F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398959, "uuid": "cd8aa80d-6db4-4ed3-92ef-89b350c51def", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398959, "uuid": "156c35f0-cbc5-4b47-b736-4c2398ecde8d", "value": "24576:9TbBv5rUeTzLAXjXXRQFX8KZZMqZExRMa2tSim8BpM:XBvzUtQSDN2ftpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398959, "uuid": "4ad800e2-02e5-4622-ae63-7d220f9356e8", "value": 1126151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398959, "uuid": "377278d2-1d2e-4e13-aaa1-6b4390f7c6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398959, "uuid": "cb749f60-7e63-4235-93dc-047c99da4244", "value": "orden de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03632fdf-ac47-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676365651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365651, "uuid": "70d50231-352c-4368-999a-05d2b5360eb6", "comment": "Malware payload", "value": "7b4c587258d9324728348ca61cbb0f3d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365651, "uuid": "fa87beaa-830e-471c-977a-cabe41a0bf38", "comment": "Malware payload", "value": "19bcc7719dbc54ffcf2d06efff92ef6714b80ba5eb32d9c9b2e55e9760051aab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365651, "uuid": "37b248e7-bff4-403c-9c5d-0f0c9419fccc", "comment": "Malware payload", "value": "be031c8209d63365dea8a56cc917d7db65110325", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365651, "uuid": "2ace5f78-f8d2-4444-af9e-01aa52bc2dc3", "comment": "Malware payload", "value": "edd686ed76ac2e31e43fe68faab1e5fc06541c6ceb477fc0babd70a88b37f87d69b611a7e87949f383565c8ae783d7ff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365651, "uuid": "76c1ccec-a838-4c8a-8276-43f3258371ad", "value": "T18445BFF875047DE62A6F576BCA96ACDD13B616239ACBA4CD80B477C305A3371EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365651, "uuid": "36f037cc-b254-4c19-82b9-8e3d6d8448a1", "value": "24576:v20EDXBf7bypdNxXHxo39KdHoj02ni0vioUFoi5UvP+Mxm9+9f5hMqXs98Wi/7:vO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365651, "uuid": "c2af9edd-8062-463a-8d62-90ad445308a9", "value": 1273139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365651, "uuid": "fb66d2f0-4efa-40df-8f8f-aca02246ad46", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365651, "uuid": "9bacb51f-0e5b-4f2b-88f4-4a1a5bff6c16", "value": "PI-FEB 10 2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3b21fc-ac43-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364057, "uuid": "197e8f26-4017-4ca2-845d-79ca256ac8b1", "comment": "Malware payload (RedLineStealer)", "value": "a5f5c5d6291c7ae9e1d1b7ed1e551490", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364057, "uuid": "2af7ee15-0d1a-4427-9b35-6dcd23bbd76c", "comment": "Malware payload (RedLineStealer)", "value": "1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364057, "uuid": "4b43514b-40a8-47b3-a1c7-532673107383", "comment": "Malware payload (RedLineStealer)", "value": "3d06413341893b838549939e15f8f1eec423d71a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364057, "uuid": "c32514fb-e58a-49b1-abec-021f116a5263", "comment": "Malware payload (RedLineStealer)", "value": "78ea708c614751ebbdd1003c11f24683f54c76d7bba48a301fa549f122ee6780554db9ac3ea8c196da8aa72cd81b3358", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364057, "uuid": "17993515-8e20-40bf-b939-adf51ea1d6ae", "value": "T13C04C61437FCCD11E1BA1A3F6961A06146BF9802AC52F25B76C367CD1E32B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364057, "uuid": "772895a8-86da-4374-bc2b-dbdf43f3e21f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364057, "uuid": "fa323295-4a1a-443a-abe3-b440ea185e76", "value": "3072:HxqZW11a2kX8fGRaMX84neI+9mhivxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jV:RqZkGRaG3emh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364057, "uuid": "c4e13247-8b5a-4fba-9f28-e2dad367e00c", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364057, "uuid": "30874918-d452-429b-af4f-04d23654d52a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364057, "uuid": "60cb1c57-23e7-460e-b423-19e4e3ea7cde", "value": "a5f5c5d6291c7ae9e1d1b7ed1e551490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebd185a-ac03-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676336572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336572, "uuid": "b3d5bb12-1292-4e28-bc90-05a8954a8925", "comment": "Malware payload (RedLineStealer)", "value": "b2031a88f173fdd8acc4c2b5eaaa24b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336572, "uuid": "c3353f00-95cb-4e40-bc4a-e5634879e116", "comment": "Malware payload (RedLineStealer)", "value": "1a48b318e160d17960e9587d05fcaa3a2bfdb369fca1c78f80d486e22eed61a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336572, "uuid": "9124e3f0-108e-4ad1-a91a-d26176a739f7", "comment": "Malware payload (RedLineStealer)", "value": "0f5662098c2c70982c764d06afb6225bcbf09380", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336572, "uuid": "e0197762-8159-41d7-9f01-fcc4f7ccb9e3", "comment": "Malware payload (RedLineStealer)", "value": "684851f8120f8da83c2db55a124721dca81d192ea996f7ea855984942f6337bbe631e603c84c04cf98310567efbcb237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336572, "uuid": "b4ed2a6e-1ffb-4709-9f9c-8179f5e79aad", "value": "T18664E112B3A1D872E82A45318965C6F4663FF8604FA4AAD737B4AB3F0DB12D0DD76341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336572, "uuid": "33853bb1-8dc9-4e66-86ce-b4373db3e10f", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336572, "uuid": "1322ac7b-78db-4974-a12e-4910e6523e1d", "value": "6144:x7FcjYfEvf7k4F7KvdFA7+S5f+/GfTjhgpHd6:x7FUvf7kIkdW7V2/iJeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336572, "uuid": "7f7234de-19a3-49dc-b742-40f491b5eb61", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336572, "uuid": "90dfa869-e990-4baf-a293-31a87e49075c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336572, "uuid": "0162af8d-d975-4964-97b8-fe2288731a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5815ee0-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391747, "uuid": "55bce882-e84a-45f3-86b9-227ff352cec5", "comment": "Malware payload (RedLineStealer)", "value": "4c21565f8752c48c30756d15dac9d48f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391747, "uuid": "0ce2f781-ce82-4980-a6ef-9311da0c2b27", "comment": "Malware payload (RedLineStealer)", "value": "1a715a984c7b73d4b097f67fc0ebb9aa8933f8f5b57b5207613e1cb1765c7c9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391747, "uuid": "a016c31e-3967-42e2-98c9-1bfbe2a8f566", "comment": "Malware payload (RedLineStealer)", "value": "7d70a33a12bf09a82e830cc6fb12f4907d5a4bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391747, "uuid": "d75e67e6-b4e2-4313-81e3-2ead620f04d2", "comment": "Malware payload (RedLineStealer)", "value": "5645888ec25829d9e52f9422a7d0883a6f352535c480c5a14c01efa98341d621339e30fbd638a10ca90901befe0a8131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391747, "uuid": "e30f0899-79c3-4d4a-813e-b0aed8c634a9", "value": "T1A4A40247F7FC8032E8B557B009F743D309367D616A34429A238FA90E08B19A5A6757BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391747, "uuid": "35577347-638c-4ea6-9841-9c089d79f82c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391747, "uuid": "24402b93-dbb0-4d10-871a-7f8e8ad1fd35", "value": "6144:Kny+bnr+/p0yN90QE5mfsVSodBM+W2jSMPXeUxSozDDnlryVH66SLvbm8nqh7O1d:ZMrLy90OfsVps4SMPOUxfLniE9nqtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391747, "uuid": "4d10768a-72bd-48d3-8cac-4945d1deca49", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391747, "uuid": "8321c8e3-cbd8-4428-a627-880fbd8e249f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391747, "uuid": "6c5be623-947c-4bda-ab5d-d7c410e7b12f", "value": "4c21565f8752c48c30756d15dac9d48f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2d1d09-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676399380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399380, "uuid": "eece0b1b-7284-46f7-88d8-7e8502974f23", "comment": "Malware payload (Formbook)", "value": "a44404aac23672009dc1d835f223d35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399380, "uuid": "1e30fe23-c2b0-4c43-8e09-c5a91c6b0a85", "comment": "Malware payload (Formbook)", "value": "1a82b5f2c6d3897569544939dfae30457d05924c8811f009d0cd1540319ea90c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399380, "uuid": "59258c8d-c46e-41b2-804e-62db771e9491", "comment": "Malware payload (Formbook)", "value": "31aee1e8489ef5b6033f24050ff309941f8f38b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399380, "uuid": "8f911906-2638-4c42-a494-5ef13b63a161", "comment": "Malware payload (Formbook)", "value": "93dc4c7d4ebacd5b0277aae0f3f58449efa3a007cecba0d08f8df227c10bc970ea571da48a21487f2ba8d5dbdf3214c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399380, "uuid": "8a0285c9-4daf-450b-ab42-e9491b8f9b96", "value": "T1E154E030C365F467F9DB6133357ADEA22AB4AD72C453AA2B0F807A0F5577490A639313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399380, "uuid": "f206ab3e-c04f-4830-bb13-4605a11419b1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399380, "uuid": "c589e12e-3384-4561-a95a-377eab2230db", "value": "6144:0Ya6qfeaNVq78yPmAR6PAqqQ1hPP23xulTtZ3X3fCA:0YMmaS78yP3g4qxYeZ3XvCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399380, "uuid": "6819a84a-7922-4a94-ba47-eab63ff0f690", "value": 300437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399380, "uuid": "0909e5ba-b503-480d-a2ef-6bb7ab6020b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399380, "uuid": "697ea14c-4810-410c-bc52-536d7e93cae5", "value": "a44404aac23672009dc1d835f223d35b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdb6ee3-ac42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363761, "uuid": "e2f523bf-448d-404c-a4de-9051cf11fe21", "comment": "Malware payload (RedLineStealer)", "value": "0050cd5be8e4de15a3da83c31640a6c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363761, "uuid": "7e5b8b25-26a1-4504-87e3-c1468f99fd45", "comment": "Malware payload (RedLineStealer)", "value": "1aa10681a65d13dcfacd0e564bf7214f32f542c7f06cf5b82cef124563f9469e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363761, "uuid": "67376003-a555-4477-af32-5f1c1aeaca83", "comment": "Malware payload (RedLineStealer)", "value": "3797a91014b0336f1f3a1f464403722fa63cb87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363761, "uuid": "21a8ec81-32fd-41f4-a388-45dd1da2aeb2", "comment": "Malware payload (RedLineStealer)", "value": "100c339f6f297fdcbff4929cad0a8cf226eadf8ff9cb6ae0f4cd92fa3e610cb452e941a461ee3ddcb1a8997b2f1f83c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363761, "uuid": "d79ca86a-e775-4b40-b1bc-60d4a3d3bb68", "value": "T128F41217EAE9C532E9B4877059F306C318327D905A39839B278F586E1D635A0B63837F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363761, "uuid": "64844ae0-bca8-4d3a-aff3-ce401760a38d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363761, "uuid": "c0652fc2-f8a1-4cca-b6fc-61768d9bf6a1", "value": "12288:GMrDy90JqduVmX4ge1UmVSO+JSm/QOS8DEQg6vDpRJSMFT3OSI3sXojoS3Rn:dy4qkVmDGShSe86vDpr913JIO3cRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363761, "uuid": "12aaaa2b-1ac1-4815-b302-836471893651", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363761, "uuid": "2e9639ff-3822-4d0d-9283-fd4d032b79e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363761, "uuid": "82f6cdec-b034-44f0-9c07-b083fbcb911b", "value": "0050cd5be8e4de15a3da83c31640a6c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a983d5-ac12-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676343056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343056, "uuid": "63d9bdfb-80d2-4110-b13e-9345785687a1", "comment": "Malware payload (Amadey)", "value": "b3a6b83cdce18580c8b96b699f9c2bc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343056, "uuid": "a389de7b-6aa0-46ce-bce4-f086dec79c81", "comment": "Malware payload (Amadey)", "value": "1af1e158318c854cc9f71edba01d0447b39348850afd1719b687a98da9aa2194", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343056, "uuid": "5cf64b6e-321b-43e5-8db9-606312c88519", "comment": "Malware payload (Amadey)", "value": "586334c88fcb294cf1ecc82a242c7820e638b4e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343056, "uuid": "7db96606-f139-4850-a3a4-4583faebf7de", "comment": "Malware payload (Amadey)", "value": "64adaecfd617d8d7b9e3c6222826004f7cff40b264d58d4cbfdbf924144431c69557c57ec6da11af2969bc046d5551d3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343056, "uuid": "30efdf56-8691-46cc-a50a-a91b7bb397ec", "value": "T172F41213A7EC4171E8B1577069F603D30F37BD60A738839A274E99190DB2AB0B676772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343056, "uuid": "90969239-cbc9-43ea-a083-f48c6533de07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343056, "uuid": "cd665070-d703-4aa5-bceb-1af413646d80", "value": "12288:KMrCy90P0pjsaybspttR4RLvxPx6fiWDGuJF249+kr7iWrQaZhTGHosLqhM:wyxo5KttWRFx6Wut970aZhqHoICM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676343056, "uuid": "b991473a-c4fc-4a9c-98cf-531f3381b9b6", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676343056, "uuid": "5f6dfe2e-512d-4875-b13f-b73806890340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343056, "uuid": "1e731a83-bd39-4c4d-986e-70749302df01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fd7f75-ac2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676353871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353871, "uuid": "bfe653fd-7fe1-4607-98d1-f48fdc723b98", "comment": "Malware payload (Amadey)", "value": "3341ed0e629ea10cda9d01b06441fe23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353871, "uuid": "a470ebfb-59a6-4a05-bd78-852327536e36", "comment": "Malware payload (Amadey)", "value": "1b27bd9d675148debee52e5a7ef0b3adb82d618031e4d3eba524267abe57db37", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353871, "uuid": "9ed1ff9d-846d-4974-880e-721fa4d28095", "comment": "Malware payload (Amadey)", "value": "6270e62748cec44db18aaae9421c9a2209cbae5c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353871, "uuid": "ca86e7ea-fbae-403a-9788-d9487a8f4b39", "comment": "Malware payload (Amadey)", "value": "e41f26e8d2de0aa49f7f7e4256a721f16d4b0083a0f97fb00c98217b849197995d9b6a54bf1a19db8c4a7035ece20a1b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353871, "uuid": "0af32e64-f76e-423a-bba6-5cdea24476be", "value": "T1B2F41207FAE88571F8B5977104F203C30A36BDA16A34C68B674F985A1D736A0B6353B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353871, "uuid": "2470794b-c6cf-4fe6-a24f-929b759d5236", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353871, "uuid": "69a9627c-eedf-476b-ada7-65a994deec59", "value": "12288:4Mrdy90Xd4/ZQOinlNI1jaeuQKxlFq4rKZCYElfYsTZoS3Zo/z:ly+yQOoT+GeuQgtrKZCY1W2cZoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676353871, "uuid": "e6b126a5-9bb6-4a81-ba2d-4cc3db6ac585", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676353871, "uuid": "ed8a19f2-d6a5-4edf-a3c5-d841bc3a7f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353871, "uuid": "f33f20be-13f8-48eb-bf8d-ead0b427e820", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc51da3-ac43-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364061, "uuid": "ddf35e91-ce3f-497d-9242-cef163015672", "comment": "Malware payload (RedLineStealer)", "value": "ec5e694991d588141528088544a812c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364061, "uuid": "beeaef38-5ca1-465b-bcd8-8592386f7a86", "comment": "Malware payload (RedLineStealer)", "value": "1b39a76f058e01fb638cc0c6077aeac7c77a1d51028bfc76d9fbe78334423f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364061, "uuid": "369c7eaf-da6b-4eb5-a945-61e52ba3e79e", "comment": "Malware payload (RedLineStealer)", "value": "fd1322f0f753244e7f4f0fe1685c96716ad091e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364061, "uuid": "4ed11c0b-7432-4c32-a7d9-735a99181356", "comment": "Malware payload (RedLineStealer)", "value": "d303ee648f86054258660102a82d1847419982578a86b52655db2760aee166e8ca4f7cf33ab2de8971f743170f66373c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364061, "uuid": "c89d4f27-cfe6-4907-94fa-d1a8049e65b6", "value": "T13AF41207F7E88122E8B463714CF746D30A36BE504668C297275FA96F0C73664A6353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364061, "uuid": "f15b040d-0299-4e78-b125-52fbd51aad24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364061, "uuid": "0454e708-5e27-4050-be95-58e1e17093f0", "value": "12288:LMryy907hpPskygo6RC/DS7avvDfMJHGF//WsGgHB+94+lcz:5yG1hFRUOavvDfwiuM+9Zcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364061, "uuid": "6224095e-b142-42ec-b6cb-6c9f34b7418d", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364061, "uuid": "648b2687-6672-45d3-bc4c-af45516a70a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364061, "uuid": "e101ad8c-1eb2-4fc9-8567-3a14eb27254f", "value": "ec5e694991d588141528088544a812c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec8d1d5-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676386582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386582, "uuid": "b5ac1a63-b649-48be-ba6e-c468a4749bb5", "comment": "Malware payload (Quakbot)", "value": "d8591c263e8cc18d0d11e5f6b29e3c14", "object_relation": "md5", "Tag": [ { "name": "azd", "colour": "#799DAB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386582, "uuid": "23e94a18-611b-4cb5-ba4c-373e0a7c205d", "comment": "Malware payload (Quakbot)", "value": "1b3b1a86a4344b79d495b80a18399bb0d9f877095029bb9ead2fcc7664e9e89c", "object_relation": "sha256", "Tag": [ { "name": "azd", "colour": "#799DAB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386582, "uuid": "6159a99b-77dd-4120-b175-7741fa27acf2", "comment": "Malware payload (Quakbot)", "value": "4ff8e714637d06bbcf684c2350b74dcaf546469c", "object_relation": "sha1", "Tag": [ { "name": "azd", "colour": "#799DAB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386582, "uuid": "5e3e26b9-8eb3-4f66-9227-1ff07dad2b77", "comment": "Malware payload (Quakbot)", "value": "1ef05140f6eeae6f4cef46aa0965bcfcde3bd42a74ac3ecc843adbf67d7582a6c7a6e327b2c7f9968d631af4d37745b3", "object_relation": "sha3-384", "Tag": [ { "name": "azd", "colour": "#799DAB", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386582, "uuid": "9bcff7b8-d6c7-4875-b4c8-3a922829600c", "value": "T18054239D569E34A3D93F0E7AC2A7048A22F44B42CD5C871B1256E56C5CE04F3EF26B47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386582, "uuid": "d83b93f3-f9b2-4203-8018-7d0acda101e4", "value": "6144:liDzyxuT42lqjZ8blGwjcqZiKOgTu4HLcylg0sWgvPIALWQkjuuM:liDzTHlCEEIcqLLRgc+3WQKjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386582, "uuid": "be9b2a61-0b22-40b4-98a3-da7a6572fa12", "value": 288935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386582, "uuid": "94890fcb-38aa-4e15-a73f-62c1edc21b8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386582, "uuid": "62c65525-7e15-4238-99eb-76e1d7142583", "value": "Shared Document From Cloud 292433.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b585da-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676399231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399231, "uuid": "aa3cd3d7-53b9-44b6-ae79-aaefcfd75fab", "comment": "Malware payload (Rhadamanthys)", "value": "9350441aed4906cff927d0bf862e6c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399231, "uuid": "82869760-4504-41b5-86a0-9ce17984e814", "comment": "Malware payload (Rhadamanthys)", "value": "1b889c292805d6d53f2884f560c72ed20ed525db3f2d7b91d271bf8cba24f73a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399231, "uuid": "85aa1254-0bd8-4e7e-899f-1d9cc72609a3", "comment": "Malware payload (Rhadamanthys)", "value": "86e2eee06d2bdb4cfdbfba0fbc10cbcd339c2b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399231, "uuid": "177fc077-b07c-46d1-8e3f-fedfd48f6c6f", "comment": "Malware payload (Rhadamanthys)", "value": "1c6594380436478417452b1ab190b6f5aa1e88144bbaca4cb6fd8bab0d1c582690634cd05f28f9228068a4da3ae30a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399231, "uuid": "514e45d0-bdca-497f-add9-6a0d39f67fbe", "value": "T18C24F10276E0E0B2C46A857254B1D791DA3EF870A795845B3308D67F6E303E19FFAB46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399231, "uuid": "830d695a-a165-4575-94ca-3e98e805f024", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399231, "uuid": "5cbfe328-7175-4eed-8497-80dcd58f8905", "value": "6144:OrWLz5eCKSVsJ/MBly+l5Va5qK7IR8xSL1VX3:OrWReAeJ/klH+5oR8UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399231, "uuid": "1c67a9c0-d08f-4ba7-b86f-480f6f519a86", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399231, "uuid": "34ecfde2-8564-4a68-8ad7-9b704c2deffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399231, "uuid": "a9673e03-61ed-4b0c-89e8-660251b97762", "value": "9350441aed4906cff927d0bf862e6c0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b47f441-acc0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676417822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417822, "uuid": "35d4bad5-3fc5-4a33-a0e0-c7c25350ed56", "comment": "Malware payload", "value": "16ede3e85f4462602bc232bb42e49837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417822, "uuid": "a809f52b-14e9-4d54-9c1a-d148b86f9a0c", "comment": "Malware payload", "value": "1bac45651c8896904303673af68061a71da2d670aed67403c801cc3935dca2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417822, "uuid": "3651a1a0-721a-4750-b8cb-7a2947ac4a5b", "comment": "Malware payload", "value": "f6f391b2b4b9bf063d33df98fb5ecb94513d24c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417822, "uuid": "b59d7efb-5a80-41d6-8778-e7bbbd7b778f", "comment": "Malware payload", "value": "a18912e84790eb70e77e10668757291ee899dd5d1fba22b426ba169e32ad3dd8cb2237e6a922b77ad120c88007604e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417822, "uuid": "dea52d28-f568-4ae7-b814-cc9848dd4a2d", "value": "T14015230791FC4072D4B91BB008F902C3063BBE909A749666578EFD9A0CB7A75E1357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417822, "uuid": "20af2b4b-43a7-450b-8584-18d6b07b620f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417822, "uuid": "c918fa2d-5a55-4be4-8a21-0e7b9e3fff60", "value": "12288:UMrKy905nPbrINGn3DN7rH+JfNsbRMY1IR22fPobWYaKwWS8W++JzCtNP+qiDT3l:Gys7NcStnI1KwWS2qkN2qV801WPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417822, "uuid": "483936b5-0b40-4d6c-b5f7-8870e6d10cdd", "value": 959488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417822, "uuid": "4195120c-38a0-4fe7-8fc2-37ef72369be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417822, "uuid": "2f0a2b76-d749-4242-92f9-0c000791aff3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d296d3-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369304, "uuid": "8d69e622-39b9-447c-be10-d36b0d6dc4f0", "comment": "Malware payload (SnakeKeylogger)", "value": "3d75c851068b356ab025ed3895350fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369304, "uuid": "2c2f77db-3763-4a13-ac43-968ff20fac91", "comment": "Malware payload (SnakeKeylogger)", "value": "1bc6f5ff922d8b26b2e819722fbf20a657e0fbb0e14b90555744383b2c5aec67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369304, "uuid": "d37e9b86-de50-4808-a2a1-710460690d19", "comment": "Malware payload (SnakeKeylogger)", "value": "5500015a77f471e7e3400fae199185f3de659532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369304, "uuid": "9fec7b71-e037-4a0c-aa78-2dadd3d8d765", "comment": "Malware payload (SnakeKeylogger)", "value": "22314a8eaa71c877ba1d19cfaa743a7bf06501547f353b592c76a74fbbd0b3a7f02a1202ea47624f2687ca46c08a15a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369304, "uuid": "72b4ce34-6264-4358-846c-6aac91142dbf", "value": "T158C4125099069783DBC2DD70D1E319BC7F7E39A197824AA7D28262363D073C1A77868B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369304, "uuid": "b2fcc054-659c-411f-826a-98119551a2e4", "value": "db3ba5a38c467c1467d8cab70dfeeb13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369304, "uuid": "11187829-3d9a-4223-85df-87c1f260b692", "value": "12288:lCjuH1KTxj0YvURk9DVz+v4AnhoYWGxBXxcVGrj4W:l4uH1AI1Rk9pzq4uasnXEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369304, "uuid": "38b1b5a6-ea9d-4beb-a8ca-74693da55e32", "value": 551774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369304, "uuid": "314862af-69ef-49a7-b2c1-7509089f33b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369304, "uuid": "e4c329bc-41cf-47a1-941f-f4e670cf897e", "value": "3d75c851068b356ab025ed3895350fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e70279-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364661, "uuid": "8cd5a64e-c5e7-4983-a9c8-1ecc6ee5c5df", "comment": "Malware payload (RedLineStealer)", "value": "4103ec6f4d261f5048bb2be55e34d70b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364661, "uuid": "d6f5e092-cfa7-4767-a57f-c5a0cc761674", "comment": "Malware payload (RedLineStealer)", "value": "1c7c5ce03a60a68effe4997c8d6117eed669d3230e601097e22d99da49d0bcdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364661, "uuid": "2e93ee62-9173-4926-af2a-9af65b2484ed", "comment": "Malware payload (RedLineStealer)", "value": "02b24db9232a446ef3a26263a36eda915c101743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364661, "uuid": "2922ab93-9ba8-45b1-a176-74bc43db7ec5", "comment": "Malware payload (RedLineStealer)", "value": "ddd2593050a66659ce6fb37a94e8f0a0ebb69774fb6a324a9fa4ee8fd9e29f3e0e77a632e21b1dd834a34c79be1e26cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364661, "uuid": "b5c859a8-1e9d-41b8-8b81-b0e4900a27fb", "value": "T132F41207F7E84072D9B827702CF602D329357E619A398747175EAD5E5C732A0AA3237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364661, "uuid": "753d73d0-77a4-4c3d-886e-16dd9336415c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364661, "uuid": "4d21fbd6-8d64-4669-aa9c-3a8b6aa42ec5", "value": "12288:xMrTy90KrboGQdL1fiqznHAaD0vDL6JupLuF4K+KRjUN3PD6QH+LVSmd+XRb:Oyjfo3dLtnHAaD0vDLu0LuF4KKP+QYS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364661, "uuid": "0bdce3d1-9032-4856-afe0-fdbcd6eb243f", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364661, "uuid": "0ccc4adc-14da-45e1-bf93-25b85326df7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364661, "uuid": "9899d2a9-7759-4e67-a641-5cc0c2d61c31", "value": "4103ec6f4d261f5048bb2be55e34d70b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05504d2e-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413329, "uuid": "5f737b13-1a04-4193-bf32-25c168d24664", "comment": "Malware payload", "value": "08f46b69cf3619cca5e5933abf97186a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413329, "uuid": "34742ef5-fbea-4250-9052-453ed1fd892e", "comment": "Malware payload", "value": "1d038e59da667da0f5ae85e5a2f57b876bba6501123c0ef57bd130946754d3f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413329, "uuid": "dbe0af34-f4d1-4bf2-a7e2-5b529cbbbe67", "comment": "Malware payload", "value": "b1e483716cb08cd1a754f2cc0225a6c47a212df0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413329, "uuid": "268edb57-cc68-4e03-9e03-7c2b74f723f5", "comment": "Malware payload", "value": "68ef132f432828645d53b851a469f33d2c33c6b36b33d70f6bd5afc1fff7d2241179a1c00b945ca3024233d789acb994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413329, "uuid": "128882e0-d9e1-4bbb-9ac6-d79d8c411b33", "value": "T146330744EB87E1F4DD0B4C7104A3B1BF83369A569025DEAEE7887917F933A329025F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413329, "uuid": "6c34a55b-9ea8-4707-8d7d-1b78fd7892e5", "value": "1536:3ESIuYNrHXGtK5duFaEfUy31A9nfB2qrk:3ESIuYNrHXG04FK9fkSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413329, "uuid": "b48236a4-f49c-4334-8516-3945c058ad57", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413329, "uuid": "3b676325-fb40-44ae-b73a-762a0f354bbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413329, "uuid": "0e89e387-a94c-4519-9886-165220b81ad8", "value": "08f46b69cf3619cca5e5933abf97186a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cafcc59-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403570, "uuid": "58f7df37-4e8b-4e01-a25d-0042d97d4463", "comment": "Malware payload", "value": "17ccab85dddf1515a8f2c437c29d1aa3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403570, "uuid": "a9f7d1eb-abba-4b7b-ba35-a997cb3a09cc", "comment": "Malware payload", "value": "1e030d236b1e89e149020db348662f4787fd1240bf41e6c619b7fb6747ca77b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403570, "uuid": "25f62417-1015-4914-bf26-7422fcc12d01", "comment": "Malware payload", "value": "838645f5df63bf1e71eb3157a6a55dd7b28e3d98", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403570, "uuid": "b35befc2-9041-453b-9d5d-85e76956fa4c", "comment": "Malware payload", "value": "077f75cb3edfe1e3bec80e33ce93e5dfcfff73c7536985963d35597e2d5ae1f0bb7dbdbc8d5cc0d6c49ba83255928adc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403570, "uuid": "5210cf7b-2714-4651-89cc-d8a85d1903e1", "value": "T1B4E44C416FB99F1BE4CD63B9B47147EBA6B9D0199D8FF72B400528E51E8D3CC18822D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403570, "uuid": "cbc338a3-4418-4e4d-b484-f85a094a3e1e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403570, "uuid": "d1479e63-a858-49dd-80ad-77ffedffa8f8", "value": "12288:o2YS1J/M8oOeuqHZcCeN6R66yTIem96d53Fk5PoMaqMUs:TYSjU87eHZcC2ke953C5PPaqPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403570, "uuid": "fd30dd53-4b00-46b3-8fd1-99d5fadc51ab", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403570, "uuid": "f5b397fc-f86c-4278-95c7-08c9196789f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403570, "uuid": "ece5b133-2a8a-4aaf-82e9-934e9d3470d5", "value": "sample2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acd667d-ac54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676371489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371489, "uuid": "8837af28-4352-42f7-a6b7-f6965ecab53a", "comment": "Malware payload (Amadey)", "value": "0b4e0ff9bb68c7d337df284eb1f318d6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371489, "uuid": "ba68bfed-1590-4ee5-ac10-7800524749a0", "comment": "Malware payload (Amadey)", "value": "1e2ed693393782810af0ab0ea37fd11e27749fedf85451fd0d1abb01bd73bbff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371489, "uuid": "f5cb992b-c054-4a78-b685-242433eb312f", "comment": "Malware payload (Amadey)", "value": "635e9adafd773ed0844cdb8854fdd384d4dc5119", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371489, "uuid": "b9b133f1-b9ee-44fc-a63f-c572717752ac", "comment": "Malware payload (Amadey)", "value": "4c3537dfb1004b29b242b9f5806b92af960d9bf75c071b3a69a5332959da08c4519f58a0508227b0f656c5e1ea4793ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371489, "uuid": "ae1d19b3-6dfd-41e8-8851-c7519186a0d3", "value": "T12EF41207F6EC9162D8B15B7018F603D71D327EA16A34839B274E98690C736B5B63472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371489, "uuid": "4525fa63-19a0-461f-9d79-29f6494dbb7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371489, "uuid": "39fdea91-7c61-4f88-82a1-473e3e005501", "value": "12288:lMrVy90uj82Z99MMPs4v5NHuheoTjExFw4CPJN6PPMLKvvUBXMvnc11/dDarG3i4:8yF82Z99M565NHugCBYpqcvnWcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371489, "uuid": "bde366ce-4f21-451c-91a0-e58c25c9f5f2", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371489, "uuid": "ee146cae-861e-4037-9fa8-daa9b41778c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371489, "uuid": "072729f8-1255-429b-ae00-8d820ef21fee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05c8daf-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382719, "uuid": "431fe1fa-d373-48f2-a5d4-19c6735bd126", "comment": "Malware payload (RedLineStealer)", "value": "5e7ad96227ac97ea047c202bab0a79dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382719, "uuid": "87307068-ec3a-4b57-88a9-80be33c929bb", "comment": "Malware payload (RedLineStealer)", "value": "1e55c8ff6e68cb300f581fd5003dd36f35835d00f9c8938a3a0eb9b7cded4875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382719, "uuid": "6142490e-2e02-423e-9a20-b4b40b0a7c03", "comment": "Malware payload (RedLineStealer)", "value": "700c285600d0d8324660dac5326eaae1b1891645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382719, "uuid": "7e7a4c9e-4a93-47fa-9ebb-326ad409599d", "comment": "Malware payload (RedLineStealer)", "value": "9f8d0faae6af5b0a294b3ce0f6e19429b86c125249d9bd4e76ee8715134240e6a383da93f4e9765df5b3474cce7dc275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382719, "uuid": "533033b5-7563-4fc3-afde-55b008461137", "value": "T16654F122B9B2C171E07785746121E5A45B3FBC726B588087335B57BE6EB07E2DDB8302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382719, "uuid": "8c04b124-dc45-4d0b-aa09-cdb55b4e0a38", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382719, "uuid": "d0b780f0-5efb-4b57-9f8e-097a4491e524", "value": "6144:8ILckcH1d1qagHzEdXMvKc2Wfto47CtdVlb74pnOEyr0n+DM:8IYhX1Q8XMvKc11/7CllPObrnCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382719, "uuid": "9623964a-e0ff-477c-86ef-5caa87bbadef", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382719, "uuid": "f14c9f57-ef4b-413d-b623-613468e72a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382719, "uuid": "bea67221-fa82-4dc1-aecd-fc7f2229a8ee", "value": "5e7ad96227ac97ea047c202bab0a79dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7eab6e-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392911, "uuid": "4d9061c8-6f3f-449c-b6a2-2d64a34525ec", "comment": "Malware payload (RedLineStealer)", "value": "c39e94676096351eb3140e270b76572d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392911, "uuid": "32c6f541-4ee7-4bfd-8e5e-c21b928606f1", "comment": "Malware payload (RedLineStealer)", "value": "1f6a704c47ad9ef1d1a1c77b3321f7c8f2c910bfceb81d85d3af35def4d8c314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392911, "uuid": "d25ffea0-941c-49a6-8eee-d5873cac60fe", "comment": "Malware payload (RedLineStealer)", "value": "d5135162cba8bf99c2313f1ae07fbc3b659dde55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392911, "uuid": "34543721-70a6-4453-ab43-c7aec4a95c90", "comment": "Malware payload (RedLineStealer)", "value": "f5deeb5cf9e633edffa26b11707dde2f77cf335954478fc52453d02b0606e98e1de7e8aa91f0f02b86472d1a31d8b0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392911, "uuid": "2d841df6-f741-4aaa-bcdc-9ea9017e74be", "value": "T1C1A40207E7F89072ECB057B02DF702C31A757E51663853EA1A8E9C5B18321B4B6357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392911, "uuid": "a4fd7d48-44f9-4f74-b7b8-c72e60956d3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392911, "uuid": "30ecceaf-c892-4282-a4f2-34142a5a49b0", "value": "12288:oMrSy90u2oBHBxjKa3CWrW99zKtrMhXZSF:ayeoRBxjKs5q99zQAXMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392911, "uuid": "1fbe80a4-3b25-46ef-be03-6c2190b16f73", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392911, "uuid": "0253eb0f-6612-4a54-8ab4-dd88a3e23e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392911, "uuid": "a82aa51a-9bd5-4f1f-aaf7-3c28aa16d97e", "value": "c39e94676096351eb3140e270b76572d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d4e51e-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399988, "uuid": "a7d1a775-d7ef-415d-bcf5-21db74781817", "comment": "Malware payload (RedLineStealer)", "value": "c1215df9b336b9ead0cd52e2de51eb36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399988, "uuid": "974fb313-4ebf-424b-bd71-e847e144f69f", "comment": "Malware payload (RedLineStealer)", "value": "1f8a211762e1792e2739d600efcde80aacbf62dbb93fae257c700721b186e14c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399988, "uuid": "a84e5058-edb6-4aa9-ad1e-0012a3ef034f", "comment": "Malware payload (RedLineStealer)", "value": "252dffacea1ba22b232e063373ec9a666da7a233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399988, "uuid": "fb2a1787-6001-4131-8ed2-a4fee5d79e07", "comment": "Malware payload (RedLineStealer)", "value": "cc08c690204508449d1325b24a9ea685b3744fddf0b9085a8a844312041b58511891221fb9ac3fa05f42c06332efac6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399988, "uuid": "1194e560-b280-49d7-a759-af5083686922", "value": "T1E6F41247E2E84422E570477128FB07D30E36BCB25E384397279A6D1B18B2BB1A57476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399988, "uuid": "58649c42-5dd1-4c3b-ab27-559c9220882d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399988, "uuid": "ac591a2c-17ae-4344-9d09-0d60191fbc5c", "value": "12288:2Mrly90ODaBRSQTiCzhvPxT2888q5KIPkoPkjaDG/d9WHVL5Dwcnt4EA:vy3KSlsFxT2888q5KI82TGF65DBaEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399988, "uuid": "d5c111c5-129b-40b9-887d-205e51878dbf", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399988, "uuid": "d8d4500f-b0dd-4752-8bc0-bc9496f31dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399988, "uuid": "827e7329-7e44-46f2-ac58-b71692c22d8e", "value": "c1215df9b336b9ead0cd52e2de51eb36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735ccec6-ac84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392038, "uuid": "14c3c3dc-30cc-43c8-abc3-b536e976df78", "comment": "Malware payload (RedLineStealer)", "value": "67b7c46a45bd5d36b820fb5f21cca6aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392038, "uuid": "38dd8322-1772-4bd0-8913-50854fc7a732", "comment": "Malware payload (RedLineStealer)", "value": "1f9bd2dcfa73510c5f0a90874e15d817fbca395a2d76a9789df2703e24b0d6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392038, "uuid": "2e69ecf4-483c-46dd-9212-c9e29b1efeb2", "comment": "Malware payload (RedLineStealer)", "value": "26fb711d12fbc35f9dcb8b63bf2b3cd765b9785e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392038, "uuid": "26d3ba1f-b69e-49a9-9e36-e0edd02c8fb6", "comment": "Malware payload (RedLineStealer)", "value": "f095c2a818ef76e9ac2658e66524532e12f186d96c4def414ec3ce0306732304b6c789ddb9a3948d0d80e5c399915b5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392038, "uuid": "470dd875-c7f0-4086-b69c-419aac9673be", "value": "T1B2B40207F6FD8032D5B457B009F602C30A397E606B3897AB674EAC5948736A4B63176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392038, "uuid": "f7ada2e8-563d-4ff2-bb68-aacf3baeadb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392038, "uuid": "385b4370-8e1c-4a5c-abfb-0a89f23f2ce5", "value": "12288:hMr2y90FaTCLhgMQMFAbL25BL3y7wJnPz5sCnp4gqlcV:3ygaTCLhltHL3y741pXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392038, "uuid": "d1b64d8d-2365-4b4f-b2f4-85c8a39b2aab", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392038, "uuid": "6fa767d4-522f-4067-8230-ff1964228614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392038, "uuid": "d1e1c402-fd6d-40fa-9628-72c3fc21449e", "value": "67b7c46a45bd5d36b820fb5f21cca6aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2457a556-ac81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676390617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390617, "uuid": "4a1a767b-3a05-4bde-9325-7a8cc8e3bb46", "comment": "Malware payload (Amadey)", "value": "be29fcbafd374384c79fdf83f1ad8ea9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390617, "uuid": "3f3b96da-83cd-4516-b2d8-76b6ad22a46c", "comment": "Malware payload (Amadey)", "value": "1fcdc372f8d2dff180b93072d52885285ea53844896f1d08366f4bf59fa8b36d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390617, "uuid": "1c3890f5-c355-4eb4-bdb0-7aa68da10685", "comment": "Malware payload (Amadey)", "value": "8d2fc19259577747471e221875ec24c2279bb8d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390617, "uuid": "da452534-8c18-4adc-9d76-d9f6c560d20f", "comment": "Malware payload (Amadey)", "value": "e7fc9605264d951cdf767f47d502305bd96845d278faf8f8529d8f395f8e1a9b08c10920cd7fb744b37c9b8479fcb32c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390617, "uuid": "c8dffe3b-94d5-4b78-b198-e97032adf294", "value": "T1C0F41297EBE84432E4B4577015F603C307377D61AA78878B275BA99E18B25A0E23533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390617, "uuid": "aad82b1b-d29d-499d-9b51-36e36510e7b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390617, "uuid": "a8f4c7da-ae2e-4f6a-ba04-5c5750093c84", "value": "12288:vMrcy90fqADoLXuCAQNWvuKMD52+05OQLG5boM8UnagDQyInZC9:byaqPLXQvufDU+0k5borpeSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390617, "uuid": "50481979-534e-4970-b146-d8bf04f790e2", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390617, "uuid": "f103dda0-ffea-4bd8-8b5a-0870e2889447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390617, "uuid": "da2178e4-c6cc-45cc-bb70-7a2f31b09b2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4ecb77-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676406814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406814, "uuid": "862e0453-1fec-4b4d-a63e-3df769ff6768", "comment": "Malware payload (RedLineStealer)", "value": "a7d47adead152f09ccdce43297a43889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406814, "uuid": "c215191f-c9fc-4c2b-82cd-9c509215cb8c", "comment": "Malware payload (RedLineStealer)", "value": "1fe28479e42351ecb3ae531321e56803d7aba556c51e79a9c99ae8cd002706d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406814, "uuid": "2853ee0e-01b0-43d1-b800-c04c5750079e", "comment": "Malware payload (RedLineStealer)", "value": "fbbef4811ec40015960f243056102b7d651efd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406814, "uuid": "26d1d07e-5961-4490-bba3-31ff91ab0034", "comment": "Malware payload (RedLineStealer)", "value": "ef357464d45e220d975122fc983322ca5cc7307035a65714a3f72914d9aafa2b8d478d35d2c6b0b509da1b50676b4fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406814, "uuid": "92edb688-c37c-4508-b4a1-d84e9fc2815d", "value": "T152C40207B6EC4421E4B157B099F743C31B397DA15A3582AB378E5D6A1CB26B0B63073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406814, "uuid": "59d13203-f5a2-470e-82f7-5cf63e46f2fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406814, "uuid": "ba0a2a38-287e-4869-8c37-941efdfbf107", "value": "12288:3MrBy90mi8aInDBsRVr97oR0TNlXojaUQJXft+:OyjbnDBs3xRPXojaX7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406814, "uuid": "2b09fc60-8a77-400d-aec1-825066590f19", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406814, "uuid": "8e2fa937-3a73-42af-871a-346baa8d2832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406814, "uuid": "0948f72a-4b52-4118-883a-86c393a75448", "value": "a7d47adead152f09ccdce43297a43889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c081cb-ac68-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676379970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379970, "uuid": "55948961-f0b2-4bbb-879c-4c3faa593664", "comment": "Malware payload (ModiLoader)", "value": "60d3408f8648b93eff24394903b40dd6", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379970, "uuid": "5bb15314-2c4a-4b5e-9a17-8bcea07acdda", "comment": "Malware payload (ModiLoader)", "value": "20a05062d7ed3a7008ec38214cf0231392b8e05b6802b0c66e863710bc82a4c4", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379970, "uuid": "8cc0a991-1924-460f-b934-a445e6b944b1", "comment": "Malware payload (ModiLoader)", "value": "f8b6a48020332793edacba08e0a69d657bbcd363", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379970, "uuid": "559acd91-d6ec-48f4-aea5-ae3d90c2f80e", "comment": "Malware payload (ModiLoader)", "value": "0d498fc64f5bed1a225adb6c9323b6da3a5f6c657f6a8e05f723e0372fc1a977b4414de4d9857c234db325e25e0a6afa", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379970, "uuid": "c03fa814-07a8-4af7-bb72-c2725d111ba5", "value": "T11B44238799EFD91377A00CFFEA5776B35C944199A2830FF6049D10C6F6A3D2866D28C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379970, "uuid": "276073e4-8d3e-448f-97cc-bdac6c484e0d", "value": "6144:oPPqK7ZOsG+mMtNswIaNMAbIi4UXXukTUP0BiIVf:kPboEbswIaN8UeRCLVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676379970, "uuid": "cb9d48bd-22c8-43ce-af1a-7bc9473dd9dc", "value": 268580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676379970, "uuid": "cc9d5fa7-27c9-498f-beea-8d1bf8e898dc", "value": "application/x-xz", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379970, "uuid": "545257fe-982a-4e0d-86ec-3030206c6f5e", "value": "m\u0259hsul siyah\u0131s\u0131 n\u00fcmun\u0259si pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb4561e-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392943, "uuid": "0ead56b6-2c23-4be6-8222-e36e71c843b2", "comment": "Malware payload (RedLineStealer)", "value": "a8d54a925e9dbff0dea8ea303832e329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392943, "uuid": "d3928f21-9cd1-4bb2-bcb9-6c356fbbfe49", "comment": "Malware payload (RedLineStealer)", "value": "20f629f3b10d2d61bd07cc2e0b4cf96e9b67e4f3795a0bcfef085771bd98ae28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392943, "uuid": "1ae89620-821b-45f5-99e3-5b6d22d03480", "comment": "Malware payload (RedLineStealer)", "value": "33b1e991076e21b1f67c22b88e9e92a8be9e5bf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392943, "uuid": "ccffedc6-90ef-4756-b9a7-92c62379de56", "comment": "Malware payload (RedLineStealer)", "value": "85a72082e571905d9723794b88a0ba0b7521254f1857b068023b51ca6454012cdfaa604a454cc84c291ac30b964735a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392943, "uuid": "308bdfc6-0f7f-41fe-a725-a245ed5f8d71", "value": "T1EEF4124BEBE84532E4B4237019FA03C316377C61AA39C38B634B9C6908736F5A67575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392943, "uuid": "99d8ef04-04d4-4c13-b08b-990c1c6767ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392943, "uuid": "02b7d9a1-a8bf-42a4-980e-b859a57f4e67", "value": "12288:aMrRy90UfoqmPv6Mc/w31i5vWMD56V55myyIzzo2moMiUnaBUq/tnU4:Ty7DoS/HjDIV55yI9moJpBUqVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392943, "uuid": "d3242aaf-bd5d-40bf-a95e-b8e3a1cc73c5", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392943, "uuid": "e63d80ec-f8ba-4922-a9f4-55ae17289f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392943, "uuid": "e24b59a9-59c3-4946-a259-0f20c6a57255", "value": "a8d54a925e9dbff0dea8ea303832e329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e16dc4-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419155, "uuid": "d256ab88-9709-459e-aa8d-5cdce212e7be", "comment": "Malware payload", "value": "79f1d2b44a617ed0d1cb53af34ff54a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419155, "uuid": "e533e0f2-e31d-4969-9b89-f4dbea3b7292", "comment": "Malware payload", "value": "20f810d5a9f2bd6f52ab11806e58b10d9cd51f94e0fedc38bd11489fab77eaa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419155, "uuid": "10c07ed5-9fec-4e44-99d7-4a061fead275", "comment": "Malware payload", "value": "7f35781ec47f6f29e9d2fb69c6a21c9ac8cc8e04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419155, "uuid": "1f388820-09e8-4190-a261-3043c8f48bb8", "comment": "Malware payload", "value": "fe5f0dd66522379aa8f809ad22065c71e9dd8ed13e6e896c6c378bc3891732c570a2d248f0fa3fe8766066a5198ce465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419155, "uuid": "d7c56b36-44ad-44ed-ab25-89a34b86018f", "value": "T136C32B377B270A23C0C9047111E31732BAB5D79A38FE5397BAE02DAC6F169843556BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419155, "uuid": "e9f575da-8efa-491c-a3b2-76a7fc6684e3", "value": "1536:ZiH6uSt7X4bsGKNM5gtAthn8thgRChCxLgNyPsmagEP/Ps8cfKi/5:eEBXiKN8AvgChCwIsmagEP/PhcfH/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419155, "uuid": "6d4bb93b-8ae9-4d6e-87b8-e9448a8dded9", "value": 125436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419155, "uuid": "c602d977-0eb5-4712-9db4-37d4962223ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419155, "uuid": "c65d7212-2b05-4f37-baca-883a97fd08c6", "value": "79f1d2b44a617ed0d1cb53af34ff54a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef59b1c1-ac84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676392246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392246, "uuid": "4b4e36d5-0a09-4eb5-a446-cf97f7c4ab3c", "comment": "Malware payload (RemcosRAT)", "value": "00f9d2e3df099a3c87691c6ec81fb2f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392246, "uuid": "78fc3f76-5b07-43da-afc7-5466beffa23a", "comment": "Malware payload (RemcosRAT)", "value": "20fb078a0205ca04adf66dd2250409721698e14e9e1d2590eeff2873265e896b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392246, "uuid": "94fc9465-f414-4ac2-81b2-f46db2d7e115", "comment": "Malware payload (RemcosRAT)", "value": "6b111ba39747bc449203a6d2b83d472fb16f45f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392246, "uuid": "32594a9c-80e8-4208-9871-0964f9b6c107", "comment": "Malware payload (RemcosRAT)", "value": "b99a94f326eddcf38d922635ddce2b378f018b5204c6fdf783e221c95154a772cce2dd222455c9ab9f0b190031282a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392246, "uuid": "af96439f-664d-49ab-85e2-37cd6045a0a7", "value": "T178D4F040B785CC7BC516023388ABD7286374BC58A45E8F17329DB65E6C732DF7A0A786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392246, "uuid": "c574acda-d772-4015-bdde-1285b7afb274", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392246, "uuid": "082afb20-2af1-463d-9b5c-55809122bb5d", "value": "12288:vf1PcRMNqDEDh3wWtM6YcNAUh2zoha+DE+:WuCEDZYIAiSPIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392246, "uuid": "7411b771-6a58-4f2d-a209-be839cd4c590", "value": 629280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392246, "uuid": "a6e1d726-3ce9-41b3-b347-733a878aae74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392246, "uuid": "d7654f0a-2b73-4066-ae73-fae6faafc2b5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f985e8f1-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399565, "uuid": "18b88e44-7b22-4a94-8461-eb532d0f0917", "comment": "Malware payload (RedLineStealer)", "value": "29048c981c31c52de43776b95ff1b625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399565, "uuid": "f3193781-f1bf-4fc4-8c42-7d435e596a7b", "comment": "Malware payload (RedLineStealer)", "value": "218f9f3b023290c067c955b6372cbe21cae39ea1a1d40e50e6f9c98d80609359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399565, "uuid": "5b4e3e64-0e89-4b42-9a90-53d827ea73be", "comment": "Malware payload (RedLineStealer)", "value": "c82b273a13f1e43f25297dd0b44bed26bf05c9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399565, "uuid": "c46866ec-487a-4512-b89f-4bc3d726b377", "comment": "Malware payload (RedLineStealer)", "value": "582ca86c8106576931c5f62f0185154e9775e91fa8084a40ece34009e124833fe5b65659fd182448d33a728e8df0fd9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399565, "uuid": "f9c6166c-0c1b-4400-aebf-31d041f026bb", "value": "T169C40207E6F49432D87113B05CF603D31A3B7D605A3C83AB278EAD6929B2674B53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399565, "uuid": "3ac5151e-4e07-40e1-a130-5d6bbf43e7eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399565, "uuid": "e6c08eeb-8f22-47d5-8e3a-b6a1ace08809", "value": "12288:AMrDy90IO5ssDHD23C28flGXlRtfhLHEUQVU8D:zyhO5luHBlRtfhLHEjm8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399565, "uuid": "81d44778-cc52-4600-a903-f82ac0dc956d", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399565, "uuid": "d23e32de-911c-47a7-94f1-e7536a095c95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399565, "uuid": "59dae227-d9da-45e3-97e2-418d70add0f3", "value": "29048c981c31c52de43776b95ff1b625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c917cd-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676393058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393058, "uuid": "0e63af1b-363d-4bd9-a6eb-b6bb2d09b62a", "comment": "Malware payload", "value": "a19254b86781789758590f3e98898d28", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393058, "uuid": "d60d70e7-ef2b-40e5-a099-4525d3e620fa", "comment": "Malware payload", "value": "219cd952ceb8d1c9ea32e8eecebfe13b6234c83cb71e3375dc3d5f8be9188a39", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393058, "uuid": "0bf565f5-1e56-47bd-be93-04fc89273e6e", "comment": "Malware payload", "value": "ae86ba60b57231acbf6556615d1e6b24f981e9c6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393058, "uuid": "7aa53a3f-6cc0-4307-b69d-e59201445e27", "comment": "Malware payload", "value": "76679876ef560b83da6e81591947b96d0ec96a9556de1e0d69c3eee78da62a467c23dd138d957c6b11d85dbce73e9cb0", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393058, "uuid": "4895dd4a-ee7b-4360-9b83-4f37cd8baa5a", "value": "T1FD35F107F172ED2BDE17C57CE89F24828212AD79AD15CA0E21C3732E4A367B5593EE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393058, "uuid": "7b985e45-2880-41cd-92e6-579b987a1894", "value": "24576:aFegSMdX5UFecxC5hdr/4Hk6acc2b29R7lT1:aQSYnYF/47alv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393058, "uuid": "1333c206-70be-46bf-866e-991465ad3fc0", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393058, "uuid": "bf4147e9-a659-46b7-a444-500a070c624f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393058, "uuid": "71fe905e-c62f-4813-88a6-f9529ae69666", "value": "Inquiry 2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01256b62-acaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676410315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410315, "uuid": "340ba09f-5149-48cc-a5e4-df572922786d", "comment": "Malware payload", "value": "6d65abfbe9322286ee38a8c73820c6fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410315, "uuid": "b861a3a8-ee2f-46f1-b280-fe8dd241bf78", "comment": "Malware payload", "value": "21e1347d5e4a8781de4e8eeed67ff9398c4dbed20f4fe613e7d02e3474bf3a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410315, "uuid": "d88486c8-8f9b-4d9b-bc6b-fbe8407656ea", "comment": "Malware payload", "value": "5c512fd65dfe2cf81a146452e0b860d8eb9f0087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410315, "uuid": "ba8d642f-04c5-4479-8923-80b708f72dda", "comment": "Malware payload", "value": "808d5cc68b3c8efc98c2d75bb602a843d18a0386f39ed3a3a96e8e84d918a1b51ea82b67de37353b2929c920aee8bfc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410315, "uuid": "d2fe7289-28be-4c47-862b-60117be213f9", "value": "T1D514E01676E8C072D09B417C4871EAA46AAFB871B761808B1348D57F6E313D3CB7A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410315, "uuid": "4e425f9a-de0b-4d15-830b-800f657a822b", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410315, "uuid": "3a225af2-07b8-435d-896f-e6f1a161d5dd", "value": "3072:sUfNsYLXA0s5FshbJEoR4LCJsulENZzg3rDdKmCTN16idA:hLQ0gs9ENvzg7LWqid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410315, "uuid": "14e83e58-3cb6-4c96-8340-021d1348984c", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410315, "uuid": "962e91a7-009e-4e84-96bf-a4ce0ddbdae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410315, "uuid": "1a18fb71-be80-4e1e-88f2-2b47ab138e37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f179dd5-ac69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676380462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380462, "uuid": "9c3c5049-0e8c-4380-ad2d-7da18f1ef154", "comment": "Malware payload (Amadey)", "value": "e7aa0702f19c0a44f6c7c49401f04510", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380462, "uuid": "2b196a8d-e6bc-44c5-ace7-48b061a15bfe", "comment": "Malware payload (Amadey)", "value": "2214aad26533b2154273256f7b459112ef73e0188c65b8ed6cf344274580e69f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380462, "uuid": "1c8215a5-3369-450d-9ca0-566f5c4edda4", "comment": "Malware payload (Amadey)", "value": "ab60ac21a888542de61c2642cdf80b2541789983", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380462, "uuid": "e9a51b2c-ae3c-46a1-ac25-2c0a9c5897d7", "comment": "Malware payload (Amadey)", "value": "19a53e3b0f408d101362d1af213b0c948eda7a484394ac049df53b5794d7b7f37114a0a33e0aba7b99ead080bfd031d4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380462, "uuid": "c30248d2-592a-468c-902a-e62f8ed7ef6c", "value": "T18BF4120BE6FC9433D9B187745CF603C31B323EB01639879A174BAC991C72668A53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380462, "uuid": "a2d2d80f-6f18-49b6-91c5-c65ba206c21f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380462, "uuid": "d6c89a22-c8fd-493c-9bd9-7662c1b8a405", "value": "12288:TMr4y90lmpwp7F39tQhIG9oKejdAMFuIFl4lFNP/Kj8AdY+kl1UXfW:vywmS739Gv2AMsflnnDA++kEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380462, "uuid": "ef529f56-05ea-4373-b4ba-2640ea78a274", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380462, "uuid": "1dd2e53e-33fc-47d2-a550-efec76b314ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380462, "uuid": "7a6badf3-c6f1-444a-b708-8ed092b92a8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b318b5-aca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676404466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404466, "uuid": "0bf9b0e6-25f7-4a3b-833e-c3ee361a560b", "comment": "Malware payload (Amadey)", "value": "871863a550b2a973d7efad3b2f9a5581", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404466, "uuid": "1301ad3d-7b6d-483e-a166-819be410c378", "comment": "Malware payload (Amadey)", "value": "222017753e866261557dd2ae5ccbc76283702854a2841ce8a14fdabe3aae3689", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404466, "uuid": "71e13f82-0635-4f24-ad63-76f70db9836c", "comment": "Malware payload (Amadey)", "value": "30b3308cc8de3a307b924aa60914d4d1a132afba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404466, "uuid": "5d40937a-d36a-4b41-ae9a-4be633d58002", "comment": "Malware payload (Amadey)", "value": "92b81c2e0e6d508567341abb18c8f7f5ea84cbfccc7e7197b222a84a1e9fc994f64810419973e9ac01f37e0fc209535e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404466, "uuid": "354a84bb-c12b-4141-93f1-2ab9f09b4dd4", "value": "T133F41207BBEC8466E9B057B468F313D31E363E914E38879A634E9C690C33661E53176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404466, "uuid": "90dfdead-46ef-43be-9176-5f7fe8e76319", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404466, "uuid": "9ec3bd88-b52a-455b-8853-268e7e8daa49", "value": "12288:3MrSy908YpV5LXYjLA6ic1pi2xZJtJHsejFq4oAu2fuVFs+lXo7pWST:9yTMVVYjLAu1ESZJtJHseHoA5fuvXo7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404466, "uuid": "599ffb15-9225-4106-b5ef-6d712cf0ecc4", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404466, "uuid": "f027d941-d2e7-40ad-84db-3ce7e52448b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404466, "uuid": "779bbd4a-2f2e-469a-b9b1-122fd02b1284", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f0d4f0-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399861, "uuid": "ff4b5ee5-e9ef-48d5-9244-bd1b12f46ecc", "comment": "Malware payload (RedLineStealer)", "value": "cbd1a9967624895157677ed3a9e3c17b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399861, "uuid": "ff905743-1c8c-42ac-a6a6-b46c11bbb3e2", "comment": "Malware payload (RedLineStealer)", "value": "222c0a8b5aa876d94d3614dca3591b889090bd9301178cd4ec8baa063cf76271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399861, "uuid": "000e0996-47fb-4fa9-b4c4-1b9f2d875377", "comment": "Malware payload (RedLineStealer)", "value": "66085cb1b55deb72bc21e4d62b1c3e90c3db4732", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399861, "uuid": "345bf273-f74d-423b-aee1-9b8d46816ccd", "comment": "Malware payload (RedLineStealer)", "value": "ed6bae50b8222ec798b1e358df10f05f89dd4513c63092fffb6d78bd2f839bc4636311ada0df93b23e0a1b50f406b869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399861, "uuid": "656dd8af-7d22-42d2-b1a4-ffc509ddf8e4", "value": "T1EBA40107AAF88472D8B467B059F207D306767E611B34825F234EAD1A1CB23F4B63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399861, "uuid": "148ba93c-0176-4258-95cc-ab24634b0346", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399861, "uuid": "a2e0343a-285e-4410-9d85-99e55ba214b8", "value": "12288:cMrmy90qmx9xZiFqo2HGHVfO3cVFPm52WmA:Kyq9xZiFv2m86FPbWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399861, "uuid": "4c86716c-8500-4b5d-8d4b-d538d28b7dbb", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399861, "uuid": "fa759d50-1b47-4ff8-8fcf-015eb1e60751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399861, "uuid": "5e61b942-c760-4eec-8df0-190bdfc18614", "value": "cbd1a9967624895157677ed3a9e3c17b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd9fc59-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403575, "uuid": "24895289-366a-4e7f-a4f1-b570efe9c026", "comment": "Malware payload", "value": "f15eace604c9bef42e1ddf668100fb84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403575, "uuid": "a575cc39-7143-47ab-a04f-7d9a9e2f39a9", "comment": "Malware payload", "value": "223fbab129db18e71b092efa08e160dc9f76eda52f6cdaab1fcce6a605ca555c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403575, "uuid": "a16618f0-0a79-4f12-9ed7-4668b4b2f681", "comment": "Malware payload", "value": "b2905be144eba5cbf88e75d2547a37e8e8ca496e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403575, "uuid": "d7e22218-f2b2-4005-984e-c673751f5219", "comment": "Malware payload", "value": "1736b613429b07543d802abc0795ce3cacfb37c216850b6397b144d340ed49506ed817063bd3a4df3ed2842a5f48fdef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403575, "uuid": "9aa8d922-65bc-412a-b096-7c6aa98a9652", "value": "T139E44A401F6CDE1BE49E17BAA8F807EDD7B4D0D69C8BF70B144228A51EDA3C94D426D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403575, "uuid": "69539585-4b52-4822-aa07-ce04790df043", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403575, "uuid": "5670a502-1e56-4bf8-94e7-7a35d929e9ca", "value": "12288:y60XkI9nOmHeF42UGVWUNsr36pENO4V3AJCxsYUb/CNGIx:yNbn5UUCPsrEENomsYUb/CNGIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403575, "uuid": "d82b5fee-80c5-4b02-8559-e6010255d7d7", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403575, "uuid": "241ab572-50c9-4e6f-9d2c-738d98a21fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403575, "uuid": "c8fddf97-9e8e-4608-9835-b7cbfa25aea2", "value": "sample4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e488ae1-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399788, "uuid": "202a2725-0ccf-49c2-a2cf-c2ef1b407f74", "comment": "Malware payload (RedLineStealer)", "value": "e201bc87800bd037008ba39aa26e4912", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399788, "uuid": "9b4841cd-3c88-4189-8619-98aa4554654d", "comment": "Malware payload (RedLineStealer)", "value": "226f28555dfa043b425edcf748dd969d6c37debf7379aee5b747be7e8deed95c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399788, "uuid": "0b6612d0-d339-460d-b7a3-974886ca6099", "comment": "Malware payload (RedLineStealer)", "value": "efbafafb921396f06ee8ad4ac3da665aa19fc7ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399788, "uuid": "936df324-7f15-44ea-b611-64f5b699116e", "comment": "Malware payload (RedLineStealer)", "value": "fae024bf369166c5855107ef36189e6b95cbd7d539dcd8eab628d7fc7ce6cec5e9cc444d521488bc50fe3fea91eeafb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399788, "uuid": "92dc2aeb-c0c4-4a73-a44d-22740c763f55", "value": "T119F41217FBEC8532E570A7741AF707C31632FD744A389386234B692E1872A60B63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399788, "uuid": "c0d98ce7-a885-4cce-84f2-904d24a67013", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399788, "uuid": "b797435a-35c5-4c98-bddb-b6f69d6af608", "value": "12288:GMrCy90qBRIiOSuqlK+nRB7dAELFf4Cdfr5tkcc5HGpseC1TfYkL:EypBuInv7dyCBr5t85HGNCtQkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399788, "uuid": "b3ebbffd-555e-44e8-846d-50bd1240afdb", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399788, "uuid": "c89e4c4e-bda0-40c0-b508-050bbe39081c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399788, "uuid": "1564909b-0bcd-4321-bf6a-3c35ad755663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e04c396-acb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676414014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414014, "uuid": "54cf750f-09be-4402-bd58-eb8a2fa9ef10", "comment": "Malware payload (RedLineStealer)", "value": "a5d95fe737c7dc81b63c52ccd0dc3add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414014, "uuid": "55b5a5bb-72a4-4621-9c83-20ab565d6185", "comment": "Malware payload (RedLineStealer)", "value": "22af7a9845919e19d396b270efeaa91ebc0f52c82bbf2377ae227d9b420bb397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414014, "uuid": "8fc82df8-f066-42b9-8be6-87ec10060df4", "comment": "Malware payload (RedLineStealer)", "value": "0075fbdb31b06dcee3dfcd91a70b72cb4713cdd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414014, "uuid": "a4d574b2-11c8-4278-8029-cf686a5d8861", "comment": "Malware payload (RedLineStealer)", "value": "d5bb40068c2197ff844c32f4037f52aa16e3216a1883e7ee06424e94dc168a6f895a32f56cd7acfa82c82b3a62594c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414014, "uuid": "26e274fe-1889-446c-a4cd-16a86ea32235", "value": "T18F54F11672E3D0F2E917A5745420DAA06EFEFB7257A3815B33480A7F1E303E246AD356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414014, "uuid": "51b536b2-798c-4ebf-baab-d57f979af802", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414014, "uuid": "83531a0b-3980-43b6-8203-9473facdf8ae", "value": "6144:XLSsYCs1nxswRP58YuyRUHV1OtrlrKF3L/:XessqYu911oprKFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414014, "uuid": "ff736ba8-89d2-4d9e-a099-b77469336df5", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414014, "uuid": "4fe14ea2-355f-4ee4-8266-7cb9fd15721e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414014, "uuid": "05f19a27-c75f-4895-ac75-0e8a5f872ff7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96996e68-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401976, "uuid": "defa7793-c7fc-4614-aefc-256527e6017f", "comment": "Malware payload (RedLineStealer)", "value": "8c5ad959f2ee591829c42d146e8b8673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401976, "uuid": "c71deace-8ede-4437-8374-15ce3a149d9b", "comment": "Malware payload (RedLineStealer)", "value": "23056828acdba798f19473f142a8cf09b98e4df0cdc5afedab991f09697d942f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401976, "uuid": "9ac6c625-4ab5-4421-b347-064e833f4b17", "comment": "Malware payload (RedLineStealer)", "value": "49af8cbf0bdd7ecbbbb5d1852d4ffaeb6aa9174d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401976, "uuid": "7f162da0-ebb3-49ff-bf6b-4b9407b63574", "comment": "Malware payload (RedLineStealer)", "value": "2a71ed6f053b5b54a2b170d19966f0eed2ae926c0a2101ec004308ac53a5b164b74ab094817d6319b0d2abe916df5c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401976, "uuid": "9b618314-9bb2-4568-abff-1e0e15dcabff", "value": "T10FA41207F3E88131E9B5677018F603C3063A7EA19A78878B778E5D5A08736B07A75367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401976, "uuid": "9f408cd2-bd34-4e02-adc2-16e31ad4a22c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401976, "uuid": "193d5f87-be08-45fb-8b9d-0296e0511e72", "value": "12288:AMr0y90RVZAmi+2cR0dj2KcKj9Q9daqkdKF+:Ey8Ami+J0jUKp0ahd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401976, "uuid": "b35e73ad-1e5f-4012-b3bd-b6148de63645", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401976, "uuid": "63abfaeb-22bc-4ea5-82a0-a0545743d756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401976, "uuid": "5075b146-364c-49e5-b542-0a4c1267f6bb", "value": "8c5ad959f2ee591829c42d146e8b8673.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5bfe7f-acae-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676410277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410277, "uuid": "8a1d8502-84e5-4213-9f81-e4ef3223fb2a", "comment": "Malware payload (GCleaner)", "value": "2e3d4efdbe6571f5c4d6ca57130adcbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410277, "uuid": "35be278d-9fb1-4a69-871c-aac7e386cdf0", "comment": "Malware payload (GCleaner)", "value": "2313c24b78fac9dc4a99e0d7707c87183a6f931bfd9541eb037ab830f214acf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410277, "uuid": "6764ce9f-a867-4870-86a4-a9cad0a5ae30", "comment": "Malware payload (GCleaner)", "value": "2501170eb4dc07e1b92e8acffcf8e480c593be7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410277, "uuid": "763869de-4fef-4aa3-ac16-249b8a75447a", "comment": "Malware payload (GCleaner)", "value": "87824e180dba8cc31818d89dc3c7801ca7f955bdacde93cc46afa86953711a1df63f21299bb7beba7056f372f37110b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410277, "uuid": "970fd3fd-bdf8-4d5e-964c-226b7210c48e", "value": "T17AF5127C7105C8ADC280FEB58C2AA4E75CE6ADD3E5E4A46270DD7F3F917D2888A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410277, "uuid": "380f39fc-c1e8-4a30-8efa-588c4938fe20", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410277, "uuid": "b2c84887-645f-4379-a6fc-87bae78a0507", "value": "98304:JHrVxWhwHXrMz8zxwJz8kRmfZR/l1I6V2v2MR:dJxWu9w8kR0j/vVV2vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410277, "uuid": "5b084855-e53a-4ee6-982b-b388a35bc48f", "value": 3352658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410277, "uuid": "6f739ccf-2d83-4456-a69e-f78e82101563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410277, "uuid": "84bed557-db54-426c-8bb2-7d7d81b0a199", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20d00d6-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676372414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372414, "uuid": "5d7dee54-8e8d-4ead-a531-39bce5e77127", "comment": "Malware payload (Amadey)", "value": "a986e72b14386325cef662da19a07bb6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372414, "uuid": "a4ae0405-f0d5-4c99-9c88-4eb781e9664a", "comment": "Malware payload (Amadey)", "value": "2359e5d400f1e8fa91fc3b2c712bb8f8f202fd62c7f4baaf33c89d44a272b488", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372414, "uuid": "8c4e2f4c-2a10-4b30-8e9d-53797cd1c71a", "comment": "Malware payload (Amadey)", "value": "b1e884a0c74e84952b7a39ec538fcadb7777ba2e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372414, "uuid": "2eedcf90-b886-49bc-8668-8c1104bfcbde", "comment": "Malware payload (Amadey)", "value": "cc5dacf1e79ee04d554c4e34c323975117f8bab550d13b0facd4c14a9f0ca6a856083bbb9e6dd4048ad35e7e9d983e5b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372414, "uuid": "ceeca39a-a714-4a98-a0bb-c1a29fcb20bb", "value": "T176F41247F7EC9022D9B5937029F703D30E3A7DA06A349387678F586A4C73A60A635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372414, "uuid": "715e8343-6b29-4ca8-bd83-8f441f8d738d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372414, "uuid": "3a0df4ec-7c9c-4d17-815d-52829252e8bd", "value": "12288:JMr/y903bUBvBSHpAmWuQFpDFl42ZsWKjzXMvlc11/7JemE+bp0:aywUBvBSHCmWuQzg2Zsh/cvl+e+10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372414, "uuid": "89b3f50e-c87a-4fcf-a40a-f6ee1f31edc4", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372414, "uuid": "3e56e8c2-2dac-4235-8a30-8d0aa880c7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372414, "uuid": "5506f0d6-a74b-4349-b9b0-46ca9d168ec5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5779e0a-ac6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676381841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381841, "uuid": "a74cad55-2074-4cd5-95eb-2ba4260e36eb", "comment": "Malware payload", "value": "7d0c7b8d86ef96dc0c2d6f8f42313b3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381841, "uuid": "73ac04d4-b9a9-4b84-a371-f1929fcf4d86", "comment": "Malware payload", "value": "237e04952481043247f013aad2b22a2e398854ca7c329ecffbd8d8e32a135be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381841, "uuid": "2e91a456-a5a8-4eea-b331-9d54d94a30cb", "comment": "Malware payload", "value": "fa5081191a5381cfbf7d4fae4a243812ea9461e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381841, "uuid": "dad82755-b45b-4a35-866a-57ca6fc461d7", "comment": "Malware payload", "value": "adcaafdbe4a82de1a5154da8279449e2b501e4d5f3ee814fef14c9b89e810fd0ac91b124fa07229260d272903420dc05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381841, "uuid": "74d6b51e-cb76-455f-9edd-6ff037a4062d", "value": "T12DA35B1175C18472D57729320830DAB49A3EFD301F60AEAB37A506BE4F702E1DE66D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381841, "uuid": "3655cba8-d82e-4e0b-b54a-d126bac4072b", "value": "4134d85f6b1d0331402268d6160e01d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381841, "uuid": "9b0bef24-e865-4254-ab60-af1174bac2b5", "value": "3072:fl4uZqBztqXqi24XBkFJ1Og9e0DvZFF/OJ:NlZ4MXKWc1V9/OJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381841, "uuid": "76eddd1a-5fce-4b54-9779-bf8ab1103448", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381841, "uuid": "16daf335-03f4-4bdc-befa-6f60a5cca481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381841, "uuid": "2e4ffe2d-7b90-46ec-a42c-2ee6797f3f8a", "value": "SecuriteInfo.com.Win32.PWSX-gen.23891.9082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ae9ab6-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1676381276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381276, "uuid": "298f567a-c87b-435d-89de-66a7d30afccd", "comment": "Malware payload (LummaStealer)", "value": "620d883f30c80ea4122736e37d9e7bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381276, "uuid": "25ab8e20-3b62-4911-b8cf-e61df1ca6c59", "comment": "Malware payload (LummaStealer)", "value": "23a699593b541255bb6511b0f104f49c63b3ded47979b290853bae5d2e1d3351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381276, "uuid": "5b883f52-800c-468b-904d-393f0e61d1d3", "comment": "Malware payload (LummaStealer)", "value": "fb23f292e1478f0afc8f1db23717c6becfb73510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381276, "uuid": "d56894a7-ccd6-4a9c-abff-cd190d250af1", "comment": "Malware payload (LummaStealer)", "value": "cdb18e09ec1dc4ba58bdc5c8d845f914a088b42bc1bf74621036b85b3c6bed27d6c06fc3f532207a6135ee24d3f6aa95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381276, "uuid": "9852fcd8-5f8c-4398-9526-bb3330e9a245", "value": "T11925F197092F6EE6E9012FF5C8E8FD9536C052FC8A27CD656C8044AA874BDD1908F4B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381276, "uuid": "e3ca7abd-0130-4d05-9b87-13e9fc925f83", "value": "53a134541cffd17c4229b4f56d5675b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381276, "uuid": "a29e0755-2919-47bb-b593-bda8dd823b3d", "value": "12288:Py0JsnKCA3OglBAo4fp5W1OpndokJVehku4rLzo4pE8ZrElfrVM5MyHdLCstqst4:a0JsHvcmX5/nd/dLLciELTfinwstEsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381276, "uuid": "0c7f30d9-2bbe-4999-bbc0-3569c6d7232b", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381276, "uuid": "39f800d6-7407-465f-8220-b7c255f2e106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381276, "uuid": "a694460f-cc76-46d1-b2c7-dcc15fa8d892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f875b9-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676364365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364365, "uuid": "10c4372e-c2a1-4e39-8b2b-446ddfd4a500", "comment": "Malware payload (Amadey)", "value": "3be7a921e0a56a302e689e2f3d1fff22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364365, "uuid": "7b32b731-451d-4986-b4b4-4177001f9d56", "comment": "Malware payload (Amadey)", "value": "24039418fadac343e857b633a68d3f7d2e99385a78b709ad84f149712af3f3cd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364365, "uuid": "7cd8f0d4-85c4-4d91-a478-c2e43fc73352", "comment": "Malware payload (Amadey)", "value": "5ccb53bf4eff868abfab086718d3e15a392ce69e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364365, "uuid": "2d32352b-254c-4f97-a6dc-3e83c4cb3380", "comment": "Malware payload (Amadey)", "value": "8f22fb9105430949cdaeefd9d5307a6d01d23070d690f7dfac887fce5ed0f62112c67c1641233e3d77875d67d3e9ef62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364365, "uuid": "6d92ab0e-fb1a-4631-86b8-ee756613bd7c", "value": "T134F41203FAFC8132D4B45BB01AFB03C31936BEB16B218296624E5D6A58736B4753537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364365, "uuid": "0591257e-926f-4dd7-b665-7237c7207076", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364365, "uuid": "71d9a72b-2d30-4572-8b48-62bd606d425b", "value": "12288:cMroy90SPpjVPTPHhQvGJVfGZ0tvDe7JRrufSHXGAkH8Rz0/tAuhRgj8Im/IQS:cylPZVPzHhwGJV+atvDelN0SH48Rgl1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364365, "uuid": "a6332b6d-162c-452a-9c72-5fd24953a4e1", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364365, "uuid": "a41cce99-dd11-46a5-96a9-def35e0e0c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364365, "uuid": "a3c0bbe7-0b3e-4f42-943f-9d827e503c07", "value": "3be7a921e0a56a302e689e2f3d1fff22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e5e706-ac66-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676379317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379317, "uuid": "1ffb7857-8535-444a-ac57-3350f862397e", "comment": "Malware payload", "value": "c539045a5228a62a0f3ad0e3da95a6c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379317, "uuid": "f6a5e6a9-10d9-4119-afb5-7dc5c23a9662", "comment": "Malware payload", "value": "24126096a8b7adfd15043119e0930024d3af648092e6cd43925c942682a5d040", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379317, "uuid": "4d576b5a-f326-4a39-b0e0-2c06bbede2ce", "comment": "Malware payload", "value": "57e4f7336f31ea252998e868868379d789dea3ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379317, "uuid": "fe144843-ed53-4bb8-835d-d27c116ba511", "comment": "Malware payload", "value": "3d96909d569aecf35b81b530699d59119fabcb640ba3257b93edcf19bea59120499e3045651e1871bbcca63def25be2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Shell script", "colour": "#852511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379317, "uuid": "cf5675d5-d88f-4b7c-9690-d75a4631f0cc", "value": "T18F513390A4A169B03E6298DF27245CD031C0D0657C869FF82CF8F4A849EDEC576A43EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379317, "uuid": "2fbbdb4a-ce23-4c22-bac5-00cf1a719ec2", "value": "24:cUMhM4MSbMSMvULpoJee7HHsS0XNI2k0N0zEFZmowd0UFUOurz+HXNedU8aaC7a6:NObxh9LpoJeebkELFUOun+UJJoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676379317, "uuid": "b341f6e7-fa06-4f3e-9c3b-3584fd3bd9b1", "value": 2894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676379317, "uuid": "7392bf18-c5e3-4405-8fd0-79037daefeeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379317, "uuid": "f6c75c18-4e72-4563-a2a4-75fb4740683f", "value": "24126096a8b7adfd15043119e0930024d3af648092e6cd43925c942682a5d040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d9c738-ac17-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676345043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345043, "uuid": "3d91a0a5-b416-4d5f-aa9f-e487cfde42e2", "comment": "Malware payload (RedLineStealer)", "value": "82c0afbad335ccdb2cc7720348a03ae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345043, "uuid": "6529a315-6ee3-405c-b02e-5136e96408b2", "comment": "Malware payload (RedLineStealer)", "value": "24a4a6d1e740940e98b5367c82cf944487b76bdbfacbf7df403bba7471910a74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345043, "uuid": "55e6950f-5f7b-4870-b134-f9fcc10263f1", "comment": "Malware payload (RedLineStealer)", "value": "5642c50a2b263e622fb9633758db6a5e1787be00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345043, "uuid": "b4ee8413-3574-411a-baaa-796571a055d1", "comment": "Malware payload (RedLineStealer)", "value": "3b5f1effb4bdf0cc60888ad9d0c2fa932016a052fc0805400ef14d80bdf753793d59d3b04e34ca3dbb40a567a2ed9915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345043, "uuid": "b20e2bc7-f642-4aab-87b6-1056446d1875", "value": "T1E3F41207E6FC542AE8B197702DF602C31E327DA16E34826B674BAD0A1C72674F53476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345043, "uuid": "e1fc8cc3-bcf3-4c81-a6e8-5b28cccc786d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345043, "uuid": "1063ec1d-19c6-454b-950f-f4778c311703", "value": "12288:lMrfy90dW654xUFQm8/8XZUzgF14teSwEVceFufzyPtAulngqoF4w:Oy+/5ZFRo4ijteSwSFufOV5ngqg4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676345043, "uuid": "7875d6ae-e2fb-4b46-9ac4-14d9b58e4c24", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676345043, "uuid": "93958b4b-2f32-42c3-a891-b144bee34f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345043, "uuid": "05aa77cc-4404-4c26-9ecf-ca1f5401d016", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e6b10f-ac90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676397358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397358, "uuid": "cbc871be-12f2-4d64-baa0-1adb14f64659", "comment": "Malware payload (Quakbot)", "value": "891266292ad96bcb125c50852a63b5d6", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397358, "uuid": "a7ddc740-455d-4499-936f-cb26747d0a01", "comment": "Malware payload (Quakbot)", "value": "24a77f8bca1eb72556e1d9f1eeb2568a2d5c27a0a686d3c8e0635aefc7723144", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397358, "uuid": "6fd54704-0293-441c-9aeb-9d142c115b62", "comment": "Malware payload (Quakbot)", "value": "5009cd6a019c4e0c489aeb09fd21dc2e13f0c65a", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397358, "uuid": "0ec8612f-715a-483c-acc2-897d9cd81dc5", "comment": "Malware payload (Quakbot)", "value": "4b2cf2f8cf6a6721c1f86925633396544d295bda0c3346d0991281608c21ccaa94430e214b37ee5940222b95b3d8caaf", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tok01", "colour": "#0C0837", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397358, "uuid": "b30e798d-dc15-4552-8d3e-b7044b41bb74", "value": "T1E5D39D242AAC4367E3BA4F32C6E54D536575EE52BD504F2B669222894CA1F00DC32F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397358, "uuid": "1433995a-9c95-4524-a19b-b5d964983ad0", "value": "3072:fcf/NyHtYoIdMq2W/sdRoVu+gbt/ej91+TaLCG:0mSx2Wx+5mj86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397358, "uuid": "1fe6c43b-d19b-4666-9746-c2be05b4aa3e", "value": 140784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397358, "uuid": "90b2a0a6-737a-474a-8ae0-b7c91fa340ab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397358, "uuid": "365595ce-3e71-4d88-8b75-ba4bd72dfead", "value": "Feb14_Doc-682249.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89c6882-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419186, "uuid": "772e7b00-fe94-4acb-af2e-75d1b826ef96", "comment": "Malware payload", "value": "34f600c6139a9bf603168a986cdb2eb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419186, "uuid": "837dc9a6-2be0-488b-96e9-e5ab27fcc522", "comment": "Malware payload", "value": "24b3494f2822f38f51c354f16520d75f85cedbfacd46b31fb5069466c79c24a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419186, "uuid": "4495fd6a-2d15-4e76-8b0c-400799eaf19c", "comment": "Malware payload", "value": "5a6e5a898b9677e0f42afc132f4c0beae8f40b7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419186, "uuid": "a342e530-7228-45d2-ae3d-ca8bebb819d2", "comment": "Malware payload", "value": "edb6a51b3d3e01674641f3f579b64f93f6cff5a89bd3b06592e377ee99dd3df11c291d1210c859ec0ae41674b8b56568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419186, "uuid": "9995ecf6-b939-4823-81c0-e17c8c306acc", "value": "T11CB3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419186, "uuid": "560bef14-059b-4fdb-8f45-190f95aede5e", "value": "3072:C/4g3Kd1r85hZmxgA9OKdwwjF9GhsR1Ae:O9an85hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419186, "uuid": "96f8eb15-c29e-43a7-97de-15441ec28403", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419186, "uuid": "80c8b46a-fded-49c0-b8a1-bbe9f6b890cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419186, "uuid": "f29f877f-06fa-421b-b066-ed67859cfae0", "value": "34f600c6139a9bf603168a986cdb2eb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3181d7-ac91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676397768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397768, "uuid": "9817ae12-46bc-4203-ad63-596e498f8953", "comment": "Malware payload (Smoke Loader)", "value": "a79881f12b76c51e02686cfd22349dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397768, "uuid": "2d0dfb33-3e7e-4cb8-b1ae-c8e2e5ad9ea8", "comment": "Malware payload (Smoke Loader)", "value": "256018ca89a222d1ee43a7098ada88e3119696d375b1474a0f1667169c20ccd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397768, "uuid": "c50788c7-b7d4-4f48-b0d9-beb9f02f5111", "comment": "Malware payload (Smoke Loader)", "value": "1527f0da0837f77545ff3b33f170f35bed817f22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397768, "uuid": "e010307c-a14d-4bcf-86c6-79927524dec1", "comment": "Malware payload (Smoke Loader)", "value": "5bdaad16f028ef8e5463440f0d103052000acd3f3f4dc55ebea15e53e18d2ec3685a4a7b4d8997a497fb760a21d35626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397768, "uuid": "4c6d58ef-0cda-41eb-8b46-09c5eb611dc5", "value": "T1CB14D12139E1C0B2F51B8D745920E6B0E97EB83297A5855B3348D9AF1E303D1877E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397768, "uuid": "5a88999d-bd61-4031-8f0e-35b2348b839c", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397768, "uuid": "db58a0f8-e02d-49ce-916f-7290871a544b", "value": "3072:BUkRLUXh85VcPkKw7TNEQr2nVyBhAzZhJhbA2iHa:lLEh4cPkj7T9CVyBKzhhb9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397768, "uuid": "46f9e7ea-4182-4539-8d76-e3d58b2fe589", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397768, "uuid": "614bc433-eb4c-484f-8585-ecb0da89557a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397768, "uuid": "42b56a1d-6c14-4165-a077-856969e4f935", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "975c50fd-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676398971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398971, "uuid": "d6dbe836-bf6b-42f4-8e40-db724ac3460d", "comment": "Malware payload (RedLineStealer)", "value": "78433f585f6a4cb98dbbefc4e34157d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398971, "uuid": "2642621e-3242-42e9-8462-1e8d945b8be2", "comment": "Malware payload (RedLineStealer)", "value": "2595a4b202c5ca535962ba616ce907f811683d934cf00b266106860ddce00faf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398971, "uuid": "8d0a46d1-8538-4107-88f9-938d747e8075", "comment": "Malware payload (RedLineStealer)", "value": "da824d8c499b09473701248d78860a715bd0fb2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398971, "uuid": "7f9e20bd-041e-4151-91a2-4ea7ba82b792", "comment": "Malware payload (RedLineStealer)", "value": "2ba8ae3bd5062fd36c2d0a8be9d5a92afa3635629cb457a903ca53016305ab6f5c6a6e69dc663713b822962330a418c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398971, "uuid": "749a76aa-a132-4345-9327-81ddb95e7f03", "value": "T18FA4020BE7EC8022E5B4577059F603D31636BDA09F38539E124BA95A1CB36B4B23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398971, "uuid": "ec104ec4-e5ee-454a-91d6-2cfde39ffb13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398971, "uuid": "10e35e94-d0a2-45b0-82f6-507fbeb3c449", "value": "12288:2Mray90gQ1VjXdspiYuAdi48ouVDKOlGveajt2/F0czj:cyxAdYiYuAk481NK+Qjw0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398971, "uuid": "dfd6768b-93ee-4382-af27-1807157092dd", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398971, "uuid": "e5c1658b-147d-4800-85cb-fbce7d84d0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398971, "uuid": "febbb14b-a505-4150-abe6-99b76b8b622c", "value": "78433f585f6a4cb98dbbefc4e34157d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb23593-ac6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676380912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380912, "uuid": "bee28503-8ac4-4fc9-bea8-a0340f63f9e5", "comment": "Malware payload (Amadey)", "value": "37aade13e65b02012c40d18261ff424a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380912, "uuid": "3f55825f-5bec-49ea-a564-062d471dba19", "comment": "Malware payload (Amadey)", "value": "25df13369d8f2a374580a39dfc91d0cf16e6c1ef4c98f70c284450116df6c0c3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380912, "uuid": "5ddc1e03-8efb-442b-8696-fb97981dcdda", "comment": "Malware payload (Amadey)", "value": "050cc9b6899bd1ba4ad7303d287be3f9cf6c642f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380912, "uuid": "a4ec03c0-2a04-4fd8-9acb-ea2a17e58f69", "comment": "Malware payload (Amadey)", "value": "5cea7143d309d679d454320fa03b53734addadb5dc185f435f2a748f1796c8f1e7bfddaaacf48e7c3ef6d1a368c9b391", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380912, "uuid": "98ed3707-8902-4b1c-aa87-20c814b1fb6a", "value": "T123F4120BE3FC5536D8B287700CF107D319367EA05B7886AB2B4B5C9A08B3664E57572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380912, "uuid": "03fa2bed-362e-48ae-8033-259518d40b3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380912, "uuid": "4f2f20cb-6803-4b8e-8a14-aac2b3bf3896", "value": "12288:RMrky90sdYi8Fz40v31+jbt3G2HITTFq4C1e17jLxj8AmKMGRbv/F:Zycx40/kjbA/7CM7GA5MybvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380912, "uuid": "52ede850-61eb-4483-a908-5b69b83f9a18", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380912, "uuid": "986391ab-9f67-41ed-96a8-608f49ec72d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380912, "uuid": "258a5238-0bba-47e3-9556-963aef83551e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8fbb9c-ac16-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676344700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344700, "uuid": "50c72dfc-c240-41ee-874a-978886c473a3", "comment": "Malware payload (Amadey)", "value": "18a0d709bb2ef310b4bf136dc9694474", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344700, "uuid": "29f94758-90ae-4be0-922e-22ae1dde49d8", "comment": "Malware payload (Amadey)", "value": "260b044f3a677fc7b816b616c3fe9182e19f23893c64ae652f9e25dabde970d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344700, "uuid": "881d2a32-ed61-4984-8abc-fa732acb4743", "comment": "Malware payload (Amadey)", "value": "83604bb7be5b76aff9e4e3e00c9ea9c0ea5bcbfd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344700, "uuid": "544ceaf0-2815-4626-bd02-cf209d61e391", "comment": "Malware payload (Amadey)", "value": "395665d26c4c32255f0c23e418a19e9f658c1aa4f6606a03d0257d0fbfb14fb4a04c12cbc992060d7e20a39b9c677077", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344700, "uuid": "c786338c-0a2c-448c-938c-5d6e8a6b2ee5", "value": "T195F41207F7F80125ED3127715EF643D306337EA02F38825A564EAC5A18B26A4B9357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344700, "uuid": "eab53d26-b559-4627-92a8-4e357d88dd73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344700, "uuid": "7c7b16c9-2457-4813-997c-d313ceeb6efd", "value": "12288:gMrIy90QcJ7yX+hm2ZRHeCtz5R1Ff4mqmP/5RrxAzlrtAuoIgc7ScFsm:YysyW/nP6mqmXTrxAB5EIgc7im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676344700, "uuid": "9427ad65-00ba-4a15-8839-d9d0121f7a56", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676344700, "uuid": "74bc4b65-77ee-4ac7-a1cd-92b8270f5820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344700, "uuid": "6f632a4a-521d-4094-bf93-535ddf27af26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09896fb8-ac48-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676366091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366091, "uuid": "3ec91d78-2597-45ce-8f4e-4a3e56d9ba73", "comment": "Malware payload (RedLineStealer)", "value": "b464a88a24642c89da737b90b287d075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366091, "uuid": "0ff8aff9-d708-4a49-97f9-dd1223f98c3d", "comment": "Malware payload (RedLineStealer)", "value": "262b22a81a33eb659ffbaa8071c697753d5154d09443c74a8ed4ed6d1cdf7d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366091, "uuid": "0ab9085e-14d9-4f74-94ca-d3559792881d", "comment": "Malware payload (RedLineStealer)", "value": "c9fe65809811d7426183e3cf18142c7a551ec1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366091, "uuid": "00292bc0-63b3-4bdf-a24e-53f76e497011", "comment": "Malware payload (RedLineStealer)", "value": "14ec855cff6c3fcc46c7e32d1fad116d118f4b68fdb49065c014402aeb163e4f33eece5c06ee1b98cd95a130d495f0dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366091, "uuid": "65315a1d-53a1-40a1-80ae-baf2830ae982", "value": "T1F3F41217E7E88061E8A2537059F603C30E367EB1673CC39B664E5D2A48736B0E5357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366091, "uuid": "4f29cc32-a18f-407a-af6e-12a89ba946d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366091, "uuid": "f30f4483-2e9e-4601-9c8c-e9c922d16bba", "value": "12288:XMrZy90eD27SXK/YNbx5JC44CZwP8FL46ki9dk8iXe7rtq7shzWX8BM6:Oy8SXK/0xKB4Kd6kwLL7Rq7wWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676366091, "uuid": "38048485-2941-4f70-9f5f-0f514625f290", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676366091, "uuid": "fa5d14e7-3f3b-4a05-9e74-bde49087ac67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366091, "uuid": "3252bf9b-d2d2-46dd-9fe7-604f3275ce2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c7928-ac07-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676338388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338388, "uuid": "d367206e-28de-4701-96aa-16365d72d1a2", "comment": "Malware payload (Amadey)", "value": "8e831d9dcac8e2427644b123c1d4ea2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338388, "uuid": "febc137c-e290-43c1-960a-e94b41a0844b", "comment": "Malware payload (Amadey)", "value": "26442f12b37d575dfe587e118386d853d0a2b16e07135d71d1269109f5ab6c07", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338388, "uuid": "57456750-c8b8-43c7-9880-9c3a75f96821", "comment": "Malware payload (Amadey)", "value": "2cf73e5f87cb5136d03dbcfe56f1b4d7893cce94", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338388, "uuid": "2082587f-0b10-4755-8043-1866cb752549", "comment": "Malware payload (Amadey)", "value": "1e83ce36ae17004eb8f2409247b0764ecf9c805ce41e3f1d93b3fb93379cc1ad74a7ea3cd1b109942a663a75c1bcd527", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338388, "uuid": "8542c99b-7056-4448-bca5-c1d123d10935", "value": "T160F41207FBF84072D9F4577028F507C30A3ABE605E74C647275A6C5E1872AE0A6367BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338388, "uuid": "73b92618-b31f-4802-b66c-2aab2558a1e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338388, "uuid": "0dd5348d-6549-404a-83c9-d32d0ef244cc", "value": "12288:BMrBy90AZfVCRUVCZHwdd0e5hBAtRd9ejqLLpMwgnbmZSUGsKbORJPNVPD6QxaBb:gypkSVCmQevWLuY7gbmSUGsKOP+Qx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676338388, "uuid": "39edcaf9-d6f5-45f4-9dc1-0fab861f5c55", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676338388, "uuid": "35b6110b-3b4f-4fab-8a81-18b8fca373cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338388, "uuid": "d2edaf07-3a70-4af0-89fe-965ca1c9bac5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68dd7aab-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676381283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381283, "uuid": "d19491a0-31d7-4f5e-a78a-f9bc89f62808", "comment": "Malware payload (ManusCrypt)", "value": "1310b14202d951cfeb5a37256cb577f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381283, "uuid": "595f37c1-dd68-4012-9888-a0b8150041b9", "comment": "Malware payload (ManusCrypt)", "value": "2658e2d285ffb7dbc4d084728bcb65a537fefe900eeb07a10b42f3c61291ce2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381283, "uuid": "8928bb6c-3498-4469-9abc-266ae6dda0e8", "comment": "Malware payload (ManusCrypt)", "value": "8372ad9ceaf4f386bee6f28d2686f44598b0e422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381283, "uuid": "dd702ebe-90ec-4564-8a4c-2a6ae1ecb044", "comment": "Malware payload (ManusCrypt)", "value": "75fc784fd195c86f99525d77d5f42ec2718177c7e289b16a1cee0ccb38cc29da3c6805efd8be804f4dbe4e5ddb701a31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381283, "uuid": "26404df8-8cae-4129-8399-4a9951667653", "value": "T146649E1133E1C83BD5A311334E53C799B6B6BE51AD36424B77D03B0EAE70182DA39B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381283, "uuid": "3a0c0237-1ee2-4c83-8c2c-47331518ab9a", "value": "bf60666e24b254e53946b3d3f367089f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381283, "uuid": "650d0734-fba2-47eb-9985-b2114d9d6bb6", "value": "6144:IviyYPpr8AE0W0H2Xe1L8AAXb25160uYR+kMEPD:Ivh0W0WX8L8TXO60uYRKEPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381283, "uuid": "4228bd8e-6cfb-4d8a-89dd-401b08934e81", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381283, "uuid": "5b8d741b-d1e2-4f0a-b229-c97757c38338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381283, "uuid": "5f4bc3fb-60a9-4bab-9ad7-222ca26353f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a62fdc6-ac54-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676371273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371273, "uuid": "db1c8ee8-cd1f-4ee6-8709-f7cd5fb98924", "comment": "Malware payload (RedLineStealer)", "value": "f0229acbb0eed3c6bc421f91820515ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371273, "uuid": "378aa341-5c48-4601-a117-1b7aa1206061", "comment": "Malware payload (RedLineStealer)", "value": "2726cd59cd7fdf16133ba90710b773b5c4a98f12f8f74942d63ad84ff1bd96a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371273, "uuid": "cdeeb529-e177-4e5a-8fd0-5c64d784e2d4", "comment": "Malware payload (RedLineStealer)", "value": "590825cfa9b51afed4c1adcd5f52c0ca2dbec2f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371273, "uuid": "22c3891a-338f-421e-9e9c-9095f5e37b82", "comment": "Malware payload (RedLineStealer)", "value": "0c398019d45bcff0ef639d5f77376bbaa47daa35c3428577b186e464d01c58fd586dd92520d81f2879e4ba936dfd6bee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371273, "uuid": "83464a91-e6f0-49cc-98ca-b2987fd6699a", "value": "T165F41207BBD84122E8B95B7018F703D31937FCA496348352678B5A2E1DB26B0B57937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371273, "uuid": "f150ce50-4c18-49e0-90f6-a77eca561d69", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371273, "uuid": "046702c8-6547-4c26-8dda-6a74e31b7546", "value": "12288:KMrTy90Em005YbcZBA2JdFJ4zqBPg43RvDWMJSbPfLE2PPbzrHmRGvL:hysbW4DAQdFJ4z6Pg43RvDWwSnbLTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371273, "uuid": "ba290db0-5366-4838-b836-c03f0c63cef9", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371273, "uuid": "92c6762b-f535-4a38-9f9d-5ad624027bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371273, "uuid": "6f39c23e-3368-41b5-84ec-48455abbb2d4", "value": "f0229acbb0eed3c6bc421f91820515ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc1fcd1-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676392730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392730, "uuid": "c5bb22b8-330c-48f4-b944-05ff9ad2469f", "comment": "Malware payload (Smoke Loader)", "value": "8b40e7a07a2472eed37557abde7fc958", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392730, "uuid": "b50638f3-acfa-48b4-afc3-81d873c96bcf", "comment": "Malware payload (Smoke Loader)", "value": "274d76cc5803e8fd71f122659f2d0498ae4a85abeb201fe960bba4354975c426", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392730, "uuid": "d6f0f4ed-b292-4adb-921e-73efd73c0b90", "comment": "Malware payload (Smoke Loader)", "value": "93da981f17c665a169b0e8b9953c66ed0e1d9c1f", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392730, "uuid": "460f3f3d-d01a-4bed-857e-7a2c5e0c8730", "comment": "Malware payload (Smoke Loader)", "value": "06ef9b6cc3074a18240384a78f7317f4e67382e1a1408726367b753333fc51312f103633fa428af5b35b3e3c9d5c5ccf", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392730, "uuid": "5af0c50e-a08d-4476-bf0e-ee4266f57c65", "value": "T1FD04CF127AA08073C06785741421D6A05A2FBC7277A8FC5BB3580BAE2E316F19E75F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392730, "uuid": "5609f2ec-9c25-4e7f-8a1f-522718e61093", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392730, "uuid": "71eb30e3-6eb7-40e5-8580-81d42e4b7a98", "value": "3072:XoAGL5CU5nLnFVex9CVG2E+31oyt9KXfO8t+2xGRakNuara:4zL5CCLFVexqGB+ayjKXmF2xqVNuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392730, "uuid": "6cb8e111-8140-4e4c-aad2-ed7a100f8fd7", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392730, "uuid": "cd773aa0-6ad7-4b54-99eb-570689518f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392730, "uuid": "e5fd9bc9-d846-40b6-9dad-c23ec07d9f77", "value": "8b40e7a07a2472eed37557abde7fc958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ec0ed1-acb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411592, "uuid": "a9fbe6f1-1c31-4b9b-a9d4-c653383fc919", "comment": "Malware payload (RedLineStealer)", "value": "b54a14ce7774a7cd6b6bdd7c49c28e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411592, "uuid": "026666f9-84c6-4045-b042-8fc89b048e01", "comment": "Malware payload (RedLineStealer)", "value": "275db2bbbd631acf176a14e1830ef2c2bd6037b888b17a291aeb38d4810b0648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411592, "uuid": "29103b28-3145-40db-a0fc-6c6ec9c8f4d5", "comment": "Malware payload (RedLineStealer)", "value": "f53bdb3899ac62a2364e79edada2d65dc078900b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411592, "uuid": "32b6247b-6b81-41aa-bf05-270ac172597c", "comment": "Malware payload (RedLineStealer)", "value": "11651d8e055d6d24d630b6b73c05450fdc334638db2b36ae7270bd1aad8c48b432e52813c6ba808df4773ac032770cb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411592, "uuid": "18693a08-df27-4709-9edf-8be53a8d0957", "value": "T1CBC41257B7FC8032D571977019F607D31A367DA16B38C3AF534EA85A1872270A2327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411592, "uuid": "648b9704-78e9-47d8-b1d6-b569b0891f38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411592, "uuid": "0237fef9-1ca3-4f1b-97b5-ecd3700e46a3", "value": "12288:aMrhy90YZXgtVelIPsfXanZmwNE0W0ZI/FC/UXkUmGas6za99Q:HyzZXoVDPsvanZm70tGOikUmJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411592, "uuid": "0497b2c4-c5fa-43fa-8417-c4439a4fdcba", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411592, "uuid": "3a6952cc-76c9-4e93-b03f-7d34e67c17dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411592, "uuid": "ce0a64ec-be42-4e42-8dc3-6e0d997b1c83", "value": "b54a14ce7774a7cd6b6bdd7c49c28e7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606f3473-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676359365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359365, "uuid": "ffd229c1-136c-4daf-9512-497fa688aaf8", "comment": "Malware payload (Amadey)", "value": "f0c65f8edbbba0396af04f4828cc030c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359365, "uuid": "c6ad382b-e596-4973-90e3-46a59bcdf31b", "comment": "Malware payload (Amadey)", "value": "27868158f1ba31f506510c3ea8911f8e416b1f782452100f66163244d5733273", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359365, "uuid": "e50ddfdd-5354-49f6-a0c2-98dc8d4fbbf6", "comment": "Malware payload (Amadey)", "value": "86280e25426f8ea7b8be9e0dfb2aa207da4f0a6c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359365, "uuid": "784f395d-cebc-4962-87f5-99fbce6a3c60", "comment": "Malware payload (Amadey)", "value": "6326bfa80d6ebef241243405edc09dc00790aabcf5e4301a30f4e60968cb4cb1c052ecd9f74ed37577bcc46bf42251ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359365, "uuid": "276e3c61-83dd-40f6-b396-92518f90db62", "value": "T1BAF41207FBEC4465E8B197711CF603C31A33BDB19B39866B274E6C590CB2964A63532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359365, "uuid": "93f9ea7c-17c3-4094-a261-6b1f9310c7d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359365, "uuid": "2fa65d88-d736-42d4-b5fd-7b35af809781", "value": "12288:DMrzy90Vwtmg3Bd3R118506E99Fz4o3dkbzS1O289LAcMe:MybtmURrSE9go3z1Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359365, "uuid": "e038609b-a87b-4fa4-8d0b-87824179a6c4", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359365, "uuid": "41e0ebc4-1489-447c-99df-1dc1640a4c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359365, "uuid": "168a1c83-f465-440d-95c7-69e039a977ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f56809-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676399072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399072, "uuid": "fba56ca4-8074-433b-9552-28b5e95f1b25", "comment": "Malware payload (Rhadamanthys)", "value": "37db5181e973d4d7f9c44ff2a2b80f01", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399072, "uuid": "d71e7d81-afc2-4947-8b5d-acacae5bab86", "comment": "Malware payload (Rhadamanthys)", "value": "27d3d5fe5fba171eb2244f07692441be38c7308507b446977a377bff17bb5904", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399072, "uuid": "bf4f5565-04f5-4093-9893-470f9b3874ca", "comment": "Malware payload (Rhadamanthys)", "value": "1e4d62ddeb63fb6402efa812c59ab3a787282d6f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399072, "uuid": "10da37fd-eb2e-477e-9c51-15953c8c84df", "comment": "Malware payload (Rhadamanthys)", "value": "a9d2aa1cb4cc87bea585e40e289e71b7f166e71dee0164128d2a0e170388e80451c675ae2993458dbd1a7a81a7b98362", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399072, "uuid": "9b652eff-ffa1-4e96-ad5f-1a5efc108c8b", "value": "T14475DF8536723CD6F6514279166A4BE7E9200053BD722AA7B2E7D1D14ACE36C7F3A033", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399072, "uuid": "d7fc1d57-38a0-4388-8433-9bda296f17be", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399072, "uuid": "e49f8de0-f447-46e6-98a4-a5efc2f0cafd", "value": "24576:+fFQddjdaB8OWqN0ujXGEJUuLp2avBh4kUaOY7zEGOmth0tgo5fnv/:+tiG8OjqujXx/LgavBSkUI7yuh0tgk/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399072, "uuid": "07417587-9581-4717-b689-d468f1abbeac", "value": 1594384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399072, "uuid": "0830b29d-5b6e-4214-a69b-df9e1b52c7d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399072, "uuid": "ccf476e5-1a2b-4458-99d9-758fe37c7e38", "value": "DHL Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8dbc56-ac31-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676356245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356245, "uuid": "26e83ff1-2191-4de1-a588-13a10ec5fe4f", "comment": "Malware payload (Smoke Loader)", "value": "1f804a64c85d1ea1058eb5eaa591361b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356245, "uuid": "51d864aa-c790-428d-a77a-a9d0821230c9", "comment": "Malware payload (Smoke Loader)", "value": "27f8d16236a44fcb42c8b622e24c6aad1b27f014994fe3dd4e40a3a08b561ee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356245, "uuid": "26f144e9-88b2-4efb-831f-adbc45fa4a7b", "comment": "Malware payload (Smoke Loader)", "value": "f55f39a2bcffaa68242ac5c3677ea4c3d5c1d99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356245, "uuid": "cfccc1ed-8ce9-44b5-8dfd-6493554237bd", "comment": "Malware payload (Smoke Loader)", "value": "a3e9ba745e17a0d4c546aa6d8d4123821fde4cfbabf7dceccdfaa042ae510e05397d67a0ffdb25bd0b5816981ab0c30b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356245, "uuid": "49472aa9-aba8-471f-a8b7-b9a0ad189f83", "value": "T15604C03579E58173E06785B0E430E9606A7FB8B27FA5808B224C1BAF1E303D19E7D756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356245, "uuid": "eb62ea43-4b3a-4bbe-a1f9-0f720f5cf689", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356245, "uuid": "0b87c000-7756-4159-9be3-8098a4339b39", "value": "3072:6oSGLPJs5fU6O0VBqIF/vgzVa+oBirggLmbQQWrh2OXsOZSc5Z:53LPJ6U+Bq0Y5a+T/L8WU3gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676356245, "uuid": "c35f6ee3-e9b4-4c66-9aec-d7efa9d618e0", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676356245, "uuid": "98abb090-ec0f-46eb-9bfb-a4c06d0fcf9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356245, "uuid": "33cbe5e3-80d1-489b-bd7b-028d25993dda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f84f0b-ac88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676393902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393902, "uuid": "66ed4cea-0977-4544-9986-b033a6d640fe", "comment": "Malware payload (Amadey)", "value": "9aee1667a81485d0df20eaa49c682e50", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393902, "uuid": "14296cf6-a13c-4899-9c36-89a6d30e31a6", "comment": "Malware payload (Amadey)", "value": "283adb4af5012bb7b569d728b9ffc6b8da55cca228f63c3d9f92dc0e3d5225fc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393902, "uuid": "80111c53-f9e0-410d-8096-821938f25160", "comment": "Malware payload (Amadey)", "value": "7f7b872654b79b6dae14a232b3a662b0cecfe5f1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393902, "uuid": "a09fce11-6518-406b-a323-b4bb7f478f5b", "comment": "Malware payload (Amadey)", "value": "e4ef32367d31cfc27b11a0664d73e2fcf6980146aa1f75399ae205482078a41b08bdb2a4e15f74e9d9f944ec32bd6d4f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393902, "uuid": "99a0cd11-c107-4f4b-a26f-b4e6a47eac68", "value": "T17BF41257F7EC8132E8B197B45CF602C319367D205B3483AB278F584A1CB2698E63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393902, "uuid": "234112e9-d757-4534-90e4-96254be3ff71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393902, "uuid": "c93d03d0-3485-4b6a-9fc2-e985cec7a9f3", "value": "12288:gMrry90VlipHaWkj7tLjb3IGjD0SP0BFW4eDr3mXdybY2FnCmF/v5O4P:7y4lOaWQbLDN0leD7yy5nC6vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393902, "uuid": "0b380ffd-2f9f-4924-8df3-2323180a5a45", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393902, "uuid": "16556212-f1b1-43be-89d1-0e52bef19428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393902, "uuid": "a2c4cd4a-141c-4540-bcd4-379525a1918c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1893dbf9-ac59-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676373418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373418, "uuid": "e25bf2fe-b17d-4a20-9f90-6d0065a2db21", "comment": "Malware payload (GCleaner)", "value": "7829779901b96679903e079476bcccc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373418, "uuid": "bbab895b-a705-4fd1-91f7-d9a56c88e661", "comment": "Malware payload (GCleaner)", "value": "2842bcb8b6ebe34ecfc0416ca3154ea65ff18b6f152efff57d5f2e6f9da195eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373418, "uuid": "ab70b1b4-9b5b-4eea-85c7-859dfc11489b", "comment": "Malware payload (GCleaner)", "value": "9ff366dd0e2f7325048e3498bf4f9c11d304a6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373418, "uuid": "c17118f0-10b1-42f2-9f51-033519b48a61", "comment": "Malware payload (GCleaner)", "value": "5d1bb186ffc0f2fa9f9bf7610be9f2d4ccf86d1b69c2883e833cbf4db702a1f1d5f25ac38451a3c47e5e2764b07628b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373418, "uuid": "8b75d79a-546c-466f-9fca-a825cdaa6689", "value": "T163E5123C7155C9ADC680FEB48C3A99E75CD66EE3E8E4E46270CC7F3E92792884609507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373418, "uuid": "4f32ead4-9ea0-4a5d-bd3d-6929ccbee9bb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373418, "uuid": "f74534f7-9a9b-46f3-91a0-a0c56d3fb852", "value": "49152:rdHjZM4s49jC2InkxBeQIPaa0vNESmZz2PEkzLvKHq1NITrGPNU9oLiijLCgv2MR:JHji49jC2xBGCEDEPricSoWinv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373418, "uuid": "fa5f0158-7d80-4c99-a0d7-7d0c68d30e76", "value": 3191534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373418, "uuid": "199b2cd4-8849-442e-a5d8-fc657cb8db1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373418, "uuid": "0a9a6d63-143e-4e6b-8dc4-ef0e9dd7ec00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c45fdd8-ac2f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676355546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355546, "uuid": "66a2dab2-38b8-493c-9c59-10a552813326", "comment": "Malware payload (Amadey)", "value": "305d26efa942e87a6eac8928d0c08387", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355546, "uuid": "8bda4bd7-3f56-446c-82db-1c2dcea72b28", "comment": "Malware payload (Amadey)", "value": "28b2e579893d0fa9d60fe77f6f50a7a233e4aa03b2f6b43141b6b74f95a30a4a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355546, "uuid": "2f93e89b-d4a7-4f22-a132-82bc1f6cd9f5", "comment": "Malware payload (Amadey)", "value": "291a1d1a80b72552ac1bf6ae237ae23c858fb300", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355546, "uuid": "a34a5bab-81d6-466a-a9ef-4c1a630d7b6f", "comment": "Malware payload (Amadey)", "value": "ad748318b232fe2b921c15fa003bb0973a8f3b290a743ba1e879a2235c64633b5e0d750be9529d5aeff481c162e14d84", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355546, "uuid": "185c5b2e-4998-4cfc-a101-abba21aa5e61", "value": "T1FBF4025BF7EC8025D5B5A3B55CF243C30A32BE619738879B264E986A0C73620E53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355546, "uuid": "c10f601b-6dc5-4cf2-93e1-74bc90052224", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355546, "uuid": "11533991-963f-44b0-bc4c-8ad8fb231f14", "value": "12288:GMrJy90+5Pt6IhVqYoWDoKF+49lm/tMq2hExqFiuxr5qNG:Hy9PvAYrDv9CMpAqbcNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676355546, "uuid": "d244854a-d0af-4989-8c43-c9486089aea4", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676355546, "uuid": "43fac21d-51b2-4537-b396-46085d5d86b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355546, "uuid": "ab239534-43ae-42fa-8ada-79f724152648", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16093bbc-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403478, "uuid": "78ad7f5c-bed5-427c-aa94-fcebb7b5052b", "comment": "Malware payload", "value": "f033360b6982ae4917f5f6c9dfe15746", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403478, "uuid": "d7820257-d119-433f-a0b6-016c8db8f141", "comment": "Malware payload", "value": "28d151eb32e2f77cf562f0aa9561de388ace1c9847cf73e82dd4632ee8804c40", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403478, "uuid": "2362f6cb-3888-4ea2-a3b5-13068e78a599", "comment": "Malware payload", "value": "06284a76dba6a592d54b5b8d2fbe48760fe42432", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403478, "uuid": "da180b8c-3167-4391-9401-d82602b94864", "comment": "Malware payload", "value": "99bfa245cb31f74855a58737e48cc1c8dafdefeec1357ca29109d605955b585378bbb6ca92426d536b9794c1f9587170", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403478, "uuid": "defa0e5d-c496-46aa-8a9c-09162f79272a", "value": "T1E80733A7176631FC9827D79E8EB0237FE113263FFAEE12665F40CC1428069DBA558641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403478, "uuid": "2fab7cef-e910-44c0-9de6-af511900fe06", "value": "393216:/MfXDJ/7OlzfiGfEucZMEnAxQqoTnPfycna4Q3MW6SBpqJyg3k:/0TJDOcAWq4nzdQ8pQCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403478, "uuid": "a96b5800-4e93-4db3-8692-c3e3603bd91c", "value": 18142078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403478, "uuid": "04698e6a-445c-4717-ad75-f7460a172b2c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403478, "uuid": "7026c865-c15d-4128-8d5d-84bc1ab2258e", "value": "m\u043ed m\u0435nu gt\u0430 5.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47259d15-acb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676414298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414298, "uuid": "e90d98c2-4d1d-40ea-b640-c43c5a82e390", "comment": "Malware payload (RedLineStealer)", "value": "cf9fc50a53fa7b6e906a8abbaa415b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414298, "uuid": "b83ce4e9-8e31-415f-a0e7-6a9bb8d3368b", "comment": "Malware payload (RedLineStealer)", "value": "28d65c13ce93425c2ce7ddcd960ed85611ebf717aed8fd108fa090b689f86f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414298, "uuid": "563cb020-a032-40bc-92f6-e70663332606", "comment": "Malware payload (RedLineStealer)", "value": "91f943dd6b2f039cd9b46b83bc12bf2be40823be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414298, "uuid": "959d9bd0-b042-4eff-853b-b723c7247eb9", "comment": "Malware payload (RedLineStealer)", "value": "f409254cc4d8c853dbe83075eb1bb0c833319ffe492a5ff10d3fa614e84bd7bb333d1b1dc08cfbf2bb36ee798366c463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414298, "uuid": "918e2a8e-9dcd-4139-b6be-36a25e5863f1", "value": "T197E41207EAE9C172DAB5577018FA12C30A377D505A38839F234F9C5E18B26B0B63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414298, "uuid": "76e45ba8-cc5c-4c86-8615-dd607d0bb441", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414298, "uuid": "6fe66cff-fd72-42e9-9e41-b43a216456d6", "value": "12288:SMrHy90VH/Qf25EJGgsducHNpyzvBra+zFzenRvSNl4h2EI2Detn34UqKo:JyGof255d3HcrrzeYaRIaQ3on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414298, "uuid": "2b0edb09-9a83-4c44-8e1f-dcde7871d7b8", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414298, "uuid": "21f6554e-9bd3-491d-ae2a-700c9e65cefb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414298, "uuid": "490d740c-17d2-4e5e-91c3-4a78ac41b72f", "value": "cf9fc50a53fa7b6e906a8abbaa415b45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf447fa7-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676408943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408943, "uuid": "391aad8f-6fef-46f3-8fd5-6841cbacc74f", "comment": "Malware payload (Amadey)", "value": "b8cbe1a0f4b022446d865f5d63484e21", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408943, "uuid": "4de4b3ac-bed5-42bb-bc00-adf39e61461a", "comment": "Malware payload (Amadey)", "value": "28db02b7d3597fe78b61868c211761309b742a8ec9257c1c2bafaaab051235d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408943, "uuid": "3fc811b1-548a-46b8-adde-57ecb9f50b4e", "comment": "Malware payload (Amadey)", "value": "1e1487bf69281ed93652b3342e5e55ad0df7b267", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408943, "uuid": "370e94d1-0575-4bcb-9a50-7db50b1186bd", "comment": "Malware payload (Amadey)", "value": "23daeaacd0582828277b81394603a1f4073c5525ce94c6375806265de82339c91e0348cb5ac4586a2c253d8a4094559b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408943, "uuid": "35c42c7a-d886-4ead-a46f-b72d9ab82dd8", "value": "T148F4121BB7FD4033E874277019F643C3063ABE605B74875B264FADAA08B2570A53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408943, "uuid": "c0f13823-0d84-41de-90c5-97afc58f7732", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408943, "uuid": "70d1a584-03f1-4e1f-9730-7b890a6edd33", "value": "12288:FMrcy90oUYaiysNjREg8V+XsgMETSCrwGBMD537859mS/CGLSdrRxpLrm5TG:RybGiyYRErV+XME3wGuDd78vBSdVa5TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408943, "uuid": "2eaab385-7127-4fd9-9dbc-43d3bb751226", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408943, "uuid": "68bc236e-58bd-4a28-a156-f3803d02669e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408943, "uuid": "664ebd7e-6e13-40a9-b6f7-76147dd4c092", "value": "b8cbe1a0f4b022446d865f5d63484e21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72160459-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1676381299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381299, "uuid": "646187b2-3c06-4873-ae42-2956983e6cfc", "comment": "Malware payload (AuroraStealer)", "value": "bc7398fd2ed72827c550e27ec2bd25e6", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381299, "uuid": "428c5732-9416-42d2-8ea7-37e401768e78", "comment": "Malware payload (AuroraStealer)", "value": "295235e40ca5515045169bb0ca2730dd9ee2c06927df750a887018812f5cef48", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381299, "uuid": "aa5e9130-8fde-4ac7-822c-d5faec9c994b", "comment": "Malware payload (AuroraStealer)", "value": "ca77000ea3705b1cde69151ea024066bce4cc0d1", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381299, "uuid": "c65efe73-8140-4f3d-a8b0-46855c8af51b", "comment": "Malware payload (AuroraStealer)", "value": "22d3f352512af110b1ea1cc9571b8a4f6818b10434377e0d6febb17a8e2a12d945690bf956697595c413b1f70fca773e", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381299, "uuid": "d1014f6a-c977-4ee3-995e-4a0c8b4f2d11", "value": "T1E9857DACE265B0AFD678493485B35F3F432B17E306B049574C1AFAC9DB487A875302DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381299, "uuid": "4f4ca01b-9a58-4e26-ba0a-25a4273dd4f4", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381299, "uuid": "1bf6016a-db18-462f-81bb-eb83a1257633", "value": "24576:84to5zoYMY2+UVlxhU97eK9qO9y1BAJJ9Vr113ArZcLXIy4kU/6h6HZCCXRBAMYs:8iD6KBBikym/6sDhbYM9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381299, "uuid": "b4a0194d-25c0-43bf-934b-27528d01e88b", "value": 1758264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381299, "uuid": "1bd29ecc-6a06-42b7-a23b-8a195b35711a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381299, "uuid": "1cb8bfbe-d06e-44d3-ab75-47c06d0ba0ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c2ba24-ac5b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676374400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374400, "uuid": "44d836f6-230a-4eb1-ba22-1297d8ebe881", "comment": "Malware payload", "value": "46b9ed64b006dddcbc6745a0314e6649", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374400, "uuid": "90ab746f-970b-40a8-8080-425dbe40e038", "comment": "Malware payload", "value": "2955eb202148aa03771a32fdf28463a86734843acd30b284f1dfd3721bde980c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374400, "uuid": "60cebd73-9707-488e-9129-540b5f467124", "comment": "Malware payload", "value": "5bfac5adc809fc0766ee0ed977ef4fb8ca110bc1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374400, "uuid": "1e1f3ecb-15bd-473c-91f9-01f051c89850", "comment": "Malware payload", "value": "1884ae7ee1cffc24b0e01d8df053295b64f2736519c036db95606a6df98802d4282b94da3e778bd5ddf4fe7b7675ffe0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374400, "uuid": "c6fd5409-279e-4a5a-813d-494767ffccf3", "value": "T1BCD2C00DA5B1C42DED170771A27B8E27C52E9E12C2C0F86EFE4F22EC865CD561E2B456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374400, "uuid": "f651f095-7d14-4343-b3af-8b6ddccd52ab", "value": "768:t/vXwEQdMnx4tFYWGaUtviZIgS1ISqon2/YY/YYm3lldx:xbQdSx4t/UUBSLhVldx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676374400, "uuid": "d0b30f6d-2cf0-4e7e-95fc-a7762c51648d", "value": 29992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676374400, "uuid": "c1cba294-1b75-4469-b0e1-39fa68791d50", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374400, "uuid": "1dc181ad-5c53-4bf3-8fa7-906e2159ce91", "value": "2023\u5e74\u4e2a\u4eba\u52b3\u52a8\u8865\u8d34.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b5a3ec-ac92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676398005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398005, "uuid": "69201f68-9c96-40ea-a0b3-ce7f91f79d71", "comment": "Malware payload (Amadey)", "value": "7dd27e54052a2a295bc0e16147daeabf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398005, "uuid": "b58dcb9a-0b70-4278-a406-8e1b70254e57", "comment": "Malware payload (Amadey)", "value": "29e142e4ad3a7f6304b322176e1ca7f6bb7a9691892659fb36e515a7544dcdf4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398005, "uuid": "23802cd2-f7cb-45ad-a85b-c4fe7fa1c455", "comment": "Malware payload (Amadey)", "value": "625162e8e2dc51697c3dcdc17a0db5e04b4776c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398005, "uuid": "b7b5f159-9d08-4aa2-add8-1b1a13a028c8", "comment": "Malware payload (Amadey)", "value": "21b127cce64cb62848861637db63c075ac574b95b8e3b1c92ab13f45ba69c047df033a2589c0761f277c58ad77101e89", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398005, "uuid": "55b4f64d-9034-4308-bc5d-70c8da3a490d", "value": "T127F41207EAEC8162E9B95B711DF203D318367E904A3943AB225E6D2D08726F0F53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398005, "uuid": "8e5f5702-8ddc-4324-98ae-5800257c0c6b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398005, "uuid": "db29e723-1315-4a33-a644-1cdfd88ba340", "value": "12288:zMrky90DzP8qqY3ctFKqm1nK52PVLeKGhS70prJQfF04YSO0LeHyQ5OCkc25HGm6:7yKzPk2MmK52pP9AQBYbHcCW5HxZhern", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398005, "uuid": "4f73789d-0b79-4101-a9a7-1206d5730513", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398005, "uuid": "6ac930bd-5000-48a2-92ca-cd1c77b83659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398005, "uuid": "9fc78135-e432-4771-a160-955d750f5302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6322f75-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676412740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412740, "uuid": "2a1a9a7d-ad7e-4832-9117-c623bf35c837", "comment": "Malware payload", "value": "b1c2d46e4d88264b08e43211653f6e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412740, "uuid": "b53c8cd9-e909-4ada-9108-8285d64e4e68", "comment": "Malware payload", "value": "2a09de7052de14eabbb927b8e9ae365cc69ec3db76416886b0d1adfaed1d7a1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412740, "uuid": "68fba573-78e4-4014-8c49-7e0690e383ad", "comment": "Malware payload", "value": "43c54213d596ebf27023488b53d52c5f96e7b044", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412740, "uuid": "00544794-1b7e-4305-81f8-23a424cb7fa9", "comment": "Malware payload", "value": "0f82e9bcb48591d97710af972bad0dbf47fcef9368a0f9a1bc669ca6c143258223fd8facbcc4457c6bf53621b8f46b97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412740, "uuid": "cebdca0e-c64e-4bab-8f44-5ef1398fa94f", "value": "T14A732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412740, "uuid": "99262e4f-77d0-41fe-99d1-b05054a42e41", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftcsnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFOSA5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412740, "uuid": "ef768ccd-bb7f-4596-ace7-861c779eca9f", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412740, "uuid": "dc3c3625-bf0e-4be9-b7a7-6b0184ea73b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412740, "uuid": "cf6f76eb-a13c-4c55-8bcf-b96933b01e8e", "value": "b1c2d46e4d88264b08e43211653f6e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd44534-aca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676405342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405342, "uuid": "c2fa9636-a966-4fc8-9cfc-6f4c92ad587f", "comment": "Malware payload (Amadey)", "value": "61905205c0fc863fa2cd42e38856e186", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405342, "uuid": "399dbe33-10b7-453d-8337-0bfccb35956b", "comment": "Malware payload (Amadey)", "value": "2a35d5b6fce51c913488c9ba5551e971a29a2026c94c39805495f52e9ae1b431", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405342, "uuid": "9f7d5050-43eb-4b3f-a3fd-a56272d83a07", "comment": "Malware payload (Amadey)", "value": "91e39c33a4f685631299f0e4bc21279b27ba5931", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405342, "uuid": "d0603d72-587e-4472-8712-e9d5857fe0b5", "comment": "Malware payload (Amadey)", "value": "18db1c0033d1193a751ca527f05513d55a7eabebd20efe0e8af531ca0f0cf22a30328f1ffef74fa4b194da3125370e7f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405342, "uuid": "30690c8f-43f6-4e2a-8b3e-5b7ebd456fcd", "value": "T13EF41207F6FD8076E8B187B068F303E32D3679A1593447AA678E5C990C726B0A53477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405342, "uuid": "2258ca8a-8ab6-483b-869d-1d58c0d1d957", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405342, "uuid": "16e7869d-8564-4e18-9731-e3a420de59f8", "value": "12288:1MrEy901EwoVRkM32Tc28fF9I85kKrpFT4jK/spRNv5bfplXo7Dp9kBiJ1:dyX1VaM32Tc28fF66rcjWUv5bjXo71oC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405342, "uuid": "7b149d65-7be7-4738-a47b-c0d263696342", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405342, "uuid": "dbb5e980-2dc1-4f78-8579-21f53ff5e4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405342, "uuid": "6ebca143-7853-480b-b71d-6c8094d8886f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cade8404-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676399057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399057, "uuid": "7f107ed4-44d8-4968-a188-0f00ef7da173", "comment": "Malware payload (AveMariaRAT)", "value": "5d00cbe8a0f7e4c171672f6dd31dbed4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399057, "uuid": "c487a4c5-0bb3-4e88-bb2e-a7f280710765", "comment": "Malware payload (AveMariaRAT)", "value": "2a8b6d3293f3094c8988befb6081d9f8d193e216a82cc65abc1caaf520f3acc1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399057, "uuid": "a0e12ebe-fbef-42f3-ab19-e0b5d579fea9", "comment": "Malware payload (AveMariaRAT)", "value": "bdc857069442cbca1f6b21ae5889ee56979a906e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399057, "uuid": "585af3d7-d086-4fef-a88e-30b0a83a68fc", "comment": "Malware payload (AveMariaRAT)", "value": "c6a670f142da00165f042a482d61e30f04220c12072551f0e669de3d6848d2272f392e8a1674e1749df3c5a4559f278f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399057, "uuid": "d2ed9445-0b54-4b8f-9ef7-d12036fe63b4", "value": "T1DC05B23CD9B82D2A82B7E179EAC5F417FA9048D7771D8D9F81C2AB420542513BC9BC2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399057, "uuid": "7ff0ab39-79af-452a-bd56-cf5d4226b13a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399057, "uuid": "9a2b0cdb-fc2c-4abb-ba96-bc90d630dfbe", "value": "12288:Y0yHnyJf6oj1ubS/KY2CvmwpqjNPKpcQ22z9Mvz75EfKK9MZrFRa:fyHaf6oj4bSSY24fpyQOzFESUMZrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399057, "uuid": "a89f7db0-f686-4080-b8c7-db3a4c96819e", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399057, "uuid": "4d729a8a-5c83-4b80-83e8-88c9de175468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399057, "uuid": "04c59e74-fdd8-4395-83a6-b4550225088f", "value": "TNT Original Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df77857-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1676402284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402284, "uuid": "79db71bc-7bf3-4552-88f7-42f26b4c0822", "comment": "Malware payload (IcedID)", "value": "369480624570299e8d09abf03029bbc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402284, "uuid": "ed9161ad-be17-4148-b748-f969d0d70e12", "comment": "Malware payload (IcedID)", "value": "2b317f6a1ffc33b390ef0f9ca4c7227c250dc6e46e9eb198e2ef56ce00e0d360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402284, "uuid": "7fce65c2-8cf2-4f21-8e58-af876d94c790", "comment": "Malware payload (IcedID)", "value": "806be56086dc7d3dd75c6328516ac6d8370c113e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402284, "uuid": "bd957a4e-971c-45e1-a285-1566b7cd09e2", "comment": "Malware payload (IcedID)", "value": "51f864903162fa3e3171ee3a15f3a3e21adc53a18e607b55ca2f4166b1bf95cf553dc16d13541ce5b08ae57bb3c181f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402284, "uuid": "47911982-052b-4805-9464-fa590f1a0903", "value": "T169F39E07B7A911B7E17385748C635609EBB6785207219BAF039483393F237A19E3AF35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402284, "uuid": "a87ef340-b3ef-49eb-9e0f-fdd189c48f6c", "value": "7d520c58152fd8881716eed523f85e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402284, "uuid": "51f67eab-c03b-4ae2-8083-0e6b40b4c2ef", "value": "3072:Yr4JWF89VfP+tBcPm8s7ZCUMQWHZgX4bX4QchwnholNHUuAaGlcLs4fn:YMJWFaP+wPm8sYIWHZarBCaccoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402284, "uuid": "02a1858e-a9a0-4410-8db1-80444b73d6ca", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402284, "uuid": "74cdee7b-62c5-4817-91ec-0b502d991762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402284, "uuid": "acadb608-996e-4e38-b64a-bd8418036509", "value": "twain.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7442c55-ac33-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676357336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357336, "uuid": "b951a810-7003-4591-b455-e3da94650c71", "comment": "Malware payload (GCleaner)", "value": "7f9aa6b348f0dfcf84b0401b786057a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357336, "uuid": "b3c8cc2d-1ae5-4f1e-90c6-cdd13f4a6f78", "comment": "Malware payload (GCleaner)", "value": "2b500d11a8b31dc5dee692789eb191e798b8c1783059ee98c7b7459f95c58b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357336, "uuid": "def2100c-58e6-4774-811f-b36255eaac60", "comment": "Malware payload (GCleaner)", "value": "a98f5a499df401467168b6e29e93fdeed7dd087a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676357336, "uuid": "e256a89b-482b-4d7c-b8df-e39505f45b75", "comment": "Malware payload (GCleaner)", "value": "5eff8dba944584e52540b7260029c665dc00a1a3ac9d0b02b6d6f827109915edfe858c4f2f8bd0dbbe3039ba3d574715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357336, "uuid": "21d4be93-4256-4dd7-9238-d9765df7f28c", "value": "T19CE5123C7544C86DC580BE78882AD8E75CC76DE3E9E8A416B1CC7F3F8279289570A617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357336, "uuid": "bf63c1a0-c89a-429f-aa9d-641392c3cb6e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357336, "uuid": "f508c129-8e89-4bd2-beff-8cfee5af1129", "value": "49152:rdHafxIbEcppFGOzxRzY+EUI/t8VEviCdjjd5dtXjD6YkLCgv2MR:JHaqFHzxRctt8VEr/dBpUv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676357336, "uuid": "1c215f57-6d32-43fb-8b0d-55cab142ea77", "value": 3209332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676357336, "uuid": "b2e58fa1-9fb8-4485-a550-38617e9bd8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676357336, "uuid": "342e2602-ad5e-4185-83b7-ee5b748c7448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95f2ebd-ac42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363890, "uuid": "fb2e57ef-3802-4312-a8c2-75d77fa502b6", "comment": "Malware payload (RedLineStealer)", "value": "316482a5b572d04ed3a5319213e5c8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363890, "uuid": "195e8693-1c12-4cca-b08b-452bffa2503b", "comment": "Malware payload (RedLineStealer)", "value": "2b8a8d5817a97a3cf72802906f588c4f5cb1de2dc34456aaf803d74fbf4037e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363890, "uuid": "d11bff24-f927-484c-81c4-54626b0d4f8a", "comment": "Malware payload (RedLineStealer)", "value": "d7e2d77df217481af816fcd53db433e56b49c207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363890, "uuid": "70217b46-f899-4beb-8b20-19fcaf47d3e8", "comment": "Malware payload (RedLineStealer)", "value": "de04d929b6797ca84c1110e5635d4c99b0dbbc885c473b1135878f368c7c9e3b71c372f0cf471ba66c2c6eb22dd3e58f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363890, "uuid": "2e6aca0e-95f4-4278-834b-d1b699220f0c", "value": "T1BEF41257A3E84236E4F557B029F606C31B367E604B38838B7B4A5A1E1CB3730A675727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363890, "uuid": "49095279-2403-44d9-b5c1-b7114e872afc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363890, "uuid": "ebe9f562-4baf-4251-8663-acc9dd3b4163", "value": "12288:BMrny90KTkbSraJr7kyYnHGPc2FCvFo3ck2VNQKBFT4zXYV3Rd7m3zAzC7G:eydbu7DYnHGPcgCv63ck2V10zXcd7EAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363890, "uuid": "c21b0f97-f1a1-4ca4-8194-0d1e734b8a37", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363890, "uuid": "de7a23e8-356c-46b6-8a2a-b1c3dbc033eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363890, "uuid": "08edd826-14b0-4e4b-8631-2cc7ff6a88bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cd6c48-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676375230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375230, "uuid": "de5eb3ad-d975-4fac-80c7-a42f9a99507b", "comment": "Malware payload (Quakbot)", "value": "262c51bdd33a69aa0d47963175463963", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375230, "uuid": "53f21d58-e89f-4766-a1b3-d91b818b1c70", "comment": "Malware payload (Quakbot)", "value": "2bbfc13c80c7c6e77478ec38d499447288adc78a2e4b3f8da6223db9e3ac2d75", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375230, "uuid": "e40c1efa-a40d-4f18-8057-15d572711f50", "comment": "Malware payload (Quakbot)", "value": "10c5839dc93f6d471bdd7acbbf71940bb2b9bcaf", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375230, "uuid": "ee1eac0c-3b26-4458-a05c-3fc3edbc270b", "comment": "Malware payload (Quakbot)", "value": "ddd3d1ae5bd5ba42334d56302a7325d3f4047a92c09a5754526f5b435a245e96435c77f14c2f92f98eae40e65006d181", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375230, "uuid": "2867705a-a78b-4f8b-921b-c7094990a0d9", "value": "T121C3CE0172E416EDE2F86E3148F63B621762BE52A92E4B3FABD1244C6DE4A00CD1175F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375230, "uuid": "9accb197-9985-4d26-9257-7f985c189cc3", "value": "1536:HIOjciqwpusMOnrRKWDehU6BpAnzcsa4TtK+28ao9:HIOgiJcsR9hyhU6Uzcsa4xKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375230, "uuid": "53f4830a-a81c-4004-bd7a-bd3e0f38c8a6", "value": 126202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375230, "uuid": "1a1797a3-bf49-43f8-bced-8875fc48b578", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375230, "uuid": "4086fa8f-0c3b-48e1-9d62-3d2a368d921e", "value": "AgreementCancelation_692540(Feb08).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf43fde6-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676382717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382717, "uuid": "141effb6-4394-4aac-9fc7-b4e85cfecb98", "comment": "Malware payload (Amadey)", "value": "cbed34edac14a47de0b2afe5df14e3d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382717, "uuid": "b4f911ba-9824-4e82-be60-0215c061fd27", "comment": "Malware payload (Amadey)", "value": "2bc351fc4548a0fd77518a055918a76103b1d516b7ccb1cd860ed86ba667a0a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382717, "uuid": "f8a96673-9177-43c5-8969-22d9b77a1bfc", "comment": "Malware payload (Amadey)", "value": "37b6c7e0ae02e85d1c82d2714b07e20695dc5914", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382717, "uuid": "dafcf25f-bd56-4247-a43d-fe8a6dadd77f", "comment": "Malware payload (Amadey)", "value": "664ad403e49ea0367dff2b4d41dffc483fb5d8e499a13c5ad51cc9068756027836cbe8d5150b9ca2f46592a10461a987", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382717, "uuid": "51fb46ed-e3e9-4b35-949e-e3d2b67880c6", "value": "T197F41217EADC8133E8B4977018F206D30A3BBD619A688787234EAD5D1CB35A4E539377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382717, "uuid": "c67483b8-edce-4884-976e-a52a3624827c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382717, "uuid": "095d8631-1543-42ae-81c4-c4524b8fc53d", "value": "12288:1Mrqy90VYutUTutH/GM3wKYrDKvDbcJI1mCCR8jLIwXMvCc11/I7FbVOb6n83PT/:3yruyCtH/hwKYrDKvDbgIcZR8AwcvC/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382717, "uuid": "b85890ab-142d-4abc-9433-5d75118bddf2", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382717, "uuid": "20eb5178-66fe-4066-9432-e17280ed137b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382717, "uuid": "6b3a7117-151a-4594-9ceb-b80a41bb6d21", "value": "cbed34edac14a47de0b2afe5df14e3d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9547e4a-ac20-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676349260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349260, "uuid": "8275f2d2-43b3-47b4-9f93-38a405deaaf1", "comment": "Malware payload (RedLineStealer)", "value": "aaf2dc125576a201421dd18ca7081a23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349260, "uuid": "f3cf2bd2-a2fd-46fe-9987-5801d0a398ea", "comment": "Malware payload (RedLineStealer)", "value": "2beccf8a915c34bf6b081c72220805b5871c26fb8e2038b8f6ca7b351cd90061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349260, "uuid": "ec3011f3-d513-4ca3-81e9-ecf91a62c070", "comment": "Malware payload (RedLineStealer)", "value": "c782c53a632d9fbe02e117bddde91b39251e511c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349260, "uuid": "238a6033-f7e1-4dec-8c48-6ad7d70ea08d", "comment": "Malware payload (RedLineStealer)", "value": "6d623eff75fc6bcd972968c385e32434f3328e76c803d93357c87dd68e160f68773e8c058720b6462d473c91ece7d37f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349260, "uuid": "a72bf401-6158-47e4-aebc-c3b2c5cdf01f", "value": "T19664E012B3E1D471E42606318929C9A46A7FF5214BB4E6DF33945B3F1EB12D0CE3636A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349260, "uuid": "333f7ca3-2c75-4b7d-a19a-89f9331b0d01", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349260, "uuid": "7a9f8821-d2c1-432b-8a55-626d105f5801", "value": "6144:suL9R0/VTps9DtlbZYr540hqTCpAdh3NIbs9DUn:suLATpsxHbZYr5vy9eA9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676349260, "uuid": "88678e3d-feea-47ca-afcd-6cfc5a48c93e", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676349260, "uuid": "44c263d5-14ba-4a27-a16b-ba9328f1029c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349260, "uuid": "5228abf9-3822-4d61-8c91-6e569ef76b2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8b5d69-ac3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676360860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360860, "uuid": "2005e0a3-2af1-4e4e-a11b-7dca8c153e05", "comment": "Malware payload (SnakeKeylogger)", "value": "f9ec41b86f6e0fc8b7b4708902e218ac", "object_relation": "md5", "Tag": [ { "name": "lha", "colour": "#2F08B5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360860, "uuid": "d4289415-58f2-4731-807f-99c27b5ba88d", "comment": "Malware payload (SnakeKeylogger)", "value": "2c1c2a6ac96e1ca6a04d7713a76c0d9d30d18798d798831ca4d119dcbc755b88", "object_relation": "sha256", "Tag": [ { "name": "lha", "colour": "#2F08B5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360860, "uuid": "0f9781a0-1035-4407-843b-a6a2dd834054", "comment": "Malware payload (SnakeKeylogger)", "value": "449e4384c584955668285f40318694a3b3832217", "object_relation": "sha1", "Tag": [ { "name": "lha", "colour": "#2F08B5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360860, "uuid": "dabfea56-a89c-4c00-aae8-361ef5668405", "comment": "Malware payload (SnakeKeylogger)", "value": "bdd15fce9d5a461ad58baf478aed24333b51c93268b084af4e09ef2cbd29600697b9da17286fef0fbd5832f82a3537fb", "object_relation": "sha3-384", "Tag": [ { "name": "lha", "colour": "#2F08B5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360860, "uuid": "0c23f62e-f0c9-402c-8f2e-326e3ccd5603", "value": "T1ED64239A915FE5258498FA13A040EDF9DC0BDAC9150FC6D0B6F27497967CD8FAC8CB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360860, "uuid": "b925942c-77ee-4b9b-88b9-2c755c2d1397", "value": "6144:4gC8V5aWe7JWvGia2Pz0G95Laf0XOCQ7j7iOFTL1AELDYoi3j:i8V5IUVa2Iy5LswOrviOHFL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360860, "uuid": "94c0c890-6c74-4026-9651-520c90437d11", "value": 318937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360860, "uuid": "1a9169c4-4602-4321-bea9-442d251c109e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360860, "uuid": "c13dd561-9378-4a4f-8046-628682bca9f5", "value": "HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22).pdf.lha", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86c943c-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399563, "uuid": "13504b0f-ddde-478c-99ed-e77ddca8f0bd", "comment": "Malware payload (RedLineStealer)", "value": "1a8c2fc78a1e7b848b6d4bafc19d7a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399563, "uuid": "4bb85be4-294e-4b7e-bb91-21b2b612945f", "comment": "Malware payload (RedLineStealer)", "value": "2c2c053f74d01764f4a9abd1a9d628863a481471a8b26ecb7125ed23412679b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399563, "uuid": "15500592-7871-445e-876b-b767a5c0ebd7", "comment": "Malware payload (RedLineStealer)", "value": "31fc0c99487a107db9d80d4b239869d0063c0fde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399563, "uuid": "4224c640-f186-434b-80ad-c141aba1047f", "comment": "Malware payload (RedLineStealer)", "value": "a8d7ce0a183cc3b56fb87d02b592e387a1abe33d40ad2b0f3ce2873fe1c3f151cd11627726eeef2f42567455e6f4fb22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399563, "uuid": "d61b94e6-03bf-4450-b938-8a1967ededc6", "value": "T135F41207F7FC8032EC64277019FA02D31935BE905734934B268B7E5A19F26A1B63972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399563, "uuid": "af750e58-8da6-473d-86e5-bea8e74efde2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399563, "uuid": "f92ba3e5-69e3-48c3-a49f-0f7c55d97d30", "value": "12288:XMrFy90vGqvLdiC0fIhPyk3g5LS6sEkcV5HNBsbk661hGci52IOe:2ymHDdr0fI4W6sE15H7ok6khlIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399563, "uuid": "7190c8ba-5f21-478d-ac2f-a615430f7482", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399563, "uuid": "0f3eb64b-0a43-4fb1-a38a-ccea2e17744f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399563, "uuid": "dd1aef5a-8e04-4c8c-bcd5-c13606afbeda", "value": "1a8c2fc78a1e7b848b6d4bafc19d7a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e2d140-aca7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676406941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406941, "uuid": "bbb7be26-1c31-418b-a0a3-415068e0270d", "comment": "Malware payload", "value": "c49706fc3ba130fc102f2afd7562af3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406941, "uuid": "f7ef9653-3670-453f-be73-224560e3340d", "comment": "Malware payload", "value": "2c9f6da29da17111f53e365c3edfb08490a42ad110dfe64a5a68880c8b2ce4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406941, "uuid": "e95b332b-6f7d-4f0b-90ca-a90f1dcd73f2", "comment": "Malware payload", "value": "022afd86489a2639bbde4ee58baa9330edf22601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406941, "uuid": "eeea76b0-7246-48cb-b1ec-43b494ca5dc4", "comment": "Malware payload", "value": "2868cf015388528e59732f4003b7a9ebd587e22edf1f0b7bc91cf59da6f165c695bee9ebc4f649a73485cf9a8cf63c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406941, "uuid": "a8fd7b05-4ae2-4c74-8e6a-f3dfcc2c183e", "value": "T154F4120AE7EC8071F9302B705AF603C70E7ABE619A38C357678E6C591D73664A535327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406941, "uuid": "b89af14b-839a-4850-943c-8180d7f94de7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406941, "uuid": "ef68d0b3-2adf-4ce7-98d4-ed9fea182b6a", "value": "12288:UMr2y90KSt4R1DkPvqkzqZxla1IFN4KzazlZWskIbY2fSHtlApZ:6ylSog3TzoxlaTKzazjWskIk2KHtlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406941, "uuid": "6cb85599-2b22-40bb-8743-923f6b41a562", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406941, "uuid": "4a9e8766-fe98-499b-95a6-1485043358e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406941, "uuid": "b8f7d40d-5bf8-4c13-9c06-d54a996ea8fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282c3da0-ac25-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676351110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351110, "uuid": "8ddb02d1-fe62-4626-b641-77f97bd01719", "comment": "Malware payload (Amadey)", "value": "973102123757a65775503d5242c81ab4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351110, "uuid": "59a0334e-6f8d-4758-ba78-1a5080126f15", "comment": "Malware payload (Amadey)", "value": "2cc89c54c86480b9f230c2673f48d28528f524067dd6bab6840036e637e73105", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351110, "uuid": "37ccbe34-236b-4d28-b70d-a76edd56f636", "comment": "Malware payload (Amadey)", "value": "9449a16983cf5c798472ab4762d07c33478898af", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351110, "uuid": "50f43354-3518-493a-ab61-4c97821d201b", "comment": "Malware payload (Amadey)", "value": "203182f29cf4aa7daf80aa24ff9c34753c6ca276dd2d54ea82b5eb68779cc4bb410f2bc77a68879ea7c045d62074c8d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351110, "uuid": "f775f057-bc25-4d3b-80a5-dc4a37b50be8", "value": "T1B5F41256B3FD9122E8B553B019F602C31E36BE606E78879B634F6C590C72A607634B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351110, "uuid": "04925056-fffa-4f20-8a3f-ce798ad9dd2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351110, "uuid": "78ff866f-87b2-48c7-b60d-8764db98d2b3", "value": "12288:rMrTy90V5SINio3NxwTW1mDFM4hcnTk1LRPWau/LwvMWR9WF:kyAXB3sTqmVhQULQbWPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676351110, "uuid": "91001ff8-736f-433f-9136-70ee669d56f8", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676351110, "uuid": "318201cf-a66c-4262-be6a-89ded604dbd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351110, "uuid": "1b322efd-3f4a-47f7-abbb-82458bbbf2ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e6a4ec-ac3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676362483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362483, "uuid": "4badb9d0-8b96-455d-befb-39224aa3e101", "comment": "Malware payload (AgentTesla)", "value": "7fa12caf9669d4b69111c8603dbffb24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362483, "uuid": "c86a7137-6edb-419a-a854-2579e44cd99a", "comment": "Malware payload (AgentTesla)", "value": "2ce0d039386dd012a0d050d1bafa373cdd1a232af06afa965f2878d40beadcb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362483, "uuid": "82c6a84b-0057-4bb0-a868-0f255c8096ab", "comment": "Malware payload (AgentTesla)", "value": "ef4ee2a38ca56e716dc44cefd279137c1bfae1a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362483, "uuid": "cc0f47ea-8602-444c-94fb-b8d3bc3e4a85", "comment": "Malware payload (AgentTesla)", "value": "537820584465741b520d32cddc530359944a95c291ae027416a754dcccf073ee88247eadbf3460dc6bb9ce12194d7de3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362483, "uuid": "fddededb-8b38-48ad-8c03-6fc6337d9c74", "value": "T131F4238DF383F914F9CDF96C4C1482AEE7426E9206F65F63A7B9A003476018F6826177", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362483, "uuid": "111da606-a268-4772-b33c-4cbdb43690eb", "value": "12288:JKaFw0VTVK0hDx0iLhk4GDSzw71SlE3iyiXuo8ujn6n280ND3YsRiXl:4ay0lVrh7dk4rBlESytujnS282cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676362483, "uuid": "50b577ee-052c-4890-9623-9ba0272dfac3", "value": 723374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676362483, "uuid": "dfb7789a-f4ab-40c2-8d16-fbd7dc909678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362483, "uuid": "0d906532-49c8-4177-9b84-575ae1bff361", "value": "AWB NO. 4308258296.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9251da6d-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676401969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401969, "uuid": "45f70358-62ae-4a5f-8749-528e3e28772b", "comment": "Malware payload (Amadey)", "value": "d1afb23f3e4c0b08781afd7e017919c0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401969, "uuid": "81fbd642-56e4-4fd2-8006-a7d1e4bf7c0c", "comment": "Malware payload (Amadey)", "value": "2d0d123729af4b4800f33b117359906e6fcbd4eca8ddd44a19284395bcb4b063", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401969, "uuid": "3f484c64-fa22-40ea-9c1b-cd61f2459cec", "comment": "Malware payload (Amadey)", "value": "da23ee09d9d722db5f64a22ecd4a2e3eafe6363e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401969, "uuid": "f3004d46-5710-4a13-b32a-8476979ec4f5", "comment": "Malware payload (Amadey)", "value": "bacc9ccd14a77106710024fcff0fc0719fc40044bcabff42286ed2b29daa92ce6529deb9125715c2a917b403e0860acc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401969, "uuid": "83a40275-6527-414a-b19a-fd0f6bf587e5", "value": "T1D2F4125BEBFC4522E8B56B7015FA03C31A327E119A34C3AB170AAD0E19B24B47635777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401969, "uuid": "3ab94845-5527-40d3-93d8-6294bbd8251e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401969, "uuid": "3602cb8f-a3b0-4245-ae79-0d1d52fdae6f", "value": "12288:OMrby90Lsz+To2WQWRiOsnV8u0MD5Hw75odhaQ7c7kcc5HGuNrQB65NiYLg:xyOsQWPR0nVDpw7e7c785HFFQBQQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401969, "uuid": "277ab004-dd26-4ebf-a618-a47b2d5b0664", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401969, "uuid": "79cab7c4-c0a2-4dd4-9c17-a7a6c65c4c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401969, "uuid": "aabcb371-c460-4487-ac82-f97d2b58d9dd", "value": "d1afb23f3e4c0b08781afd7e017919c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7040871-acad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676409788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409788, "uuid": "5ff16c91-22f8-4a02-811d-7b1ec4c119a3", "comment": "Malware payload (RedLineStealer)", "value": "8962dfc3fa32afeaf775c8f937d023e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409788, "uuid": "b3489d2b-117c-4c42-a09c-0af01ab992d6", "comment": "Malware payload (RedLineStealer)", "value": "2d160d7d3ce1a4d14445c6f52d5ca1d34eb70d0b1f21a6dff74733d4f1514d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409788, "uuid": "01df87e2-ed4e-4d70-991c-7f2af509fbfe", "comment": "Malware payload (RedLineStealer)", "value": "bec15c7adb9fa3b9b1519b924b8bf51a6dcd98f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409788, "uuid": "c732630d-f71f-4301-89a4-29962b08e8d4", "comment": "Malware payload (RedLineStealer)", "value": "f939b32a2a4e683119b3f3d8c1f07b363749f291ddf24e5d276c2064eb66985073a12af1678d9cc3484d649d1e3cb835", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409788, "uuid": "3279c876-6639-4b07-a0c2-4dc568c3944e", "value": "T176A40147EBE88132F8B527B019F703C306367D6157389357329FAC9A18B2AA4B535367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409788, "uuid": "b33d4d8c-6f19-4d73-8ae6-a2824ab2026e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409788, "uuid": "783246d5-f1fd-4097-9bda-33a1c7106555", "value": "6144:Kxy+bnr+np0yN90QECPGInsGMuYIBf6/4yjX3cNzQq3YRz0JqABZimdmtg:LMrTy90GDsGMqBfG4yGUq3YREqEZpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409788, "uuid": "bc58508b-10a0-4086-beed-02dee7fc0ef2", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409788, "uuid": "46ec831b-ae9e-4c09-b116-c36a3d70b404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409788, "uuid": "bcafa58d-dbdb-45c6-a0a5-f7a630359767", "value": "8962dfc3fa32afeaf775c8f937d023e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874b2bf7-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676398944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398944, "uuid": "642629d4-223d-4fe9-9ac3-b7262a5a0112", "comment": "Malware payload (Smoke Loader)", "value": "9fcbb7f0ca9da393ed96fa8264f42802", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398944, "uuid": "061ea602-09bd-4acb-bba4-0450486ac234", "comment": "Malware payload (Smoke Loader)", "value": "2d1a40a6d316ad3ed0426cc17848db9f70664a7e63397308a8946d9de079d1f2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398944, "uuid": "2bd38d3f-4cac-4adb-b214-4b52eb318c8c", "comment": "Malware payload (Smoke Loader)", "value": "1caf67991f87052bca8b365fa4a37d59c56ab3da", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398944, "uuid": "441d8201-09b4-4e29-9d66-e61b564e92fa", "comment": "Malware payload (Smoke Loader)", "value": "b4bf017327f2d3ca5db246b292c616d87f4e320da80aa7490cdba744ca44b8325a26f46f4905a90c895162db80f98824", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398944, "uuid": "92101158-c552-4b4b-b83d-ebfa6d9b5a43", "value": "T1BC04D01175B1D0B3E06784711431D6BCAA2FB8B26BA0C08B27475EAF6E313E18B7575E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398944, "uuid": "8b0ab115-0ac6-4216-8bc9-7124450bb749", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398944, "uuid": "6505f691-d9d3-4373-b691-4b889d5adadd", "value": "3072:yOzarpLLVp75oy5vBV1V+QjUnxivUoZsJzSo2qB7VmcuC:yMGpLLVpC4dVUxipi43qfBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398944, "uuid": "90357ed2-2987-4912-a06b-a530c0af3613", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398944, "uuid": "cefdd40b-d0a5-4e0e-bb39-8e88e9d79f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398944, "uuid": "bf5b3c42-41fd-441a-b1e3-4bc22d963cc8", "value": "9fcbb7f0ca9da393ed96fa8264f42802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16481687-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676375132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375132, "uuid": "59e3f367-4290-4725-98ff-5e9c6328c92f", "comment": "Malware payload (Formbook)", "value": "6427bf82ed57f0d3747bb4bec46e120f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375132, "uuid": "72f0101f-63b3-412d-b8b5-1e15fda0a865", "comment": "Malware payload (Formbook)", "value": "2d3c7fefde60268ec96906144d74058651f6d5d7ed5993a8b1ed00ca40a2d7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375132, "uuid": "ec194089-981c-4b07-bb75-691079ca12ea", "comment": "Malware payload (Formbook)", "value": "4f14f9f3140f9a949d37782905c79da3ab91f1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375132, "uuid": "d576c1e5-1152-46d8-821d-fe042411edd2", "comment": "Malware payload (Formbook)", "value": "270d3a774bd0e6beea4e6f0ef4a8605e695cea4cca0ddf4545cb5876b2492cda138a1b00208ea01c4d1ebe529d09ae45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375132, "uuid": "c364f587-5794-4a6e-9af6-d355adb32a7d", "value": "T197541220AFE1C427DE634D32897E4B2B2FF59A150D5543D783941B69BF226A4C60F3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375132, "uuid": "700b20a9-1a07-4f4b-bf18-38d0a6e6023b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375132, "uuid": "be3fee10-b748-4d64-a873-729b24b53784", "value": "6144:/Ya6/V0Ub0HLA9UHJVS8qDEZrNtJfRZ9wolBTuQsUIVHwFE50:/YNWUbqLgsSHm7J5ru3iC50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375132, "uuid": "c450ee17-1872-45d1-a110-49eb4af2f6a6", "value": 291684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375132, "uuid": "d3e54742-79cd-4486-bd4d-d305628ae238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375132, "uuid": "de69e9e3-57e4-4332-9309-c09a56d2552f", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da6eb24-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676408242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408242, "uuid": "4c23f079-01bd-4a2e-8704-1fe2a2fb3097", "comment": "Malware payload (RedLineStealer)", "value": "6daf4eea3467fa3d39cfba5ee48c88c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408242, "uuid": "e6c4a89b-6462-49d9-9ab1-b9cdc48ce62b", "comment": "Malware payload (RedLineStealer)", "value": "2d41dd7820693663b31efb6bea95f0adc8e511393da1752ed7a2960c02df91b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408242, "uuid": "2b481021-fef6-4678-86a3-78b1760cb0cb", "comment": "Malware payload (RedLineStealer)", "value": "416b581c03fe3768abd9cc035a6afd42af4c8dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408242, "uuid": "5f96d7fd-62e9-4be6-b989-e16f2c1fceef", "comment": "Malware payload (RedLineStealer)", "value": "54c4ef167562f374d742d1df8663c0d9637902bb5f9674c41773bab2b5b49554e757eedb5940557c1a1052e3e3758698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408242, "uuid": "853441a4-89d3-4cd0-8cc9-9467261da2c5", "value": "T1A9F4124BE7FD5032E8B457B02CF243D30A36BD606635876B634E6C5A0C32A74A53676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408242, "uuid": "c6483018-421e-4f52-9653-2571963b6578", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408242, "uuid": "b45d2c93-ed17-453f-b8d1-cf5c7c7209ce", "value": "12288:GMrty90n5sCujG7gHXXyMnNlc75n/I+k8kFW4PLpX5nQs1OSOxyAhtlWRqop:jySnuju+3nNlUp34PlX9QItOrhtlpop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408242, "uuid": "d0f472cc-5329-4a91-ab62-5a1cc7ba900c", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408242, "uuid": "06457124-0665-46c3-8331-69a55c003351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408242, "uuid": "537274da-aca8-4e73-9a11-8f3e96eabc10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bea5854-ac00-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676335386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335386, "uuid": "4b83a615-546c-458d-9a2b-5f0e9c1d8ee2", "comment": "Malware payload (RedLineStealer)", "value": "984eb2da7135c406937ebe54c99b3d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335386, "uuid": "491cf697-cfad-4c22-a826-9dddf8380c80", "comment": "Malware payload (RedLineStealer)", "value": "2dab8700fbdbc1e2e2af10d58f242b4ce154245e4dfcaf11574691e2e3d6f451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335386, "uuid": "39c99171-901c-4df4-ab72-f8afa7940559", "comment": "Malware payload (RedLineStealer)", "value": "9c19f388ea5b760465c8186437e9095069662100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335386, "uuid": "73cc2927-538b-41a9-8539-c87789f31b5c", "comment": "Malware payload (RedLineStealer)", "value": "86d37a69ae192c88fcbdebf9781c9d01323a2dfd3cf122327fa0ec5168e4d10e77ec307e0b9a1443c9f950a3c88cd3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335386, "uuid": "5dd835b3-e9e9-4c5a-8f22-2d621939ec50", "value": "T13B054983759D8033D3E151333DB482E889F967F11EC348AB53D0D629BA3B28DDA61576", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335386, "uuid": "8a766cb7-9d85-4dbc-9b7e-6ff41ad20f02", "value": "ebd11b3f90837127466222812adfd903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335386, "uuid": "e2eca6d0-3855-4bc1-bab5-909e9b27c61f", "value": "6144:f+EN1AN5Rv7ZBRdH6Gpq1JjEBz7G8dAOL5tC3mhqO/jE6AA:fTN1A/RvNBR96nMtXt9087AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335386, "uuid": "6674a9cf-93ab-44a1-a2ef-82ac5eedf96d", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335386, "uuid": "6b7ac9ce-d18c-45c5-943c-653618553ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335386, "uuid": "a940cb3d-8442-484c-adf8-33c4170861b6", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf580a46-ac57-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676372839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372839, "uuid": "24beea30-7028-4da5-ad4d-04de2e1fc7c1", "comment": "Malware payload (RedLineStealer)", "value": "e5c50060f235d43959de0d992768201e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372839, "uuid": "f79c1ef0-79de-44c6-9137-ac41d93265e4", "comment": "Malware payload (RedLineStealer)", "value": "2db2488675ed3cd780a0a39a3b9636edf6e49a3a0af417133c5ea40de275341f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372839, "uuid": "80d43ffd-1d84-427a-9bab-a563d38878db", "comment": "Malware payload (RedLineStealer)", "value": "c3554b1c27d22bcb79d0a58d5e3d4b13e1f30b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372839, "uuid": "77df165b-8ef6-4528-830c-34f2a541003a", "comment": "Malware payload (RedLineStealer)", "value": "8fb0ef7afc32ab1ea2fa67582debb007c9c60fcddfb8e2f5b0d26951e57820e8874e4bec0ae5f927c0530134cf83a237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372839, "uuid": "bb0d77d9-0d35-4121-83d8-85d206fd25ba", "value": "T15DF41207BBE80161EDB15BB024F243930A773D719A38D39B2A8F6D191C726B4B934767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372839, "uuid": "074466ec-53f9-4d9a-bc66-62e5d6df56c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372839, "uuid": "39b29acd-5915-4531-9974-c86f6320ce6f", "value": "12288:AMrYy90E1G0eG8vwyHZGsnrFvuq1GCqI8FzF34GfgdzzRjdXMvmc11/spTrYZfyW:oyvQ0exSGr0QG1IkyG+LcvmZfY9yW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372839, "uuid": "ef8295a5-debc-47cc-ad66-41e993775540", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372839, "uuid": "bb6446b3-8029-49f4-a3cf-4960a6f5b33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372839, "uuid": "6d792880-9405-45ed-9927-55eb2acc8710", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca845ed-ac5f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676376270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376270, "uuid": "9c648390-00ca-4edf-be63-aaa94e6af969", "comment": "Malware payload", "value": "0327006c23fca38a8783a924bd1fcfef", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376270, "uuid": "79dde2cf-718d-4ce3-96a0-5866d36892ee", "comment": "Malware payload", "value": "2dbe3530adb3ddbd92211b549082e9657b657ed3efb0eae5dae154b6d1b1a626", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376270, "uuid": "ac131756-e0d1-4405-803c-9448fea7b0e9", "comment": "Malware payload", "value": "faa9819234752e96804cf12a69c79ff077fdf336", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376270, "uuid": "d7d4ad5d-d667-47e5-afd2-a1764b208617", "comment": "Malware payload", "value": "68435482b84fbb0b8a0b7bfa6d9bcc1d0fb955cdf0b4e19c47eb0900d34f45d591edc928694d51069c8557814d4bc864", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376270, "uuid": "375ccceb-2109-4d72-a902-e50c306079a2", "value": "T1DA4196E63C650939E0D2A14FB0E1B141632FBA6B41553035F1DCE4286F38A30E5A5F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376270, "uuid": "5634dd7e-87f8-4a33-94a0-3a0fe88a52de", "value": "24:Ee8zQdnNt1XS1i1UM6kdkHSfRXV8Y7mEBDJZ0rYsYss4Ovx+y7+4drgIv:l8T4UpA+Y7x6rY+s4OvIy7+qrgIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376270, "uuid": "a359ada2-89e4-4341-b1c9-85054dc10eb9", "value": 2141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376270, "uuid": "0d413daa-7538-4277-b244-59d2b17b8102", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376270, "uuid": "ffdb8d9f-59ef-46e0-8a25-5e81e1fc66af", "value": "discord_python.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61c2ab9-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676393546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393546, "uuid": "075e5476-a5ac-481f-b8a4-58a23a6c9c1b", "comment": "Malware payload (RedLineStealer)", "value": "4f2c7d8083c393915cd75115fae7b74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393546, "uuid": "2be3d407-ec59-47a4-be1a-71c554b5b326", "comment": "Malware payload (RedLineStealer)", "value": "2dd4034657edd0abb95ae936710845f021e3293d1ca9f5187de012010c02693f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393546, "uuid": "3fb5afd7-fb42-41a9-94b1-ea3a53938070", "comment": "Malware payload (RedLineStealer)", "value": "5eadaccc9110d5878cfdb7d03fa6f21ba5bf3476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393546, "uuid": "0956adaf-13b0-4302-84bb-b5274a3eeb03", "comment": "Malware payload (RedLineStealer)", "value": "2c5df21657715b0ad3be202cf819ebe4839f438eb1d7e0bdfd6143faa6b00e2848586e39931e764a9dba8f664d5dcfc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393546, "uuid": "5c3c1ed5-4e89-4cde-8599-d7fdcf65b60a", "value": "T1FDA40207EBE98462E57567B019F743C30A36BD505F38439A278B6C5E0DB36A4AA31337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393546, "uuid": "1c995152-146d-4863-8307-dc8ec00d4e21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393546, "uuid": "dad12195-07d1-419e-939c-62a0acf930f5", "value": "12288:VMrKy90wUwNW8AAv+byMZH+y2ycfLxYCe2xdVK:7yXUgLvcyhHyuLxMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393546, "uuid": "7ed27f40-bb04-4126-8f44-7737b12e4dae", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393546, "uuid": "02489273-9ced-477a-974a-1117c77a0979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393546, "uuid": "d54b0eb4-5ef9-4ff6-8f88-cef6e509ae60", "value": "4f2c7d8083c393915cd75115fae7b74d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fd9ea0-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676402272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402272, "uuid": "d662731e-3a9a-4c63-bd29-382b90d7bad0", "comment": "Malware payload (RedLineStealer)", "value": "b424a5a6058501862d99f1222888c171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402272, "uuid": "19dd7949-4aea-4126-95e9-65de28915ff8", "comment": "Malware payload (RedLineStealer)", "value": "2e2bc9d03eee65d5457bbd975bea1d07a616bf64f1b0a6466d9ceb5549473955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402272, "uuid": "6905cd7d-5dce-438f-80d0-7e1d2a57ce30", "comment": "Malware payload (RedLineStealer)", "value": "25c915bac91ae7e30150e6c18601ac1911364a6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402272, "uuid": "a1f1d56c-65fe-417d-8bc6-45077ce9135e", "comment": "Malware payload (RedLineStealer)", "value": "7193b247540283a50c0aeb75c8e44025574aa9b5433dfbd73a2b7bb50721b29172cc0690aba7589efb71cf930eb1616d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402272, "uuid": "31d3d4a2-8dc6-4f4c-b0bd-f473da0a465c", "value": "T196F41287E7E84123E4B567711AF603C316357E50A338839B268F6D9D0CB29B0763676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402272, "uuid": "fd4b7dc0-dbca-43ff-a9a8-5617833f7a33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402272, "uuid": "e3fecd6f-cec2-4871-8bc2-702decdec5ee", "value": "12288:zMr/y90OBIi+M+3vGllz2MD5xNF5QHY0OsMzf5Vkc15HGNR0Fp:Myt+B/EvDfNFSS5HV5HeyFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402272, "uuid": "8536cdc3-7def-406c-af5e-9f62536fcd23", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402272, "uuid": "cba6102c-103d-402d-b20d-05e54ce2cee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402272, "uuid": "2ead387b-3480-4600-9f75-939e37b1f2b1", "value": "b424a5a6058501862d99f1222888c171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85009320-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676408389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408389, "uuid": "96383817-1918-4a8b-b257-4bc30e58b9fc", "comment": "Malware payload (Smoke Loader)", "value": "d3d1bdf91ddb1e89baaff79d9362614b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408389, "uuid": "664b54ed-fe3a-497a-a1e1-82ffe61e82bd", "comment": "Malware payload (Smoke Loader)", "value": "2e38d79d03f31bc45af06b97dabb3cdf3044a104445e381e9ea1d2861baeb326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408389, "uuid": "0a167b61-7a88-42c9-afc0-b1457fa19823", "comment": "Malware payload (Smoke Loader)", "value": "95d9dc3b4eed15c3acdf370a2e9bda49fb72c892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408389, "uuid": "6cb0a2bf-598d-45d1-8b2d-f1e067444f6b", "comment": "Malware payload (Smoke Loader)", "value": "efbcbd5a71ac435c04ab6e217860db90965f842dfef94eb34860b42fe4a200c7f6a2ebfd5bafbb849672026f53029b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408389, "uuid": "5720729d-0da5-48a6-8a19-4216893a0b15", "value": "T17D14E132B9E0D07AD86785784474DBE49E7FB832B7A5845B2354067F6E203D04B3639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408389, "uuid": "8422fb65-219a-4af9-97f6-202a60b09fdf", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408389, "uuid": "977bb3cd-6f9e-4247-96ab-f6ef693d5149", "value": "3072:CIwfEN6GL03UYYFy5FUnTyEE9VQRLxzz1Tfh:VL0aFOyk90FDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408389, "uuid": "35a9b0e4-a287-4230-bb4d-eccc4b21d62f", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408389, "uuid": "c7912a7c-2ba8-469d-a4af-07655d82c250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408389, "uuid": "27985f08-6e7f-4df2-a217-f8be229249a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1f260d-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399573, "uuid": "48517e78-498c-4520-a04f-0fc3a8b350c2", "comment": "Malware payload (RedLineStealer)", "value": "4545238e0d43ba1ce29cf84e90a9a05d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399573, "uuid": "1f84c088-e542-4e5f-9d20-b2f71591fc1b", "comment": "Malware payload (RedLineStealer)", "value": "2e42dcb63ce6ab8e0c985e0e9c3b40a5ecbbe798b0a6c477cd39c123344c7d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399573, "uuid": "48d6cddb-84db-42c0-90a5-1c64f1eab470", "comment": "Malware payload (RedLineStealer)", "value": "dc6b2124d5df313dea32a18981ca42d9f2f3590f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399573, "uuid": "8de614ca-73fd-44e4-86e8-45b8dd57d101", "comment": "Malware payload (RedLineStealer)", "value": "8a538db7aacd46855f2f42cf828e56999760e04fb673098026283077e42f538317deebfdc836119b83493598ba77fa95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399573, "uuid": "4bb40cde-94bd-4551-a15d-e316b4188ead", "value": "T1E8A4014BB7EC4036E5B447B01CF602D30636BDB1AB38439B224E6E5E48725B0A67577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399573, "uuid": "573539fb-0fd5-4b20-be30-e4f6bf3f1c46", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399573, "uuid": "200c716d-0820-4ea8-9fdc-4c0f586f23b6", "value": "6144:KJy+bnr+wp0yN90QEnqa4bTADMyPa+AFI63UdJhMFjE4LmbUemMOrJyD1fXpFQ:DMrUy90doTAMd3IyQ4Sm9EZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399573, "uuid": "db30bea5-e2ab-423c-b4f6-6c17a4dff128", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399573, "uuid": "627ad224-7895-40bc-83f9-7031c2fe39b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399573, "uuid": "0b2b0349-e906-4cea-8981-30759b210bff", "value": "4545238e0d43ba1ce29cf84e90a9a05d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2bdfba-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (VenusStealer)", "timestamp": 1676363250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363250, "uuid": "600b95db-d375-4bcb-82b7-5d2202f76d82", "comment": "Malware payload (VenusStealer)", "value": "d58ce3bc7ea80069fbaa79b4db1e77db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenusStealer", "colour": "#0BA375", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363250, "uuid": "6abccefb-cff4-41ee-8228-243d08708058", "comment": "Malware payload (VenusStealer)", "value": "2e7371ac46e29730ed2739b041c619ea86d41a7b5032259a02f9fc8ac397988a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenusStealer", "colour": "#0BA375", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363250, "uuid": "ef3f7a08-c5a0-47fd-80d1-0cfa077cabd6", "comment": "Malware payload (VenusStealer)", "value": "28e970359d01c8356a586b5219e5ee10520db7bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenusStealer", "colour": "#0BA375", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363250, "uuid": "f37119dc-2ec2-43db-96e6-5ede1cf71569", "comment": "Malware payload (VenusStealer)", "value": "4e29a5685060fe51360e93ec0f0928ef4b5de8362b7bf64bfb0af71471cfc7847bf5996da9b799a861c4d53b91b22c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenusStealer", "colour": "#0BA375", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363250, "uuid": "64505767-13c0-479f-9203-78f7a26fde02", "value": "T1A1573309F2210C8EE51E977BADA2C1723179BEA5459086073A76350A0EBF6F72D71FD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363250, "uuid": "cdaa4b92-8729-4128-8e02-4d0a596db3dd", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363250, "uuid": "03a946c3-cda7-412a-8b54-540385c9513d", "value": "786432:coHOW5ueByuyVmGOHzeMKVxzx5cEoiVQZERuOd99A6mW894aQ:nZsNuyV5OHzDCd5cEoiVQZ2DA6mWXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363250, "uuid": "27d501a9-a09b-4275-9d5b-d188bacb20f8", "value": 28494093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363250, "uuid": "d1deed85-47de-4212-ae89-32437c6e8fd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363250, "uuid": "caee0c9d-596e-40e6-883a-7b4f000cefdc", "value": "Detailed information Diamond ring design information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b10cb3-ac84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392036, "uuid": "26fcfeb8-9e32-4edd-a41f-a5b43cba9012", "comment": "Malware payload (RedLineStealer)", "value": "fe4c0883eba2c1f26dd638142a5c6f9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392036, "uuid": "f875a266-1722-4281-b22f-9678f860738a", "comment": "Malware payload (RedLineStealer)", "value": "2e94a777e3b86474913bb95e457207c645956b53f41a39149418d806be8a6aa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392036, "uuid": "295f101a-4c9f-456c-98bb-2c47bc1fc5ab", "comment": "Malware payload (RedLineStealer)", "value": "6417d8b40c8737d4219a2978d757724c8d5ee06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392036, "uuid": "f420b075-f2dd-493a-82ff-0367adbd4def", "comment": "Malware payload (RedLineStealer)", "value": "16e29171204ce726706082665d3ee18c1c0f32b76bed271f85aa066f1440a935e8f415f32ef1f623b10cc027c2dba380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392036, "uuid": "15552a9e-905b-45af-ba95-a1f591519e17", "value": "T1FBA40257F7EC8072E9B157701CF203D30A357DA1AA38939E238E6D4E18725B4A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392036, "uuid": "f91d49a0-9cf6-470a-a98a-fe886185c840", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392036, "uuid": "c44d4df0-1f63-472b-9ce1-7cdda2dee452", "value": "6144:Kny+bnr+Cp0yN90QEfcIUP0LVPIkYFsmPBcLslftc1xUMThp1yc60+hc5Hur92zB:VMr+y90VZUMLVoGmPlftcnpKfF9FTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392036, "uuid": "493e9d98-c9e7-47b6-bab4-05a6cb05afd6", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392036, "uuid": "fc4aa86c-6b43-4f85-a131-f1cb9b0c6503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392036, "uuid": "acbbe5ca-f12b-4bdf-ba89-ee7e18134a1b", "value": "fe4c0883eba2c1f26dd638142a5c6f9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b5a95b-ac11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676342486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342486, "uuid": "a352b44c-ad3d-4622-85e7-34dede7026f1", "comment": "Malware payload", "value": "088430e0a0985f83fdc345b8c502377f", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342486, "uuid": "f9a94c48-5164-4556-bca0-296e9f293e0e", "comment": "Malware payload", "value": "2eb3840ed8fbd461e60747b78afa792cce1d471f2de7717f7d13ed921ccc5501", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342486, "uuid": "36a37485-7e16-4eb4-9892-998ab6d643e7", "comment": "Malware payload", "value": "1378cdee73f05e52999427a5dcf7cff9df5f2296", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342486, "uuid": "21f7b16d-1160-4f86-9168-3c91b900e637", "comment": "Malware payload", "value": "a13a2ad543635878b8ec7d51ad36ab3ab2c44cd718c52a202cd6033b449592e298f2b52c72c9f6fa716c94ac497c1f14", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342486, "uuid": "3a29b267-d9bd-47b4-b765-764f2a73416e", "value": "T1A72733A523584EA7D8D5253FCC1FC43D10A9ED121768D8CF81A8B31A5E73781AA37FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342486, "uuid": "0058a885-3ce4-4c7e-8218-4d432bb07a03", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342486, "uuid": "0f710d26-7598-4ac2-ba1c-c166befd9e61", "value": "393216:CxAlndYXAnAu0ptGT6K4/m3pFFqyoBgsSYCeBC4kYdiZW:DldYXAnA9ptGWK4Ky1UWRxsZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676342486, "uuid": "6a58c8dc-bd85-4569-9576-7b0c9ef32745", "value": 20499760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676342486, "uuid": "cd6cd7de-04f2-4b3c-a69d-06583d3de578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342486, "uuid": "f2785c0c-e00f-4ee0-b676-486eeb33d664", "value": "blbot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb3420c-aca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676404510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404510, "uuid": "8ef1dec6-e8e1-4ce5-a9d5-f6b514988e5d", "comment": "Malware payload (Gafgyt)", "value": "fb70e52eb260b1ff1d26dfb131aa2c2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404510, "uuid": "d8641020-5143-4cc0-9430-7fab1e60d21d", "comment": "Malware payload (Gafgyt)", "value": "2f14065a111a67d17da3625591fa0820031d472902402ae1cfb7fc16782feca6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404510, "uuid": "dd143f23-8750-4f5d-b6fb-5a8e7df896ac", "comment": "Malware payload (Gafgyt)", "value": "abc0cb7ecc0727dd9d9166a3e51a7cd457763c1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404510, "uuid": "ecb410fc-3e0b-49d6-b1d1-d6d613010f90", "comment": "Malware payload (Gafgyt)", "value": "0bb26d337d105a828320d03c0ef94f041cc68aa5afe16d2c13aa262fad08cc72c5a73168470d33cae89721e71f2ae9db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404510, "uuid": "6e0c532c-96c5-45d6-ae9a-1274599484eb", "value": "T1252443367C26D123C0A7EFB8AFE9BA92DA59F2D70F45910372E0106D0DF5959681FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404510, "uuid": "b4bc6653-4619-4d94-8914-5d300a818e7c", "value": "3072:mlyykcRLgrvkOtWS9lmQn0t4BMyi4dnHh5+mwmVuENm2DaX:GLgrdzA7t4kSnHymwmVuENm2DaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404510, "uuid": "da3feae7-dbd9-4fc7-a245-f2edb324197c", "value": 216179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404510, "uuid": "ca98420e-dc09-40a4-b608-ce55849823e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404510, "uuid": "5c2f8d40-d17c-497e-8d5a-f398122d5c5a", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6f3a90-ac59-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676373802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373802, "uuid": "5c1ab4ab-da49-4e0a-9125-199dcfa84d35", "comment": "Malware payload (AgentTesla)", "value": "b40e72f52bdfae03646792535fee83d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373802, "uuid": "7c983182-c8fa-4008-a70f-8950b0da4572", "comment": "Malware payload (AgentTesla)", "value": "2f55dbe8f4d63f160bb03799fe4d97ede37cb3312579464baf596769e875be23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373802, "uuid": "f47de013-e758-4117-ae61-4b184ce119a6", "comment": "Malware payload (AgentTesla)", "value": "5d8e32e477d74249d64a1bf0d2891602885cd09c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373802, "uuid": "e43ec6c8-dc80-459b-8c9a-50a454bf9b47", "comment": "Malware payload (AgentTesla)", "value": "272d6fb893d6eca84287d4262dbfc768e4acf422896aba8cff99568769eaaac0e404c4dfcd502276e65e931bd787727d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373802, "uuid": "673d5198-9e8f-4e4d-a54b-7d8a102ed38b", "value": "T1BD736210BE549163CD25B6F64D63A6D01177AE7098B6B62A349D33DA6B73F80CE33360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373802, "uuid": "c7f8a6be-e747-4c48-92be-2359672cdcbe", "value": "192:NbpoR61BG51zAfH1PkDL5mE2QYVaog6ktDOp+4Fm97R4JO:Nbp+63G5xCH1PkDL5meO6tDcPkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373802, "uuid": "fbb404cf-f832-4e01-8a79-74e3d98d4211", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373802, "uuid": "bd128a28-7bcd-4f0d-a39e-3394afb23641", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373802, "uuid": "02106b33-b9a4-4ae4-9c4c-ebaaacee8fe2", "value": "zamo\u0301wienie.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91219a6b-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392947, "uuid": "a736320e-28ec-4e90-b71f-65804ce3238a", "comment": "Malware payload (RedLineStealer)", "value": "b92ca5e1ddce2b8e043a9815ad2ce769", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392947, "uuid": "2494e732-9716-4181-942f-3e99b12d975f", "comment": "Malware payload (RedLineStealer)", "value": "2f5e3f426fd29b9cdb548e752ac502a438c3d5b8c1f2819e28dd8680509bfd42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392947, "uuid": "a1c37167-b1e6-4285-bc64-0597a22b6767", "comment": "Malware payload (RedLineStealer)", "value": "ca62a8e1f78879bd766190ed301b6c6770378233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392947, "uuid": "82b0a526-5a65-459b-8a03-6df511e2f0c2", "comment": "Malware payload (RedLineStealer)", "value": "65a3ce677bc0e86c71b11f1145d29c426da31b1a102958f5d2c2df3615df6ff9daa6c16e63b86208545667865b21b01d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392947, "uuid": "09bacd18-4842-4074-bc7c-3a9349fad70d", "value": "T1F9B40207EBEC9032D57657701AF703C31B31BD601B38835B668AA85E49B26B4B63537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392947, "uuid": "1529c264-c45e-427e-a52e-587546a3cec9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392947, "uuid": "2a8df3d0-6313-434c-8544-190a284fe0c2", "value": "12288:SMr5y90VcL12V37zcCBGG/9HloRKvnagVyOqfJB2IJAjv:/ytgVL9/9FoYSgVyl2ISv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392947, "uuid": "194378f9-49c2-4583-b65a-91d330e96689", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392947, "uuid": "4a9cee9f-5cdb-47e4-a3d2-82d9910e8f24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392947, "uuid": "41ffbfba-9661-4d09-8447-ff790c07354b", "value": "b92ca5e1ddce2b8e043a9815ad2ce769.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6813fbbc-ac46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676365391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365391, "uuid": "76d56c1e-5f31-4de8-9cf9-d8a539b025cf", "comment": "Malware payload (Formbook)", "value": "1b2504eaa55097312bfb5e80d81cf897", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365391, "uuid": "7adeb3f7-cc77-46bf-a911-3a650f4a566d", "comment": "Malware payload (Formbook)", "value": "2fb0a24e905687a5443fbe50d21033e4318da3275260bd82d016a9af346bb09b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365391, "uuid": "1ff9cb08-d2f9-4015-b651-c1da5a38a428", "comment": "Malware payload (Formbook)", "value": "7c58194fdc6db2123a9f90cb0b921a1859158fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365391, "uuid": "35fc3434-a2c1-4191-8559-09030e950673", "comment": "Malware payload (Formbook)", "value": "dccd59e8ce89d75cb440c0cac85fd3017bbae020a6704391ea2c8f0d24bb068b24d8fa1bffd615194257e910356c5aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365391, "uuid": "036f1e62-88d4-4307-a788-cca808f6071f", "value": "T18AC423A1314A536AC6F9EEF028F645476337562E3D12F61F3C891ADA2C43F068642F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365391, "uuid": "e53a5a85-359b-4505-91ed-08edf3bbd324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365391, "uuid": "b39fffae-8cb2-4645-bbba-8554d92c089a", "value": "12288:EVFFZ6qCmhX6OibPBNXB2Fx2JUkcLtRosYEykcvjSCCMO6apu:i63mlSjmqUkOtusYjkcY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365391, "uuid": "8d4ad209-ea52-4550-88f8-aa0d5bf93c64", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365391, "uuid": "8752a247-db1e-4de2-a7d0-e0aa1b3e9b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365391, "uuid": "40fbae8b-ccc4-4650-a497-f3686dd5434b", "value": "SKMBT-283202109080.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901fb8d0-ac00-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676335393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335393, "uuid": "0ea53b00-f7a5-4569-92cd-fd7b8aac8976", "comment": "Malware payload (RedLineStealer)", "value": "5d5b56fdda5b9d0c61fd826aa14addd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335393, "uuid": "eaee56b3-3ac8-44ec-afa8-e61b517eab6d", "comment": "Malware payload (RedLineStealer)", "value": "2fb829977f9a5754d1aa63a839e4784957358ce6226d352119190a77b1997954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335393, "uuid": "bc22adaa-d650-44d2-b606-0ae39b5485bd", "comment": "Malware payload (RedLineStealer)", "value": "5f9e65cbd7355dce7cffb34afaf55ccff7deab62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335393, "uuid": "f0f7b239-3668-4df1-a3c4-2cad296b9ce8", "comment": "Malware payload (RedLineStealer)", "value": "8e63fb74614443d1ae7a553c8c30123b83330da2cfb1e68fc62570634ea97d7105dea88a7119b8842d91d9b4f18f4859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335393, "uuid": "8243fe72-c59d-4182-843e-ce3ce417697c", "value": "T107457B01A3B2BCFFDC31D13115B09637DD7DA8A9CB626B9B7790061A4AE0E818735BD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335393, "uuid": "61406d97-750f-4933-ba5e-2252af782b1d", "value": "ebd11b3f90837127466222812adfd903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335393, "uuid": "595a5297-7f6f-4b87-891f-0ae635493563", "value": "6144:Y6CmwN1xa/D10vuBstts4GQn9AFNFEnAOBu5hOTcq/vewup4k:9mN1aD10vuqsOgm4OFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335393, "uuid": "3080df1e-5271-4909-af67-e09cc9ffde1e", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335393, "uuid": "6b4065df-24bd-4c76-950a-fb9d984ce1cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335393, "uuid": "3bbff246-22d4-404e-b6e8-73ecc145241b", "value": "loader2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc04c2a-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676398901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398901, "uuid": "8305beb8-3482-4d99-ab10-45130dfd8f88", "comment": "Malware payload (RedLineStealer)", "value": "5bdbab78c87843799480fbdc3fe7a636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398901, "uuid": "200445b7-962c-439b-824b-8a551b2a725a", "comment": "Malware payload (RedLineStealer)", "value": "2fddae0b070cd2391ee2e5e4fdb23fc24ccdf822a4800bad8d7981ee455a37a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398901, "uuid": "cdbee99a-cb64-4f4e-94cf-8f6f5e3a5cf9", "comment": "Malware payload (RedLineStealer)", "value": "d064468928916b915f603422a5e0b84faf5d41cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398901, "uuid": "072f6ca3-e0a1-4223-87a1-19c1591a371f", "comment": "Malware payload (RedLineStealer)", "value": "ef62d6c353e757b51b568c2c5d4d66dc689ee6ccab1ae5809645302697c44dfab05971de74f631bb2c527a491e4c3bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398901, "uuid": "ae579793-a315-462d-bcb7-49bcee0dca02", "value": "T1B2F4124BE6FCA032F4B517B02CF602C309367E605A3982BB664E581D59736B4FA31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398901, "uuid": "0e34886a-c1b1-4a0e-b2a1-7af8e725bf25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398901, "uuid": "f9fb35d3-214d-4ed0-a88c-c58fc1cd99f1", "value": "12288:6MrUy90rJgob6ppUKwLTm2kwrhDNeJUXNF6466UCaVPp/41FYdkcB5HGyXzP7HUL:uyegU6ppq3rD0A66d8PY+dh5HBDP7H2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398901, "uuid": "fe1e2f62-dffd-4ca6-b167-4f0e6af320cc", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398901, "uuid": "a922469d-2ce1-49ae-95e2-dbfd4b41c374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398901, "uuid": "9f1afae6-0ff0-42e1-a353-3b9cb5303d37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c21f0b-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392960, "uuid": "d7e9517e-9219-46bc-8a49-98edc3c10a56", "comment": "Malware payload (RedLineStealer)", "value": "1b6846aad4413fd691b17948eaa2e931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392960, "uuid": "8b013a7a-99a6-47ea-8242-2c49331a05eb", "comment": "Malware payload (RedLineStealer)", "value": "3094f53203380d842e1da4b2816872784cb332f10ca3763015c1b37335d875c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392960, "uuid": "63d13d1a-9756-44c2-abf8-a8cd39863fb3", "comment": "Malware payload (RedLineStealer)", "value": "7e9249c44d7edb5c1b15c49073bbaa5c1d13095e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392960, "uuid": "0e5d40aa-b0c0-4b29-a80f-80f1b08f294f", "comment": "Malware payload (RedLineStealer)", "value": "4dbaf6fb244679cb7ff2f4e9744f6259b2d7b44833301be92b2871e64f37bbb95f8cb6590bb39d0df4ca0d561ad537f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392960, "uuid": "f002f97a-3ab8-4b1d-bbdf-2f7375d98e43", "value": "T187F4120BF6EC9136E8B557702CF603C32D317E204939839A274F9C6918B26B5A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392960, "uuid": "ca41813c-5ea3-4f44-a290-0658b4280ca3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392960, "uuid": "a5340a42-ea5d-4f4c-a7cb-c8f122a207f0", "value": "12288:hMr6y90ZFeBJVBCTADhWLnrDxNwF/4GQd9PeBIZpAvCSW0RzzQ/kU:byOsDVB/WnVGQD07vCazc/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392960, "uuid": "19cde842-5611-4452-8a5f-714a3fc2cfd4", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392960, "uuid": "66245fcd-a48b-49ec-8dd9-6ec4bf65d031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392960, "uuid": "03950f9b-9d30-4bc7-b8b6-e6d867a58c14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2da3ba-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382715, "uuid": "8fa16f78-e5cf-424b-b180-08b7b6d48e18", "comment": "Malware payload (RedLineStealer)", "value": "55781de9a9b6b315c00b17ed780dd272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382715, "uuid": "4eaddc09-b6da-49b9-8a14-c5550883e1c3", "comment": "Malware payload (RedLineStealer)", "value": "312620f833f021774fd66f84a7cdccc2c95ab3f934386abffb13da5754bba86f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382715, "uuid": "590bcb46-7012-4c64-a473-d30f576441b1", "comment": "Malware payload (RedLineStealer)", "value": "dc3039aed37acccc862a2eec317d60fe4e8f495f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382715, "uuid": "c2cc7b22-777f-4980-a056-1f80c04c2655", "comment": "Malware payload (RedLineStealer)", "value": "21ee679395b57699e22649a19d0cd994bfc82251ed09bf107bd9ff4e0328909316562f6f8929a23077c0f676d3375851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382715, "uuid": "56d9f039-7d99-40a5-9e8f-fd3771e55b2b", "value": "T1DFF41203E7F88131E9B167B045FA12C30535BDA05E39478B674B6C7E08B2AA5B63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382715, "uuid": "a0cde022-4abc-4df0-ba48-d1fea28b44d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382715, "uuid": "a2c8b70c-52ef-4e01-8ede-5276203fd777", "value": "12288:EMrmy90ttNr7d1WENtr4W6erMD5FIg5JnzpRYj8AnMKiNeC7:qyutNrDLraDnIgPtzAMoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382715, "uuid": "61299346-360f-4e68-81db-4ab8acda1669", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382715, "uuid": "242551e8-aff9-4912-b5f1-52d36afde1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382715, "uuid": "3cd49d94-6d22-4cbf-94b5-3eaea99f3401", "value": "55781de9a9b6b315c00b17ed780dd272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d857b7f9-ac52-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676370733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370733, "uuid": "31701493-994f-4579-b995-6e91afc7f688", "comment": "Malware payload (TeamBot)", "value": "dfc608e08849b60d39c69bd24bcdc63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370733, "uuid": "616a2b7b-127d-4948-bd93-edd407ab331f", "comment": "Malware payload (TeamBot)", "value": "314b7a6d969a0f4654bb6b3a80a58087dac25c26c5777270b0f53056ec5645c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370733, "uuid": "62ddb816-40f6-414d-b6f7-0a21ca185862", "comment": "Malware payload (TeamBot)", "value": "7775aa1574ee0ca33303aac8d6ab8fb0caaf5d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370733, "uuid": "b993ae2f-4ea0-44e4-8ee6-24a2fa390981", "comment": "Malware payload (TeamBot)", "value": "9e771481b7239f2e6e500a040d7575eeda0813ee946c9c30d20ca16b397a179c24e19da109bef1c4c3e48982e64863be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370733, "uuid": "cc4b4543-87ad-4974-b938-ac79c1e033f6", "value": "T17704DF11B5B1C073D1BB46706730E1A0166FBD726BA5C34B37889BAE2F302D1BA35766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370733, "uuid": "0ed3a8df-977e-4f82-aa2b-908771d70f01", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370733, "uuid": "d87752fa-7d9f-4474-9b8b-2c0851bb600b", "value": "3072:ioTELlVv5n/hWnGZTHA3Fa8Ni+qMhoWdZZQp5S:RwLlVZ/UncgVv0+Zho8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370733, "uuid": "3cd1daca-9eb9-4eca-b574-20b84165d9b2", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370733, "uuid": "9d49ccf2-a0a3-4419-bed3-8a7589d1f40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370733, "uuid": "a28d5c5f-cee4-4981-b696-f50473f8d442", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb10435-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676382501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382501, "uuid": "52a0ae0e-1df1-4caf-918d-7cb4a7c7354f", "comment": "Malware payload (Loki)", "value": "2ae88e2d27202ce5fc3485abbd6103f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382501, "uuid": "3ab865fa-812c-42b6-87b5-52b9f108e7a4", "comment": "Malware payload (Loki)", "value": "31c6893939135e03e2bb8511f21eac8599bcf302e752a37f6aa912c4d9990242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382501, "uuid": "04be75fd-a6d9-41ab-931d-596322a991ae", "comment": "Malware payload (Loki)", "value": "75004af586165041020fdce420efbc2719177703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382501, "uuid": "b087f3a3-05e8-4410-801a-e7f70d03ea0c", "comment": "Malware payload (Loki)", "value": "61a9b3e47ebc269d90ceb921008fa014a7b7077a31c53d197dceb2354647559b519f5b644ab5fe4c657b12941d5cf98a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382501, "uuid": "397cf45d-b6d6-4e97-a9b5-e59f510cea6e", "value": "T153A4134491AA279BD5FC8FF028A1514237313AAF7552EB071C4B60DC3E8774651A2BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382501, "uuid": "9d29addc-b162-42ac-8656-0e9e87ac9f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382501, "uuid": "cdcd54ea-da17-490e-a550-ae0772f049b1", "value": "12288:ZFFZ6FE752u/g7X01HCXYWoqeWe0GB/K:z6FE752u470teYNjWe0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382501, "uuid": "0ac52b5c-52fd-4154-9a9c-5e80e0945ef5", "value": 493568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382501, "uuid": "8b42e4aa-3482-4009-8949-9c852751f6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382501, "uuid": "73014543-dc12-453a-baad-717ebddc6b97", "value": "31c6893939135e03e2bb8511f21eac8599bcf302e752a37f6aa912c4d9990242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d27a83a-aca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676404779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404779, "uuid": "43e81d37-891c-4b91-9c28-b654a0c7edf4", "comment": "Malware payload (Formbook)", "value": "53ea11365ade963592f3aed97845059e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404779, "uuid": "f7cc939f-262d-47dd-ad89-a009c584da39", "comment": "Malware payload (Formbook)", "value": "31d4fa7c04a77660000eeecf8f66e38d6108f460ea7b539744d7bf9216266a50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404779, "uuid": "ba9dca44-fe5f-4706-9bcf-06e6ff44bf40", "comment": "Malware payload (Formbook)", "value": "cd7ca6d3e9e2c3983acbed0d5ae04ef89e9f9e21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404779, "uuid": "c42ae12d-d64f-44dc-8adf-b2d2f63b764d", "comment": "Malware payload (Formbook)", "value": "7a325136c488dcb801e08c89e75dfa47232f818b95164f045acd9473ee12e52e44426ced7aead2a99777f96eb2074c72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404779, "uuid": "bfc0079f-feb0-4498-b070-b80602b467a3", "value": "T174541214F2A1C067CA6216B27DFE06A31FEEE90619F0934B7700AB553871E82FA59357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404779, "uuid": "3c693f5b-ffce-4e1d-8d9d-0eebb82d2472", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404779, "uuid": "2475aa08-64d7-454d-bbe3-839bb3e41715", "value": "6144:/Ya6BuI9iJD0Mbh/KZEm7grD5ZkoItEqHVuHF0Vmg7z9LseLgH:/Y7/cCMlSZEmcrEEnRQp4Y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404779, "uuid": "5617ba67-55d2-4382-936f-9d8b4b427fd9", "value": 291130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404779, "uuid": "115a7337-94cd-4f0f-9952-4a7e92370c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404779, "uuid": "17f9cab1-6517-4293-9eb8-707b32ddeecd", "value": "53ea11365ade963592f3aed97845059e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df9cc76-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676359441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359441, "uuid": "562f273a-a3f8-414a-8978-56b13a1677e0", "comment": "Malware payload (AgentTesla)", "value": "1ac20ea6f693057e38bc68ed2d0273a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359441, "uuid": "52964e1d-df5a-4f9b-bbe9-55d852f2cdc6", "comment": "Malware payload (AgentTesla)", "value": "31f74743aed6aabe5af121a44785c9e68b951a7d16849873d346503d79868246", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359441, "uuid": "f3daad10-1507-4e18-8de8-15f9a08ed055", "comment": "Malware payload (AgentTesla)", "value": "b6a439786246e31f249202fa940a7eec171b74c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359441, "uuid": "d061c40c-d4b0-4b11-8972-ffb0c157636f", "comment": "Malware payload (AgentTesla)", "value": "136de901b50f7509155406204f9ad1621697f7d0ddb719ec07fa5cc152f3e5816b2a76cb2eabc7a4551e39cd76973304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359441, "uuid": "8df1f3e2-ac8a-472f-9bd9-f18f63a522ec", "value": "T12E742360A68CD8A3E663133035343BBB6AFA4A6415B9474B0760DFDC3A6B441ED7F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359441, "uuid": "e636bdd3-b8ee-40fa-843e-43f33a9ccf9b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359441, "uuid": "e5452655-0fd7-430e-a650-fc5f4c366490", "value": "6144:/Ya6LJ9NcS8A+h445yf0vf+xJ2ZbDoGO1JL4f1G422D/mYGEBznP0Zz+y/X:/YxTOSUhD53LZYLb4PDe7EiZz+yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359441, "uuid": "83d7b80a-8a8d-4342-812b-accca94836e9", "value": 337328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359441, "uuid": "7983149c-6969-4734-b1b7-6b32a7cbcb34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359441, "uuid": "234bb1d1-490b-4bba-b61a-5d77c479886c", "value": "order for february and march dated 02142023 NO00384855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea357655-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363462, "uuid": "3f605d07-2a9a-4f1e-bed1-8a232e2bbc01", "comment": "Malware payload (RedLineStealer)", "value": "2265a275c2e22852dd633f765da8a2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363462, "uuid": "7fa0ea6a-7a59-40fd-9a70-d71357ea9fd2", "comment": "Malware payload (RedLineStealer)", "value": "32296c4479cb1a6124baf168a247824d1068b269ac88f690d0d437a018c1e858", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363462, "uuid": "b773e46e-101d-4158-a761-77ee0ae3c339", "comment": "Malware payload (RedLineStealer)", "value": "964f75d78748573c6f4585b1860394dfab1c07d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363462, "uuid": "00c179a9-a4d2-4a41-bba4-0c6dcc28ebf2", "comment": "Malware payload (RedLineStealer)", "value": "7929273f4af67248ed288865a95956784efc3b5da11af888cd1b0ca71aa96338ef44d8d383ae28031d1a0813311c8526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363462, "uuid": "a309133c-6be5-4d97-b2ad-d87cb5346f4c", "value": "T1AFA40207AAED9032E87067B049F703D31A377DE19B38837F274A5D0A1872674A53576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363462, "uuid": "1bf65ae1-f478-495c-a554-71cd6c526f9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363462, "uuid": "5dbd8cf8-a301-4a96-93db-3be6b23c573c", "value": "6144:KPy+bnr+Lp0yN90QEwrwya4LTAHFyaa+1O+Gho6IjkABIwshrRxofCif62invEA+:xMrby90W8QTABO+GhwIwPfravEpThwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363462, "uuid": "9744c0f3-98d0-4a40-9b0a-32eca172bffa", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363462, "uuid": "376abb53-7f02-43b3-900c-6b52bf31e0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363462, "uuid": "b6e39e3c-50a8-4698-b6e2-b538b9b51cf6", "value": "2265a275c2e22852dd633f765da8a2f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53e6a1d-ac78-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1676386968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386968, "uuid": "9d33bdfe-198a-4181-a93a-2b9ebe959ff1", "comment": "Malware payload (DarkCloud)", "value": "f887d56a8c442677fa724d3faf86aafe", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386968, "uuid": "9de69d6e-b41b-40e1-8da8-58ff6e0ef072", "comment": "Malware payload (DarkCloud)", "value": "322eb06a1c789fa91c8e5e9aaaae961552669ae055606e7b8be8cc31dcf0dce7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386968, "uuid": "a18c3dde-3d4b-4605-99b4-d0a33705ffc5", "comment": "Malware payload (DarkCloud)", "value": "f87552c2cb912299fce50b1f5e3a09dacfdb1f79", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386968, "uuid": "da956b0b-d1bb-45bb-ade9-648cf54911a3", "comment": "Malware payload (DarkCloud)", "value": "b6c379bbd0a3827b21566a5bdc266da40a6c0544d5e24be6e723f3295a924c0996f3d113804ad9291511d68ac75002a6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386968, "uuid": "f11a91a2-9041-4229-9568-f2950978b512", "value": "T16DA423501FB4E47FDC1749381BAA166A6FDABE2394D4C29B0BA407BCB4739558F0C362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386968, "uuid": "38de23a9-76a5-4b6b-9b4c-c0d1ee04826b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386968, "uuid": "a8b88db3-3f67-42c8-9ec2-de5525331d10", "value": "12288:RYWJFILPzIfF78f/EHBE6Zop+vq5BTRDchmjVdc:RYW43I978EHB9IBTRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386968, "uuid": "3f10cf72-0a4f-4f25-807a-7dff485c2251", "value": 490567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386968, "uuid": "e0f6f8ac-1184-473a-a6de-cdeb0e19ef75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386968, "uuid": "c1984ac1-b99e-4d9c-bc8b-d91ab75e8938", "value": "STATEMENT OF DUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a70194-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676382515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382515, "uuid": "882cfeb1-b8fc-4bc1-ae2c-1d9d2c823bb3", "comment": "Malware payload (AgentTesla)", "value": "6b8d3a38e5d73988f153e9d25761af23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382515, "uuid": "be02cdbb-bb39-4454-ae4b-e4cc73211819", "comment": "Malware payload (AgentTesla)", "value": "337fd7902188a3c29f45ba71a1a95fd640f445c084c9e1976934a8e998583dce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382515, "uuid": "5a251ec4-1a36-4e17-926b-0b02b0fbc912", "comment": "Malware payload (AgentTesla)", "value": "59650df61f01f2e31803095299a535e42ba29ec1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382515, "uuid": "1e4b6f55-c16c-4a40-a520-5d362c9c7b95", "comment": "Malware payload (AgentTesla)", "value": "ee3cd0abb80c92a4d4027567481fa4f83f1687c0f389174c2653e4a48a176d7a8975c118215f60b9ff194aa7916a7211", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382515, "uuid": "47561229-b709-4f10-8cbf-cd258e388004", "value": "T156C41354614973DBDFF89BF218F0708657723229AC13E60B1C8A29DC1E46B028695FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382515, "uuid": "82381467-e380-4182-89ed-166beaa2265d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382515, "uuid": "56fbe587-0b12-44d4-b842-91684ea3a8a0", "value": "12288:HFFZ6DG7Dkbr9hpKNmj9q1FCDkxGfMW8N+8mMCRtKFO48HsYfjEKu+:B6aXk3TQqkxGY/8/Sx8JbEKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382515, "uuid": "9e85744a-3bd8-400b-b033-563f0fa657a7", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382515, "uuid": "0bec054b-2b4c-47d4-a1a6-45265fd86f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382515, "uuid": "b8328a25-3d8e-4f74-af8a-b16652d64397", "value": "BvjkVJLmWdPNSBS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea05b68c-ac2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676353583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353583, "uuid": "1d065ca3-f782-44ed-8ab9-4e080813fab1", "comment": "Malware payload (GCleaner)", "value": "46aee73c0afcd1be6ead7ffefa94dc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353583, "uuid": "16605e26-61be-468c-b798-f468c0d87886", "comment": "Malware payload (GCleaner)", "value": "3448a05489e05b1a462517f19b876b46b898d69c03134ed73fe1b513bd6ee7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353583, "uuid": "fb8e0ff2-4a50-4941-b61a-f228ca51391e", "comment": "Malware payload (GCleaner)", "value": "63e069a1d118fcab99e7eeae0165eb54a3e0962f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676353583, "uuid": "42808aa2-292c-46e9-a1ab-925f18b3fb0b", "comment": "Malware payload (GCleaner)", "value": "38fb027db2c2186594d939f3076cbe4617046ace0ec1a3895fbca2d39fa6ca2ddd8176f179e5761278eec2ce29892a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353583, "uuid": "b61f79f1-d007-42fd-8b6d-95dd6af334e6", "value": "T15BF5127C7105C99EC280BDB88C36D8E72CD66EE399E0952270DDBF3F567D2889A09507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353583, "uuid": "33ae03d5-4783-4951-ae24-59aca0abf012", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353583, "uuid": "225c9be8-2415-46a2-a4d5-61a2f3f3d0dc", "value": "98304:JHh7ol5zJMIaR2fnu2L9mFP9lKnBl66XY1ZMv2MR:di9MV2fuo8PsW6YZMvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676353583, "uuid": "9de5b840-5562-47ca-a0c8-78c886d14031", "value": 3368899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676353583, "uuid": "c99cda98-65ca-4025-bbbd-085ff6a44690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676353583, "uuid": "32e3806d-4a0b-4db4-b971-9dc039abd0a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad7d076-ac4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676367140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367140, "uuid": "1852252a-e19c-4794-abf8-a3f0343c2822", "comment": "Malware payload (RedLineStealer)", "value": "1a217ea76fbff1cbfa230408221a86c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367140, "uuid": "c3777739-d385-4abb-89f5-c525dd311ff0", "comment": "Malware payload (RedLineStealer)", "value": "345e48e91ea6a7bfada321010271509be306f8b5447058e2af6ef4cbf62d4c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367140, "uuid": "29dde67a-4876-4dd2-8134-316b42b8f9e5", "comment": "Malware payload (RedLineStealer)", "value": "1ba152ed69cda76858ea2882644ae205578087cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367140, "uuid": "2a0f7247-f06a-4f25-a94e-c3935445cdd0", "comment": "Malware payload (RedLineStealer)", "value": "d0bb95a9f3db6c8eebec865248d9ba7927d4b763b4ea805b44fe97e5a861ca1e6f450e5ed722b3b81779e9e77d29a29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367140, "uuid": "03018911-fd99-449e-af6e-a2ac04998127", "value": "T1C954F11275E18D73E8E786309520E6942A7FBCB36FA3C18732541AAE7D313C1DEA5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367140, "uuid": "f8aaab82-f11b-4139-a2e4-76920e49ecc2", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367140, "uuid": "19b29771-ae55-4eeb-b124-5cc39d4fdf9d", "value": "3072:ZonSLr9J95f+JU1w3pQBVezuGg9wpZnulUUooMgYwp9YaEHNXChxDVeIFhq3mE1P:CSLr9JP5EkVeuz9wjnQYgZQypdFo3j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676367140, "uuid": "d7a27dce-478b-4414-b1e1-7962704caa7d", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676367140, "uuid": "c55f58e2-8c5b-48b9-8c07-10a81aa3a99b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367140, "uuid": "180a1c0c-2838-462f-b0c2-22c182ef9de6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1390fd0c-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382429, "uuid": "4f6e514c-dc60-4801-8a9a-3be4226d8fa8", "comment": "Malware payload (RedLineStealer)", "value": "160037935d9bc45d1fa352acf35ec22d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382429, "uuid": "6c9098c4-11f3-431d-b55f-bfc1439b3b10", "comment": "Malware payload (RedLineStealer)", "value": "348e52ae011426668da86551a638237f233048ed572f5cce5d083397e5ccf60e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382429, "uuid": "20c969a5-3451-4925-aaa2-537bad2887c2", "comment": "Malware payload (RedLineStealer)", "value": "84c1e00ef0b5e47009cfd1d375b130d920c5080d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382429, "uuid": "6e979b19-44f1-4d26-8e05-ba910d14abaa", "comment": "Malware payload (RedLineStealer)", "value": "726e18145d8aeccfdeb13ac2f036cf48ef570e6eaf0b7c7e05756f374c5f3b7e6171557ffeaff4082275d534700811f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382429, "uuid": "b517e152-e9ca-432a-b938-24e9fdf331f4", "value": "T195B4020BF7E84132E8A90B7059F603D31A367EB05A74829F278E9D5A0C721B4E53536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382429, "uuid": "672faad9-1d90-4ea6-bfd3-752414607a57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382429, "uuid": "1c2a0fe2-3876-4aac-bdf8-d1b50cdf018d", "value": "12288:RMrSy906uUWHSeWTIWPq+NAO4A1cgLTDB5PUHgFEM2K:byBBG6TJPq+NAJA1t3DrPUHgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382429, "uuid": "bb49dd3c-6527-4f59-b930-e8c82e1358d9", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382429, "uuid": "cae9941e-92b2-425c-9c9b-f24ebbc236bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382429, "uuid": "69e706b2-2037-4611-8ec2-2d8c42139f65", "value": "348e52ae011426668da86551a638237f233048ed572f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d6a7cb-ac8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676394947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394947, "uuid": "012017a6-fa0d-4af1-bb3e-0ca40bb2848a", "comment": "Malware payload (Vidar)", "value": "c9eff7064828ed6307c80cfc1a12bdc7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394947, "uuid": "5144f851-a8cf-4cf7-9357-5bccc570859d", "comment": "Malware payload (Vidar)", "value": "34f355d0ad2c3fc9b79bbf8ca01e658c59b4609c3ba91f89ea2fb7766299a7fd", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394947, "uuid": "7be65490-398f-459e-9b89-bb51b52ca829", "comment": "Malware payload (Vidar)", "value": "fd9f76567997da7f703e4384cc869ae25a4643e0", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394947, "uuid": "e50c1944-f7f2-4ad5-bfe7-0f81a6062436", "comment": "Malware payload (Vidar)", "value": "af5cb2bb95b37914eec61af49c93ae684dc54e43717a387c42c64fe269fd19e002159755213bd4aa3ce29fa41c644f16", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394947, "uuid": "205b4e78-93ea-4b13-97cc-a11a1eb01307", "value": "T12586330985597C898E9E32E4D4AE1873739517B1BEAAC3A38F87F3B10F107594EC94B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394947, "uuid": "78b3dce1-460b-49d9-8b05-e3d33035c41f", "value": "196608:4FuIb8H3GaXD2gjWawDtZqz1pmmmcboiF1oGjmgl6Oo/Tv5Xmul:Do23iBpsam4iLoGjmE6OITR5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676394947, "uuid": "cd90b2ea-b2b2-4436-823f-eb9119af9ad5", "value": 7976645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676394947, "uuid": "549dc2a9-2125-43e2-b5e3-20b0db106c06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394947, "uuid": "0f41f315-a5be-4649-8497-af2c058bc697", "value": "Unlimited-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f83ccd1-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676402286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402286, "uuid": "dd25fa80-4d18-4ad6-8256-a0455ff41937", "comment": "Malware payload (AveMariaRAT)", "value": "20f53a9142c57034486e53e5bd338fd3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402286, "uuid": "1207617c-342c-4e6a-9817-9380a80de2b6", "comment": "Malware payload (AveMariaRAT)", "value": "34f8317c88180f1c229d69b940838a794b80ea6dcbdf0082e01720177adb468a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402286, "uuid": "16eda6ce-745a-4682-8e73-4415352b6698", "comment": "Malware payload (AveMariaRAT)", "value": "89320dfb38d2e1f197e11ba82345ac0892ee9f7f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402286, "uuid": "4396ba74-c7c4-49e4-a5e1-5a247fc24e6c", "comment": "Malware payload (AveMariaRAT)", "value": "7f15d10632afe1eb06a45404f03abe851a78e1c975bdd6d0c1e33f22485bb156f5a50d927d17dfcb202b728ed3aa5658", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402286, "uuid": "86e762ec-6ae3-4379-9dcf-b06ca90998d0", "value": "T1B085E7243FEA901AF177AF769AF035999B7EF2633707965A105403864E13B41EDC223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402286, "uuid": "570fcdce-befc-44a0-89e1-47421542c751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402286, "uuid": "95210c17-8783-423c-adb2-09a22ce736ae", "value": "24576:ga4DeDaAyXWZagcHPhSeTBIqq4xA1XrNiR9GQCj:ga4DeDapXwagcHvBAGr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402286, "uuid": "615b4aea-1f7f-4d9a-853c-9e2ed9c5b7b3", "value": 1843712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402286, "uuid": "a790fc8d-422a-4060-90a7-bef20b286236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402286, "uuid": "c98a6eef-fda0-45d0-aea9-162903ddbc06", "value": "20f53a9142c57034486e53e5bd338fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c130a0a7-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391740, "uuid": "b3b1d3ea-6477-41f5-97a3-ae40d06e5e5d", "comment": "Malware payload (RedLineStealer)", "value": "eacace4ffbea293143ee505bd1d87e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391740, "uuid": "61b073f2-2509-438d-bad4-3fe8ab8b5b72", "comment": "Malware payload (RedLineStealer)", "value": "35451ae63297d6ce45c14fae434d2dde344967e7280b2331fe2bcba787982670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391740, "uuid": "9dc02d15-96f9-46de-8868-0b28d18452f6", "comment": "Malware payload (RedLineStealer)", "value": "369dc67290a44b9f560fcc044d4d6f13d4fe7d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391740, "uuid": "1da58ba8-e90f-4475-a280-2bba38678626", "comment": "Malware payload (RedLineStealer)", "value": "b865456133cd1e18f40fdf371a5be786f4d2520416508f87cf25f2f93ab5de0d2bbe129da61806f3408a8bf4afa8659f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391740, "uuid": "fcfe0e79-4c61-4baa-b776-753fac8b194b", "value": "T1D1B40207B6FC8132E5F953701DF602C3093ABE506A38969B634AAC1D4C736A4B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391740, "uuid": "ad4e277d-b5da-40d6-8bb5-25f58154f04a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391740, "uuid": "2ac9f5fb-683b-4d09-9a8d-0bd29514ad32", "value": "12288:xMr2y90+tt9dpJWRfltL2Rx2rBL3y7xJnPzUsCnp41qPd:fyJt9djWx2qL3y7Hupfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391740, "uuid": "f49d5b50-e1b8-45a2-8da1-9fb4e9958448", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391740, "uuid": "559e22d1-709f-44e5-b26d-6c6442e39a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391740, "uuid": "f19a7e87-03ba-4314-848c-21a6adfdf025", "value": "eacace4ffbea293143ee505bd1d87e85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a757fc3-ac98-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676400667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400667, "uuid": "d4e81750-1eec-44c4-b638-4585cb937706", "comment": "Malware payload (Amadey)", "value": "4afbc3993ea4b3fd6dcfe39b2d641bdf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400667, "uuid": "a644a6b3-f4c1-4dc5-9537-d6075dec1046", "comment": "Malware payload (Amadey)", "value": "35b8738a6f1aecb49468b41e36231dd09d2a1a8c578c82aea64d4e7c59f30985", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400667, "uuid": "237be6ac-eca2-4429-bf0e-f645836f1118", "comment": "Malware payload (Amadey)", "value": "0793819d454016c2396e88b44eacc27989503448", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400667, "uuid": "2836fb62-b9ac-4e2c-8f06-ce3142ac3696", "comment": "Malware payload (Amadey)", "value": "edcc674faca81d123c62ba93be3e6a5d862cff899008922d18854f4f97da7f5816966fdb5cdf2707fc327132f0ea6fc7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400667, "uuid": "bd04bebc-08c3-4e6a-a952-658586f4505e", "value": "T117F41247FBEC9032E4B157B058F602D30D367EE15B38439A628E5D1E1973AA0B13977A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400667, "uuid": "bfaeb648-47f4-42c0-95f1-c581d093805a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400667, "uuid": "d3bc8651-7f0b-492d-bf73-8064ccdd0a44", "value": "12288:EMrry90us2G66ppQbuz4uAmf6n+3Ft4qwDRLNMpzj5kci5HG+RBXl+KlbSi:/yLxG66ppeluG+0qUFNMpz1C5HV3V+0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400667, "uuid": "196e5305-2a4f-49dd-89f8-edf651ea4452", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400667, "uuid": "1a0a1b9d-c0f9-42de-8ba2-58bed73f0b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400667, "uuid": "f0505957-bdc0-4454-8f32-b732e2014680", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af388bd9-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676407601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407601, "uuid": "bfe1aee1-4bab-42fe-b9bf-f1cb4592f22a", "comment": "Malware payload (Gafgyt)", "value": "60ac1eda1af5cbddefa4fcb957323d4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407601, "uuid": "48692713-e6b7-4983-bc42-46691fe04c6a", "comment": "Malware payload (Gafgyt)", "value": "361385f45a02a2ed19a7852b26b4c0f7132e68d236ed8c6dd42a4502ed2b2226", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407601, "uuid": "725e13ec-efb6-483d-9470-905a4216881b", "comment": "Malware payload (Gafgyt)", "value": "4f1ade3c103e67bd143cc3e620926cffb04e86b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407601, "uuid": "6c83f7d1-ec4f-4422-9faa-66c50833220c", "comment": "Malware payload (Gafgyt)", "value": "c4621136aa9a7724a526ae5e3928b77e1785e70a0ac20ace4e3d08acbb512e99fca01078059abe9d503b7e9bf86ddb2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407601, "uuid": "dc592afd-c6c3-4118-974a-d200aa6799fb", "value": "T181B31805FC004B23C7D26BBBF79E429D773666596BD73301A6296EF02BC17982E39250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407601, "uuid": "5596500e-761e-415b-817b-cb9b8d2c5347", "value": "3072:qhDQ1qlYQInoRyTkEIrqza6xJ45h1RbzbJEr7HoDQHDVpZAlvm:hcrq+6H45h1RbC7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407601, "uuid": "0c0c6b22-ea97-49f2-90a1-a769fda7b3ca", "value": 109179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407601, "uuid": "e6dcaedb-72c9-4c56-8074-480f178829b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407601, "uuid": "6b50afba-dc64-4a11-a9ab-0418e9f5efff", "value": "60ac1eda1af5cbddefa4fcb957323d4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4df0338-acad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676409785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409785, "uuid": "fd4a723c-c353-42fc-80d6-1aaf427135c3", "comment": "Malware payload (RedLineStealer)", "value": "d8f38558bd9c4a83548ba56ef5e31244", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409785, "uuid": "3e8bede9-3a46-4ca8-a6f1-a0a78f4f0e74", "comment": "Malware payload (RedLineStealer)", "value": "3630b9fd9d3d3f24c1b3116118f7068b48c74201938a8fdfaa4d32116d383abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409785, "uuid": "b997795d-ee61-45eb-ab41-ff6f6097cea9", "comment": "Malware payload (RedLineStealer)", "value": "b9a5780740c0ce32515eacf5880d8d54c1328b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409785, "uuid": "bd124037-77d5-496f-b1bd-ce8199855e4b", "comment": "Malware payload (RedLineStealer)", "value": "30b0be3c13bf01989ac95e64c4e59e4c8b76a04e3230df9e513da0638af1a6d1a010410596f0ff4a9c773c5412ad0960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409785, "uuid": "b189d383-0d47-461a-817e-fe79a4b0ab42", "value": "T1B9C4124BEBEC8423D8B453701DF702D3053A7E625B34929F274AAC5A18726B4F23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409785, "uuid": "a8120568-90d3-4b61-91de-b6e8caf51cb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409785, "uuid": "5979def5-f243-4285-924e-46d4c43fa1a2", "value": "12288:EMrXy90ujBwhs/sT6PrijXwqpdIeOjMq5j2mCgjX4:DyvjWhs/F+jgqpCgyOgj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409785, "uuid": "baa1ec27-3f5a-478a-bfaa-2df8c22d01ee", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409785, "uuid": "b0a0b2eb-4efa-4fe4-bb86-32f9dc33bcb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409785, "uuid": "1f6665a1-3e32-4b5d-b529-b64a7b3ce6b6", "value": "d8f38558bd9c4a83548ba56ef5e31244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1eafae-acba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676415328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415328, "uuid": "7c7058ed-7d6e-4739-a8f3-b1b5d3e0d713", "comment": "Malware payload (Amadey)", "value": "f1305ec722b1402151de373053ef2abc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415328, "uuid": "ca1e741c-aa8e-4075-93c6-086cc7ed110e", "comment": "Malware payload (Amadey)", "value": "369195e94daaf066dd1b7090c866ec4603d211e4723338f59a263adaa2f323dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415328, "uuid": "9eebac5f-51a6-44bd-bf00-13ccbe756fb8", "comment": "Malware payload (Amadey)", "value": "0397132cfdafcf86bad80ab045bf8f5c46805100", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415328, "uuid": "80249fc3-a991-4ce7-914a-472f521595b8", "comment": "Malware payload (Amadey)", "value": "c27816a40b88342effbaf59d02e4397a1542af0be8037bcb907aedd2229a66ae325341e232cdc17fdff5608d17e3631e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415328, "uuid": "29ec3c4d-3f05-4d93-bcd4-a863e4a081e6", "value": "T130251247D6ECC062E87167B01CF146C31A36BE516A3493AA334FAD990871264B1B57FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415328, "uuid": "b98e4fc0-954c-4b19-9478-0ec6f501870e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415328, "uuid": "04ec7d7b-1b4d-4dab-84d0-f269cd13b5ef", "value": "24576:DyDShC8hMwuKlI4YFa96+60KhWxPbKuHSfNF0lCG:WuhCmuKlI4Uu6NJCl4NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676415328, "uuid": "8afa17fd-da6d-4711-be49-e8f8a5e242ab", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676415328, "uuid": "4209c3ea-697c-46ec-8657-bce20f20b89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415328, "uuid": "863c5236-c014-4fff-b825-6758a08eef6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c744b8-ac35-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676358278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358278, "uuid": "923ff21e-044f-45fc-805f-95d4a86bac2c", "comment": "Malware payload (RedLineStealer)", "value": "748873ff2efe2b475aac87c9f85a2874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358278, "uuid": "c8b95e23-dc8a-4737-8296-e54bf42198ac", "comment": "Malware payload (RedLineStealer)", "value": "36a64887ec2f66e3e15391915c0727c30ae94efdfdcb07cbfcf651e2cc551667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358278, "uuid": "95fcd314-74f2-4336-a144-9376884ecfa0", "comment": "Malware payload (RedLineStealer)", "value": "d0d5f95fc0b2934ae6c2d19d9009dc4d6ece4bd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358278, "uuid": "39fb7f00-1233-4ad8-b460-76ee7744f4c6", "comment": "Malware payload (RedLineStealer)", "value": "03abe33d7d05f38eaeab4714c46acd7fd7a51d074bcf3c8cc2de2320932f912a0bd7ff339d2e27a98ec22c3bda3741a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358278, "uuid": "a3a57b44-90a8-4d11-a7f4-f3e2a03bf820", "value": "T14AF41207ABEC8027E4B4173118F307D31A367EB46B649797138F5D6A18B36A4A63472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358278, "uuid": "839439a9-336c-4583-af84-24528a11726a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358278, "uuid": "a8087fea-985c-41b5-be01-b0ca21439d86", "value": "12288:WMrMy90Y4qQe1KS/W0GaE41NDl7ToBLFvDmrJPwwKk8Oi9bzY/ISS+Ca:Gy74qQec+vpzxoBLFvDm1P5/ISS+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676358278, "uuid": "33d58117-c423-4f4d-bfde-8db9dfd885ae", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676358278, "uuid": "5e39b260-254d-45df-958a-462470218cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358278, "uuid": "dd2722bb-bdbd-498d-a999-48fa41cf8162", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff8cc8d-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676369430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369430, "uuid": "22822b44-620c-4d99-8ca3-8e7bdc34ccae", "comment": "Malware payload (RedLineStealer)", "value": "4998d8f709c378014d65a94f7ec00466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369430, "uuid": "62c3569f-8f5b-4966-bf66-82a3d68c02c7", "comment": "Malware payload (RedLineStealer)", "value": "3775123171340148c390234d05b64cb08f47d2fdbdf8e6548feabad3ce4b9af9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369430, "uuid": "be8b658e-c48f-4e4e-9163-f6363c2c81dc", "comment": "Malware payload (RedLineStealer)", "value": "d3168c0fcb8ca61bef715347c579585541cf8dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369430, "uuid": "6ea1ae2d-c3dd-465e-a5f2-4e881602ab17", "comment": "Malware payload (RedLineStealer)", "value": "cc0e7bf726610d927af04a8cdec5bc07f089e8d8b1bc741b5376e56750af96523ac94037f9b41e26183aa98266f7a2c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369430, "uuid": "5d8b401b-7d5d-4792-9276-48d7c70eff1c", "value": "T1C8F4120BE6FC4523D8B1577058F303E30A36BEA15A78939B674F5C6D2832570A23976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369430, "uuid": "1c22e654-12a2-4664-9aeb-29b6983853f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369430, "uuid": "c4abb066-9f63-430d-879d-a732828e6fc4", "value": "12288:1Mrry90yhHi25+XQOEPDDHI5kesIIFj4WVLcdzTt+83Fl3B:qyVHi25+SPnI5kq9WlUTdFlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369430, "uuid": "4d231b34-4178-4806-8585-141f7e5b3576", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369430, "uuid": "85af38a5-548a-48e7-9e50-169a84b60260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369430, "uuid": "6d553050-5c2e-440c-887b-7a359a5db867", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b2d0ee-ac23-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676350522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350522, "uuid": "bd8447c9-8c6d-4a54-855f-eebe58c6abf0", "comment": "Malware payload (AveMariaRAT)", "value": "ba2c8785b52654aed9112c84ecabb7dc", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350522, "uuid": "f2eebe31-7d7a-4a20-b628-705ef8842469", "comment": "Malware payload (AveMariaRAT)", "value": "37d3c78b471385d79109cfc6bacbe88226f5ff0ae45513479f76c9f4a354982e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350522, "uuid": "b9ece40d-d6a3-403f-bc72-b03b3f725d2c", "comment": "Malware payload (AveMariaRAT)", "value": "ce7c553f927c9d5f4139c8ecdd265316237fcfde", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350522, "uuid": "dd5b0ed9-c7b3-4d47-ba74-5ad7abec36f1", "comment": "Malware payload (AveMariaRAT)", "value": "738138e610e1cd5f88845928d83a26ff1528dd2291e1ccdfb16bcc3a2d33fcec3b874f4f9a3e3f035efefc938409721c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350522, "uuid": "a6c09662-4e8f-4477-937d-351c4d031e4d", "value": "T14FF4BE27B67C4B8DDAA842B978B005B1136D9FA721D1BA143DC4FD9E09BA3CF11530E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350522, "uuid": "d4a34aac-60f8-4aff-a2ea-268f0fc6793f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350522, "uuid": "fd4ec8b0-9e6d-44d5-9592-dda7e32b26ae", "value": "12288:xk8Vd9k6RQWtE4tVT+zD7gUK/HPyP5jPWzwhK2FZuV1ajoQlQX:uqQWtE4XQDQHPypxh9FZq1ajoQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350522, "uuid": "5cce3fc8-b945-40dc-a161-bf152bf14408", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350522, "uuid": "0bab792c-ab6e-4d6f-9e84-9a4bff5c7154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350522, "uuid": "ba43c3ba-418d-4957-ae26-e91e47a173af", "value": "ba2c8785b52654aed9112c84ecabb7dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d84c9ea-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676392941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392941, "uuid": "6c00782a-e2c2-4030-934a-5369c57255f6", "comment": "Malware payload (Amadey)", "value": "42617912c526999c355438780025b38d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392941, "uuid": "af74c301-57ef-4422-9cf1-58562e8d61c0", "comment": "Malware payload (Amadey)", "value": "37f6baf19ba82d25631df39407596a5ba99e5d9ea6b28d2b67b28ea12c6c3eeb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392941, "uuid": "d3570eb4-9072-450d-bc22-6198d8b188a9", "comment": "Malware payload (Amadey)", "value": "17138928a1df4e5a2e80eeed8cb5e4e315b9d9e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392941, "uuid": "2f5604cf-369b-4a36-bbbe-cd2017bfa84e", "comment": "Malware payload (Amadey)", "value": "2ff076cec097d9a792994b30af1a8773e302dc375029bbb03378acd079981424110030425c90d78a23dc1cb2e5c93f4a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392941, "uuid": "55b31a87-7832-46c5-8a48-2891435a293c", "value": "T1F6F41287EAED8032E976177015FA03D309363E916F3C87DA524FAD9E0CB25A86535327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392941, "uuid": "ece1eb93-40c0-4ec6-a1ae-66a4868a5340", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392941, "uuid": "9e4c99fe-5cdb-45d2-b792-fac1fef66df2", "value": "12288:IMrmy90cDw7YVfFlWzE9Ez6GXZ+IMD5H3z56dgwUoMWUnak4CbvO:uyr/V7HEz6GXmD93zIgwUoppFCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392941, "uuid": "53d99ff9-eb57-46f1-96b8-443640b81ca0", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392941, "uuid": "59633034-de90-43ee-ab11-ebcf01f3719a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392941, "uuid": "30b45ece-50ae-4630-a600-7376cffc40c0", "value": "42617912c526999c355438780025b38d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14b8f92-ac67-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676379660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379660, "uuid": "07d835c3-812c-430f-8f21-724cd19686fd", "comment": "Malware payload (RedLineStealer)", "value": "e9b592d5808e9a9a99924dbb5c773963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379660, "uuid": "c8d9deb7-a721-47fa-aa52-5e20a1864b89", "comment": "Malware payload (RedLineStealer)", "value": "385f54b51f74a5e62f357a3deed60b12b9d4d92d79a4e5204a8751a6b54853c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379660, "uuid": "369ffbd4-f9b3-4057-82f4-6403089124b4", "comment": "Malware payload (RedLineStealer)", "value": "ee13ed5594766bbb166442ecc28000c9d333d227", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379660, "uuid": "f58bbbbb-c3fb-4c25-8bc6-111996e7334c", "comment": "Malware payload (RedLineStealer)", "value": "dca24ddf2171c87af4b4388d12dc1acc28d9311134a4b3b28eb491d990139550be7d444bb04470b6fd7ca7e0434372c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379660, "uuid": "367e0084-7092-4032-b224-0e0d039dae1c", "value": "T14F54F112B9A09067C32B8A355921E7A01BFF7D71AB54C687334C12EE2D357E19A7730B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379660, "uuid": "a30296ff-aadc-4006-830f-38b60f47c733", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379660, "uuid": "41fa4b38-fe40-428d-883c-62814272c1ab", "value": "6144:mdL9NgvQN0sIZ9GZpGkEwHJRR7J24hANL4tTTm0FJGu8:mdvizZ9cpGkrHJR1c4GL8TTm0Ll8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676379660, "uuid": "0dabec4e-a1f4-4743-971f-2e13fd25875c", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676379660, "uuid": "84d323ce-769b-4176-8816-2b7448795f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379660, "uuid": "30f96378-06f6-4ebf-a47a-7afaf2da3285", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d87641-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676407399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407399, "uuid": "b870d7c9-4472-49c5-b194-a3118ba824e4", "comment": "Malware payload (RedLineStealer)", "value": "e64d35111d67d5dfbccf0ee7cdbae4e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407399, "uuid": "b106f750-99dd-4de6-b5c7-cdbf49fb62cd", "comment": "Malware payload (RedLineStealer)", "value": "387ce7da8729de35647c1d3c5bb61dd8981cef3d26b898cdf6c24a527cc63574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407399, "uuid": "17475345-d9bf-4842-8892-45c62471f6ad", "comment": "Malware payload (RedLineStealer)", "value": "97115bf83e7b802b0a2fb9d2043c23011c7f3818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407399, "uuid": "fdd76229-6a78-45d1-b876-99100c4594b4", "comment": "Malware payload (RedLineStealer)", "value": "28bfc6151090f89930b63adc0e219f20c2bd5d4d2ad01aac274c18596bb11da9edbc632d4058ceb1facb6bef8173198b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407399, "uuid": "da066117-96c7-4195-97fe-ad4f8f3fad6b", "value": "T16A54F12272E0C072E56794794561EA98AE3FBF7173A1814733580ABF2E703C10B76F5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407399, "uuid": "ae2ef58c-4f03-49f6-bc74-dfa745cfc768", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407399, "uuid": "fb49a296-2dfb-4d31-85b1-2e469c0a5703", "value": "6144:1LWmmqsPF3Bwj6FHodx+74nwjpn0G/suY8Baz:1CmI5aNdA3PrBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407399, "uuid": "5f9982c5-d0f2-44d1-9873-61df619fb222", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407399, "uuid": "4cc8acb3-1e6f-44ef-9973-407731c70e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407399, "uuid": "f24389a2-0df4-4801-9de4-c6d4e1c5c692", "value": "e64d35111d67d5dfbccf0ee7cdbae4e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d98f74-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676393054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393054, "uuid": "942bca02-3e1c-4c8b-b172-f919b6818437", "comment": "Malware payload (Loki)", "value": "a931ca00060727971b4d1002e75d0a83", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393054, "uuid": "82e309b5-30b1-4fb9-a023-f07c580e838a", "comment": "Malware payload (Loki)", "value": "38b0d9d3a77b9714605c34e0e8e9bdd05edac4bb0552b370b220836d6dee1da4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393054, "uuid": "6dc6fac7-76f3-4b43-aeea-6869be76fecf", "comment": "Malware payload (Loki)", "value": "7c2daa7909b361de95171e83230144452344911d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393054, "uuid": "535560cc-c7f9-4dda-afb2-f802c88cec21", "comment": "Malware payload (Loki)", "value": "4a82085b31abad5938156f95d8096765f89dd04a4d82347d8a6c09d86ef1c48ff479378d1cf2216b69fe90bb8b98da30", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393054, "uuid": "2f73a148-f919-4948-b4fc-2118b001fa35", "value": "T17E65123BE165FDA5C462033851E7C6620147AC31369ECA0EBC5CB66C27B37906AE67DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393054, "uuid": "5d90e7c6-9606-4f67-a3b0-1edbf98bc3d4", "value": "24576:nYV2rXo2Tt6XZxzgnfOYr2H5G2Tt6XZxRy3NyhK15WIIddnjL:GEY2Tt6ZRgfHAY2Tt6ZnGNy015WI21j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393054, "uuid": "23dae831-2dcf-4d3d-9422-8d9396f80987", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393054, "uuid": "c3d2b1a3-7adf-418b-997b-04ca9a89c176", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393054, "uuid": "88a8b519-e39a-48f6-b740-f58173afa769", "value": "MV SANTA ACE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3d242e-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413337, "uuid": "4279d880-800b-42ee-88fb-87cec8aa2577", "comment": "Malware payload", "value": "c758e18799e528d429fcf6cff29217c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413337, "uuid": "4cff06f6-575d-4c71-a0bd-a464e673932a", "comment": "Malware payload", "value": "38fd6c39347e67510eaf3981b32364b651064baeae45c6271b8d252472d15a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413337, "uuid": "d5ba97a5-da81-40f5-aa2b-12cf481ca350", "comment": "Malware payload", "value": "85981e42390e5f0280efc446432524739f3a1098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413337, "uuid": "54ac5f10-8695-4542-95c6-420543e2cde8", "comment": "Malware payload", "value": "c70a1e677ecb9b3be35d37efcd13f588306e6962b6b6e78fcfdbecfaf816b303c20123d185bfdba65d383ba4e2b987f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413337, "uuid": "324738e9-a444-414e-8a61-6960df8ae6dc", "value": "T121632BC3F410DBBEF418D73B0C6749157271F2604E870A266BA77B5BE96A198092BFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413337, "uuid": "46c79411-2e48-498c-81e5-7e4c3ee37664", "value": "1536:LC7eYetlZ8IqFfzQekacWVcW0JcWcBuVbgRAgLTcytLxGwLc9Iis/0:Lie5NqtzQekacWVcW0JcWcBmbgRNXd8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413337, "uuid": "4298ef93-fdda-4e76-9dc3-9ad278f7693c", "value": 72568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413337, "uuid": "fca8797b-2cba-4cff-9f60-acb355d36bd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413337, "uuid": "44c0d301-875a-4740-9387-354f5782847b", "value": "c758e18799e528d429fcf6cff29217c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bc7b4a-ac29-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676352928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352928, "uuid": "26ef8fde-8255-4bd2-8fae-90a5addfad76", "comment": "Malware payload (Smoke Loader)", "value": "68273765eed4bc54693d90e2ec2b9e21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352928, "uuid": "4f58e4dc-be1d-4db4-9595-1110cd58da01", "comment": "Malware payload (Smoke Loader)", "value": "393949e066d3b8f296fa9ad81b1a3de68333a0a6fac1497c8b79c01473b46628", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352928, "uuid": "f90a50b8-f4db-4f97-a78a-1a50f076f4bf", "comment": "Malware payload (Smoke Loader)", "value": "04cef9dfa696431190f4d5bbfb1bd400f6326cb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352928, "uuid": "a74dd7c4-1c4c-4c68-a187-9fc52c78c7b0", "comment": "Malware payload (Smoke Loader)", "value": "ac4aee618b3e30c7b960d03a18fb6b34bab7632d45cb73e19d24a98b9c8919ab33304d5a6cf7f6c0df2a4ad153e90dcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352928, "uuid": "7e53d7a4-0440-4e28-a38a-9e10c089e253", "value": "T1CF14C022BBD0E871E466C6314D65C1B4AB7EF8215B39A6DB33985B3F0D702D19A3E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352928, "uuid": "3dbd0694-9a27-40e6-8669-7cefa9d8531d", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352928, "uuid": "0e195632-e90d-434a-a51e-7b6caa2c12a0", "value": "3072:JJhuYa5ztmG7fsVUDcODo1ioZsZIum0sKvit+82IUgc1QEMHnIykM:JyTtxrYccODsFiZyKe/mbMHIyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676352928, "uuid": "62f6c546-e35e-4433-990c-7aba9bbedb15", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676352928, "uuid": "8cbbd11a-b527-4a21-af17-8eedd04c5862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352928, "uuid": "0d3805aa-4a71-4614-9ca9-7682e849fc93", "value": "68273765eed4bc54693d90e2ec2b9e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60022839-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676399307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399307, "uuid": "ddd06dcc-01f3-4368-a898-1d04ff064145", "comment": "Malware payload (Amadey)", "value": "45dc3120c2d9e063d6cd8b9ce7f8781d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399307, "uuid": "d9b6394d-1843-4848-8826-ba537afa9b98", "comment": "Malware payload (Amadey)", "value": "39df5545bbdfac5a29928da9a352d07e983de59c7de68e15b4d106fc333f0290", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399307, "uuid": "29027640-cffd-40a3-a943-d1e1ea3cae38", "comment": "Malware payload (Amadey)", "value": "0be48575bd9e4e9e451c0b2f315fa0270bc5155f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399307, "uuid": "aa6324d7-bcbc-404f-a07a-6409b8116005", "comment": "Malware payload (Amadey)", "value": "eaceb204ddb120356493d1e452f360ffd8ba2dfbd278487a3efbb702d65a1519cb1fe1fe7c604a173077e8f7c0db502c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399307, "uuid": "46a8de24-0571-4ed6-997d-1c642eee8a33", "value": "T103F41257ABF8C024E4B167701DF643C31D367EA05A38879BB69FAD1D0872670A63532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399307, "uuid": "eeca772f-4cf5-4951-82ad-9e4526d29caf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399307, "uuid": "4bde78be-7ebe-4141-a552-e5688640a110", "value": "12288:3Mrfy90xWV+jH3Q1gAZHEFd4kjVytkaY77VF0jIkcm5HGG6Ay2VArq:wyFVCgeAPk0tkaYvUIG5Ht9ywKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399307, "uuid": "48a3b29b-91a8-4efd-886b-2935552547be", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399307, "uuid": "81896ff4-4ca9-4dad-a7f2-87fbe3c5ab6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399307, "uuid": "c40de881-26e0-4f46-8acf-fb49232ef72b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d02ffe-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399859, "uuid": "bfd712b8-86c1-4627-9573-1c94a95305d7", "comment": "Malware payload (RedLineStealer)", "value": "87a1813f4d83168cef58786a93fde3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399859, "uuid": "ac5efa5d-55a6-4d10-bd8e-842fc00a6a15", "comment": "Malware payload (RedLineStealer)", "value": "39ee2b5eeb33f1d4a22341f239868e5d912e620ea5c0eaf9a724142162dd26eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399859, "uuid": "8c51e229-7fa5-4a8a-9b76-8611473ca884", "comment": "Malware payload (RedLineStealer)", "value": "45e0e72cbe90ed376c9c17d12ae25bb9e6cb2310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399859, "uuid": "9782a092-b169-4452-8ea3-718797bb986f", "comment": "Malware payload (RedLineStealer)", "value": "46443a38b485046adead49d04b8465b7668c8d2d2220758ff5b808907b2a5efd27b6612807528f9ab0d255b6009bf392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399859, "uuid": "21e6ae47-eeaa-4129-b3c1-077cac32f70b", "value": "T1D7C40247EAE88133E87117B11CF706D3163BBD605A79836B26CE6D1A5C73660B03672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399859, "uuid": "4d938347-0c39-42c5-8f4c-7728186645aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399859, "uuid": "d220d18b-c66f-4359-8c63-3e933da73919", "value": "12288:7Mrxy90iGTd5yxiQM7eltfhnHEU0QNrH:iy9quxztfhnHEn4rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399859, "uuid": "d72577a2-24f8-4c52-a4f6-e3fd67d7d0fd", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399859, "uuid": "2e7079c5-0230-45f8-981c-e03f0f150b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399859, "uuid": "5aa2b928-fef4-45c4-a664-b514d1bb567d", "value": "87a1813f4d83168cef58786a93fde3d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0f1d58-acaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676410681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410681, "uuid": "c5a993a4-8a4d-4f18-b1fc-18a0c83ae952", "comment": "Malware payload (Gafgyt)", "value": "d8e45f58a170fd620888e3d16485e10d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410681, "uuid": "bcc6f577-5d0f-4be7-8221-badef7ee56da", "comment": "Malware payload (Gafgyt)", "value": "39f11f89c1654b2002937576a85768490311dc219540a36d93eefd6f6843e054", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410681, "uuid": "27a7deb7-fa97-4eb0-97cb-9d8a1b2e49e7", "comment": "Malware payload (Gafgyt)", "value": "748058125729189787ad0d63c9c028617f73a8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410681, "uuid": "4d1896a8-df1c-45f9-bd5f-b6129fa93f83", "comment": "Malware payload (Gafgyt)", "value": "4462d1477c50dcf4490bb39a81237a6c9b480581826c27f7b4a7b293394c5bcd66410428da633c1c4258aaa83e0f61b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410681, "uuid": "ab207318-0cd6-4e90-bd9f-1cd73eb801a0", "value": "T15973184AE552C6F7C4821BB20297BAEE0765FD394E7A9E49F3083CF49B724D83919311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410681, "uuid": "0166cdb8-c336-4bc4-9ece-fe807774c290", "value": "1536:xdNw6uAYiPvoVjRWS7kJySRkLWFC/9hKt3iF70w2rNxLazMLZ5:y67YiPvoVjRWS79SRhw/9hKt3Xw2/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410681, "uuid": "fe0e05f3-57a4-4237-97fd-e5a22f4616cf", "value": 75543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410681, "uuid": "1d8718cd-2028-4394-b0e1-83c0fa4655fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410681, "uuid": "faf0015a-33a1-41cd-acc5-96981a492764", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01b218c-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391738, "uuid": "ad71ac87-c827-483e-b000-a50b41d8bd7a", "comment": "Malware payload (RedLineStealer)", "value": "5800ceef53b8e1c1bab0bbe2e5243bea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391738, "uuid": "6d083ed0-7477-4c63-99e9-aee226b15ce2", "comment": "Malware payload (RedLineStealer)", "value": "39f57917ecd9fd076bd7a9f7061e22ec0d5856bb7a999dce746af996d6eac8c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391738, "uuid": "f0ae51a7-c113-4b10-abb2-81ba030c5ea2", "comment": "Malware payload (RedLineStealer)", "value": "7f8772f5d6fdab233c8ab53a0965db79c4cec316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391738, "uuid": "84662b9e-518b-45ea-a559-c9b6dd44bddd", "comment": "Malware payload (RedLineStealer)", "value": "658e3dd99c872712579c06e623b4ae0b55af550b15f31307a7a1860a8df8384bad5b4521564d72f349b020473f8b3b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391738, "uuid": "97bfcf2a-825f-42b8-b03c-81989ba348ae", "value": "T19BF4121BEAE84033D97557B009F607C307357C619A3C83AA575A8D5E09B3AE4BA3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391738, "uuid": "9ac55a2c-2398-4571-b1bb-59eeb2ca1d32", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391738, "uuid": "1a28e89c-c9f5-4bc6-9808-059484d6a35c", "value": "12288:lMrsy90/mmo4BPIpUkdFR/+KoVYmlPENJ9sho/anaLVvCqU092Hfu2MbIy:tyimiBPI9O3aaMb9CoLLVvnEfuVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391738, "uuid": "fd40ff8c-035e-41d4-a006-bbdcc7d9aa1c", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391738, "uuid": "4af49976-a4fa-4711-8c5f-e845764e568a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391738, "uuid": "600ff3f7-6102-42d1-ab53-1b1ce32d5d12", "value": "5800ceef53b8e1c1bab0bbe2e5243bea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "734f797c-ac47-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676365839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365839, "uuid": "179841c3-c2af-475d-bc90-d95683f0a344", "comment": "Malware payload (AgentTesla)", "value": "741b3edb911167958add4fa0d159de9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365839, "uuid": "bd620a3c-01ac-4e84-b16d-55e8b45397d6", "comment": "Malware payload (AgentTesla)", "value": "3a216366e8de630b2e08bb33e7e2571c4eb83f5b3cf752be164f3a00f7d61dfb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365839, "uuid": "a3196627-df44-4339-8b5b-26de01c066c3", "comment": "Malware payload (AgentTesla)", "value": "7ce901d3a2aebd03b3415042ed831037d9af4b96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365839, "uuid": "7bb16915-da0b-4715-bf75-c7e306a07f79", "comment": "Malware payload (AgentTesla)", "value": "5eddb80732aa7b0de21435e95f21db9578e614646b16f68417b2e45e5a57c7e109f2b8871f21022726ad82ce963e2881", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365839, "uuid": "a1b78c84-ae72-48ff-822c-4fb60e07f9ff", "value": "T122E4B32AC9BA17E7C039F16282A54824F8ED8653331FCD5AADC317D64F81601AFCA5DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365839, "uuid": "21e6dd98-30f4-4f55-b3a0-d816c555fba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365839, "uuid": "60496127-99e7-4702-8564-e385b8b97d1b", "value": "12288:afl+B9QsOyemi1bFsOX6NTnrtOXA+/0CvD4EDzjXORHfXBAiK7Xc/w4H+zfTT+CR:afl+B8jsOX6NTnrtOXA+/0C74EDzjXOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365839, "uuid": "22eb3e73-7cf3-45ef-b757-fb72d0258bd3", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365839, "uuid": "d9561683-c3df-4a17-83df-01800458776c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365839, "uuid": "fbb74b50-2c10-4d54-a9ec-96b951a487ff", "value": "QUOTATION 5DIR231029551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b660dca-ac36-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1676358444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358444, "uuid": "c2801e82-73aa-4bf7-948e-8244b2343930", "comment": "Malware payload (IcedID)", "value": "599872eb6e1076375f77f5a04ab167fb", "object_relation": "md5", "Tag": [ { "name": "2076641214", "colour": "#53FCEF", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358444, "uuid": "e53d0187-8da4-4e73-a961-d044be06b1d0", "comment": "Malware payload (IcedID)", "value": "3abf775b4cf70b7e0b86288320b3ce39483ea7b4b2073dc14204c2e229c9f6bf", "object_relation": "sha256", "Tag": [ { "name": "2076641214", "colour": "#53FCEF", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358444, "uuid": "a6a74932-64d4-4bbf-83e2-8618d950f4d6", "comment": "Malware payload (IcedID)", "value": "c724f6b737562e1bf9dcd149e5ec13f9631ae5c9", "object_relation": "sha1", "Tag": [ { "name": "2076641214", "colour": "#53FCEF", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358444, "uuid": "c3ca35d2-c5bf-4318-8c05-6dae4990bb11", "comment": "Malware payload (IcedID)", "value": "c485bf68a5c5200170665ebf77af6e36cd9cdbcde3ae84b366abf4eafd196b674b272c70c02dc2fb7e921d9e660aa95f", "object_relation": "sha3-384", "Tag": [ { "name": "2076641214", "colour": "#53FCEF", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "ms-teams", "colour": "#21FB06", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358444, "uuid": "b79325fb-eb72-4f75-b4b9-784d441f95f6", "value": "T12F0502A751FD6668F07589754EAE2CB9E76C860C861C1907EEB10407FB830EB2B9B164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358444, "uuid": "0b8ecbbf-90f2-4699-b9f0-206d6479dd36", "value": "1536:z6HjCojFMRGhROi0Pa0nGb/3T6OR2JnqikaSsqPTatEclmJvwD7RYcFeIik:z6HjvFMRTi1qO/3TaJnrSnCOoGEeI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676358444, "uuid": "44eb503e-9d06-4a84-9e45-eaacb9ce54a0", "value": 820729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676358444, "uuid": "0112e2da-a0f6-40da-8c30-937db8badc5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358444, "uuid": "10ea5a3a-30da-456d-9dd6-80a87f4a8585", "value": "Setup_Win_13-02-2023_16-33-16.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6487fad5-ac22-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1676349923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349923, "uuid": "c9bdbd5e-fc69-4e0d-8ac8-9b531406d4a5", "comment": "Malware payload (LaplasClipper)", "value": "b9bda9f7fc7b696ef21958eba092a90c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349923, "uuid": "0ff329df-fe59-4d0c-ad04-15958dafa1ac", "comment": "Malware payload (LaplasClipper)", "value": "3bcc8ed457831394c7771b05e293ca877cff4e7dd8cd4ba7d4b1d549a3a4596c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349923, "uuid": "9a7a0e37-3eec-43dc-a2d3-a5d3e8726f93", "comment": "Malware payload (LaplasClipper)", "value": "bd8bc4d0cf860debe9d65dfea04c0e1601fd42c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349923, "uuid": "c604f95a-1a5d-4b7e-880e-14eeffc88a61", "comment": "Malware payload (LaplasClipper)", "value": "d752ca9c477b1b9b1329df0b2a567c113150dc5a9cd36520701fcb99de25c010dd60c846170eb4697bcef3259f692732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349923, "uuid": "ee2a570e-6016-44b9-91e0-79c9a3642a03", "value": "T187B6CF91FDDB50F5E943193044A6A2BF27302E099F25CBDBDA507F6AE833AE10937119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349923, "uuid": "0c47aeb2-13ba-4084-a58a-47a2cd71dc80", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349923, "uuid": "098099de-1a78-451e-9028-33026573bed9", "value": "196608:lkAitXgLbhsg7naQVOR8kDM/eXw9rOQnMcMR7:vsXgLvOUkDwUw19nH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676349923, "uuid": "8f30ed3e-6c62-4f7d-8d78-154ea0537992", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676349923, "uuid": "88b7ad98-7cf1-4dd1-a7c9-588f0fd15259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349923, "uuid": "32497f28-3394-4f36-bb76-6e5a17acb014", "value": "b9bda9f7fc7b696ef21958eba092a90c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba03a96-ac01-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676335735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335735, "uuid": "0eaec819-222b-48e9-94fb-b95b22eb3789", "comment": "Malware payload", "value": "ba8008be413b11813565bb80668a145b", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335735, "uuid": "28691c4f-68ab-4513-84b3-f64cb4941676", "comment": "Malware payload", "value": "3c1b7eed78ed128b6463c8b6eb35e46b78f2a9946d0b2a093e51630919b5054a", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335735, "uuid": "6e8a9bda-8a65-4c8e-a72d-175047062acb", "comment": "Malware payload", "value": "995258840235ed924c364c78955e7e7d181096d4", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335735, "uuid": "3294f83a-a7ab-46ce-9aa6-31a1522e5d3b", "comment": "Malware payload", "value": "50b62c67b002a57806b3c71d33299589dc9785f7f1e05b6ea84c2c80d2c2af15724da015a3498bcbd182e10daa13adb9", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335735, "uuid": "ca4090a4-2b54-49c2-bc87-54825580a433", "value": "T1852733E527588DA7D8D5653F8C4FC43C00A9ED121758D9CFC1A8B31A2E7378A9A37E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335735, "uuid": "7434ddc9-826b-4bca-b678-5de5c97d7da0", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335735, "uuid": "e6132077-8acc-4a06-a82d-91a3ded80a42", "value": "393216:j3xAlndYXAnAu0ptGT6K4/m3pFFqyoBgsS/C4mgL4GYOi6F+:KldYXAnA9ptGWK4Ky1Fo0zl6F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335735, "uuid": "c1bb02be-3d33-4ae4-8183-9c7ec19f9606", "value": 20576099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335735, "uuid": "7edd208e-952a-4344-9d86-dc48ba0e1478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335735, "uuid": "e4a5dc9e-5689-4fff-ae80-a8a0a6802406", "value": "safehook.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc379081-ac89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676394335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394335, "uuid": "badddc68-f7bf-49da-a713-79672c10cd7b", "comment": "Malware payload (Amadey)", "value": "1f1389042fed6d19fd208f68141215cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394335, "uuid": "8f8b904d-eb59-44fd-9f65-b72e0e02e173", "comment": "Malware payload (Amadey)", "value": "3c20c063630e7f6d1f694405e79e94b9ea0791fb5bb42d4e0ecf09fbcb143c2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394335, "uuid": "5c573a91-06e8-41d9-bed4-b99748bef75d", "comment": "Malware payload (Amadey)", "value": "babbb933956d0e30dc17c29a7a8035952160ec29", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676394335, "uuid": "3b5a6755-3637-4042-b7e0-608d2c612ceb", "comment": "Malware payload (Amadey)", "value": "da4c8945894d3ef8a40bdcd269fc7fcc340c64a1ce7c6a47abe519376235d5c979c3acf16b1cfa57bd1b44d845d92d46", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394335, "uuid": "7174422b-be36-4226-9513-e68a16d06a1a", "value": "T15BF40247F7EC8422EAA157701DF303D32D327E604A38839A278E9D591CB25B4B63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394335, "uuid": "f45585f6-c735-4544-92dd-f60d9a148fe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394335, "uuid": "edc6fe39-a142-4e1d-8d26-78fd09dc34e1", "value": "12288:rMrGy90VlT1MZpVV92NTohoneMJFJ4fdHua5CLX+Rzf:dykeVuWhKpafwa5CK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676394335, "uuid": "ef8c98c3-4a1f-4e30-a36c-404f082fa049", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676394335, "uuid": "0e0cd082-67cc-4d6e-ae8e-97cd569ce8bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676394335, "uuid": "2b954e97-7a48-4b8b-a6b3-b52be4fd2fd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c07257-ac42-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1676363719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363719, "uuid": "f0ac7cfa-3181-410d-a8de-5994b199b6a8", "comment": "Malware payload (Stop)", "value": "21238eb80b2f126a8c163c53133e3189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363719, "uuid": "bc12cd31-c4dd-461d-8bcf-2c732a7926c7", "comment": "Malware payload (Stop)", "value": "3c3ad1fd2a9083af9ffd64714e7b3dd7cc629c06f59eb52e03bfacd2ef2a2553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363719, "uuid": "d3d65557-de38-4a6f-93ae-dc80215c2b64", "comment": "Malware payload (Stop)", "value": "05cdec21f2dd94380b9d94508050f3a5a087f6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363719, "uuid": "ddc0074d-0a65-4823-a929-07e99f91b25f", "comment": "Malware payload (Stop)", "value": "e0c484a6c9598d834e1f770ba99964913e9fe353ce23176ba69962af694cda771eba2a412caf35575d09d38119598e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363719, "uuid": "48857a09-cc7a-453a-9e0e-89b9a1b162cd", "value": "T160E412207DF0D033E356CA780521F2605E7FBCB18AECC29B3A945B9E4D612D15B6978B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363719, "uuid": "5f6cf747-4790-4266-9db1-a9af72c7584b", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363719, "uuid": "80159ac4-abf4-49be-bcf3-ef0a60025b7d", "value": "12288:s0CxviD4nuioU3QtsC3iLwVNj6jD5XEvezlQADc9ba+tL:ulu4AtsC3iLuNAXEvwmsiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363719, "uuid": "48570598-8443-4f18-b8c1-6934bfd57d81", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363719, "uuid": "d3d953d8-0742-48e9-a2e1-58c501df7595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363719, "uuid": "643e4155-004a-4e87-8e2a-f4066011bbdd", "value": "3c3ad1fd2a9083af9ffd64714e7b3dd7cc629c06f59eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b23ef5a-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369315, "uuid": "7e953a8a-8939-4e54-94e2-b95b468eeff9", "comment": "Malware payload (SnakeKeylogger)", "value": "92e2664d59ff4cb217dccc78e3e17990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369315, "uuid": "5226b461-d807-4df5-b05e-bd58d90f744b", "comment": "Malware payload (SnakeKeylogger)", "value": "3cc1eefece073953c78de9ca7c56bd3bce3ebc5268cb708ed3531c00f3154c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369315, "uuid": "6b44b475-d37b-485a-8404-e72a32c76823", "comment": "Malware payload (SnakeKeylogger)", "value": "cd31a06fe799dbce1b6c2e716f0f66c4c158a735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369315, "uuid": "31ccbb7d-2ebf-4f49-bfd1-36fc454549b6", "comment": "Malware payload (SnakeKeylogger)", "value": "9e872432ba44a988adb27b4475d8de41dbc8dc8dbe4827623b80f66478bd405708ef581364f4fb1eefdc5222763cfac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369315, "uuid": "c4fe0452-348c-4dab-b3a8-905654bcebfb", "value": "T1A685E8243FEAD01AF177AF769AF035999B7EF2633707965A1054039A4E12B40EDC123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369315, "uuid": "9fa3c43b-7186-40dc-a4d3-78369c499cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369315, "uuid": "6bc604e0-8982-4535-bce7-e080624b74a6", "value": "24576:HyiMTeDaGEOe57Zct/JOy1Kt1l5CyrQiR9GQCj:HyiMTeDahOA7ZctI5p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369315, "uuid": "85d5637b-36f5-4818-8b86-ec2b0646eba3", "value": 1785856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369315, "uuid": "99929f9d-5860-45c8-b7a8-2e9e0f5bcc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369315, "uuid": "8b60c54a-05d4-4d81-8f99-0b128cc71510", "value": "TDLK009876545678900-09876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b9b8e8-ac7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676390058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390058, "uuid": "522e02fd-e9c2-406c-a721-1a07a75edbdd", "comment": "Malware payload (RedLineStealer)", "value": "dd40b73ea6c0f95ea9106e4229cf1569", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390058, "uuid": "66014a93-bb77-4107-b838-957a6537292e", "comment": "Malware payload (RedLineStealer)", "value": "3d148580ebae8d226f08e6c9f6c609e8b84ab72890a843befcf2d00589c48702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390058, "uuid": "cd778a12-5bba-4cd5-b48d-6b7eb8921f8a", "comment": "Malware payload (RedLineStealer)", "value": "0db4b92b8f432c3ead9dd05929af86facdc63a6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390058, "uuid": "5361569d-da9a-487f-8748-e79590ebc037", "comment": "Malware payload (RedLineStealer)", "value": "d832887fc4b0400355a9bb81b080f4a5e2fc8d9cc2f620959913ccf08afbe24312616c8d88c32960fb8912065b9ceaf7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390058, "uuid": "9c746714-d62c-4ce4-a2b7-1a2d7480434b", "value": "T107A40207B7EC8532F4B15B7058F603D30A39BD919B38826B634A6D5E18736B4A73136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390058, "uuid": "397fc131-a9b6-4e91-ac1b-c06acd4bc480", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390058, "uuid": "9a411f4b-9368-4a7c-a5e2-730f3734a30b", "value": "12288:RMrLy90RgZ+EALFEEMJEr0H0CG9BQ9JVVXg9b:qybMHREEmfc9BQHVVw9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390058, "uuid": "bf1338e0-56b8-471c-93f3-5db0c093a984", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390058, "uuid": "a9d47aa2-67de-476a-81e7-52e313a1f312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390058, "uuid": "1f406a3f-b03a-4cc0-9ed7-1d71b138bb6d", "value": "dd40b73ea6c0f95ea9106e4229cf1569", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5089f3aa-ac57-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676372653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372653, "uuid": "aae636e6-901b-41fb-8c2c-8dcfd8acedfc", "comment": "Malware payload (Amadey)", "value": "6d0046a82d219f87aaf1779e456d9216", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372653, "uuid": "40a218ea-6314-4947-888f-50dd569cc07d", "comment": "Malware payload (Amadey)", "value": "3d32185447582be8714288a8571111b6d22aca25112c3a14a1d649c9e14ca700", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372653, "uuid": "f985a469-648b-4f99-a410-7a39c6d06ee3", "comment": "Malware payload (Amadey)", "value": "f2cee1d002f59d83a50a00425c1075fb6adcb304", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372653, "uuid": "20165375-03bb-400b-b616-7584fb823be5", "comment": "Malware payload (Amadey)", "value": "6ac7ea3e580ed566e2a2d06000bb97e5d023f1d7e9e8fe33ace3cb156150b623ea01f295a79a4a0e125ddfce15afe3f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372653, "uuid": "bb1b9b1f-d312-404f-882c-96bb10fd75d5", "value": "T126936B1070D2C071D97E55351478EAB68B3DB924CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372653, "uuid": "91ceaa9d-e011-4af0-b20b-d81cdfd6eb89", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372653, "uuid": "5c589f99-483c-4031-a2e4-e82e2f2d064d", "value": "1536:hZlNECaQbDVYzbpKuW92oUsxXLbcfuNht2ZszsWuKcdJUzN4naI89p:hZECVbJipKuFoUs2uNht25LJU5CaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372653, "uuid": "f1ead8ac-c943-4924-b0ac-92fec842b8e1", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372653, "uuid": "76ee6dcf-de45-451f-af8e-e490120895c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372653, "uuid": "bba6a953-1ecf-4c85-9a51-58afa5444290", "value": "6d0046a82d219f87aaf1779e456d9216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74d0c1a-ac58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676373255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373255, "uuid": "cbfb244c-725c-4121-9755-1f684adb8c5d", "comment": "Malware payload (Amadey)", "value": "ac0c15ed5bbae5bff71582169b2386e1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373255, "uuid": "3388f2e6-3c40-49fa-9bae-d79edbc3234d", "comment": "Malware payload (Amadey)", "value": "3dacc8140c352bd144977b81f51a6de82e59b5f901b3b52d59de6f6790907b2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373255, "uuid": "409cd78d-2dd8-45ad-b9c3-ff9777bcdb3d", "comment": "Malware payload (Amadey)", "value": "0839cf8f99c0d30922b3275a2e8238823cf7a12f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373255, "uuid": "32cb2b61-d51a-4879-8c1f-fce34b8ca9e3", "comment": "Malware payload (Amadey)", "value": "8c7d5e316ed29893840a2a8fbe5c71bc43a6f4846661af66c42af49179895a997a87ac4e76d810b27277753380becb05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373255, "uuid": "5a70942c-7090-419d-a53a-129492f21004", "value": "T1DB357D1BA26601BCD4BBD1788A235A47E775740603709BEB17D05AAA3F13FE16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373255, "uuid": "83c2a181-53e3-4d2e-841f-66af7b2cd732", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373255, "uuid": "67a220d8-fcab-4183-86c0-5a379733d051", "value": "24576:jVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vfM5m:BAhQnZzrZSxxZfVlU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373255, "uuid": "d657d180-a39d-4e6d-bcc0-71bdfe0c1cd8", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373255, "uuid": "89469c5c-6eef-4d14-911d-c2b203b4e5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373255, "uuid": "68b4877a-4a3b-441c-bb22-d6602e5e7d4f", "value": "ac0c15ed5bbae5bff71582169b2386e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24688a5f-aca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676404791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404791, "uuid": "3e40bc1b-0fb6-48a2-96bc-35c9c634d49f", "comment": "Malware payload (Formbook)", "value": "6483a177ef7b0b280e5123654f6aed39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404791, "uuid": "66c9e624-60e2-456a-90c3-dbb8171055ab", "comment": "Malware payload (Formbook)", "value": "3e0cdcdaa9cf3c06e4f5c28a4d7878f8bd60265f2b7e9a8eb88a6f13b75435b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404791, "uuid": "bf1a15c6-89f2-4c0f-83fa-3218aeb7fa1e", "comment": "Malware payload (Formbook)", "value": "88a75c9383c35df71876af8f579c3ab4eddba929", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404791, "uuid": "db4d1056-8844-4774-927c-e5d5f38c0e8c", "comment": "Malware payload (Formbook)", "value": "c732801837b882a668728e1e96e479161ea8fdad8e7d29485a3b6086b008ad11042d93aebafa8e156d62a34b44ab4489", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404791, "uuid": "393b964d-8558-41b4-87df-4cb2b5146172", "value": "T17AC41251029A739BDAFCDFB259B825603338773AB951D9094D8D20EC1EA37206381BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404791, "uuid": "0fa68ff9-6ed7-4154-a18f-34b9ecc7f953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404791, "uuid": "38c49454-3f7c-453f-944e-d7f09edc2e7b", "value": "12288:7FFZ6AQRP+1UNPnKtQNw32NmJvGwVnQEt4:d6JRPBQt8wGNqvfVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404791, "uuid": "9a888f27-8b18-4b9d-8af4-bfa12b3b8cc2", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404791, "uuid": "7717a3cb-f123-4556-a50a-bbd5bf5da3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404791, "uuid": "fd7eb39d-5d77-48fb-b36a-362a3f886b0e", "value": "6483a177ef7b0b280e5123654f6aed39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863f30f-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676393094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393094, "uuid": "27f557b2-a9e0-4820-8561-2411d6daced8", "comment": "Malware payload (Loki)", "value": "f71e72ae8073011251a28ecc2d66e277", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393094, "uuid": "6185ae5b-d0c7-4dc0-95a4-931ff3f900cc", "comment": "Malware payload (Loki)", "value": "3e12ff5d6ed962ebbfd1fcc5f58e47a5e6be97a153df5603df837756e4408075", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393094, "uuid": "276fa908-2e2c-4e25-8651-52d81642548b", "comment": "Malware payload (Loki)", "value": "985d884436abb64b678159b87866f84e7c8686d7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393094, "uuid": "fb289d80-eb1f-4e94-8a8b-b275863ecaea", "comment": "Malware payload (Loki)", "value": "0e10d5c8f1c4687bdb86b99a75cebbd722211e836e7b335b00bc4fc033a532dd13b90c8fbd3796388ea7edc18f047118", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393094, "uuid": "5cd6f643-6375-4712-a80f-7ac56fb09234", "value": "T10865127BE064FDA6C466033851E3C6620047AD21769EC91EFC4DB66D27B37A036E26DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393094, "uuid": "69952e37-c995-49e5-8146-757f83f1ac99", "value": "24576:lYV2revJr2Tt6XZx99S3uYr2Hwvc2Tt6XZxwYxzKlPUMeBmhZ6Palp:cEed2Tt6ZlwnAv2Tt6ZrxzKlcMeBmhZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393094, "uuid": "2daf8095-371a-40f4-b108-4bbbf80dcf06", "value": 1502208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393094, "uuid": "6ca74aa2-707d-4454-8a32-cfb37aae0329", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393094, "uuid": "f7a4914d-fa6e-4f2b-85a6-f24307c59347", "value": "Arrival Notice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6146ec1-ac0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676340235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340235, "uuid": "442b82ec-e0fd-4290-a137-2e454ed56d7a", "comment": "Malware payload (RedLineStealer)", "value": "5320769d2b793a420be056bb9e4274f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340235, "uuid": "2576ed42-929a-4c26-9add-f357c32701fa", "comment": "Malware payload (RedLineStealer)", "value": "3e56191466024e1584bb378c04d7303ba1e9203b0d413412aa94deb86be27909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340235, "uuid": "4016e2e4-74ef-4a91-a4a4-51f2fa16f47d", "comment": "Malware payload (RedLineStealer)", "value": "1350005732392b522347eb1510b97a4c8ddc8edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340235, "uuid": "894fd7c3-5a1d-4b7a-a681-fa6ee1183f8e", "comment": "Malware payload (RedLineStealer)", "value": "cf637a82fe2d2fd9612e191884bf52dcc750f8f41b12f526d2ddd2100ab01f38709e3d59519eea2294477f85f42e4aca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340235, "uuid": "d7a20985-4067-4939-94cf-b715600914ea", "value": "T11F64F122B3D1D472E9564532AC15C2F47A7EF8205B699ADB6384AF3F0D703C18AB6353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340235, "uuid": "86713421-a1b0-4ea3-8778-a07df366b74c", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340235, "uuid": "0d215e90-91aa-4051-9cd8-77afcd2c65e0", "value": "6144:Df4wTbJDTCLY/4ohMZiGGSPNzIQMLJ2PMaIve:Df4gTCLgKoGGuN8f47Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676340235, "uuid": "80e6c8a9-78f5-4f65-952e-7c62cc495c6b", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676340235, "uuid": "04a30884-28c3-4e86-920f-819072ed1d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340235, "uuid": "d7b76abd-6ba9-425d-9c06-b9a9b50c85e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d44a879-aca9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676407866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407866, "uuid": "8edfe852-e123-4597-b1e0-6be66a1acad6", "comment": "Malware payload (Amadey)", "value": "df29909535b8a8043412729b51fc0fa0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407866, "uuid": "25a20ecb-7d4c-4937-abaf-a979e2d269a7", "comment": "Malware payload (Amadey)", "value": "3ed9d0490518a8ac661db2d31e1d5236e52d4713b9349d4fb334659017452c16", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407866, "uuid": "adcfa533-d492-4861-8a8e-82ff0a509c3a", "comment": "Malware payload (Amadey)", "value": "95dcc9be49d08b45a7a2ec81ba3e2cb37a468299", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407866, "uuid": "6e2f2e7e-4d93-4df2-8712-500603437d4d", "comment": "Malware payload (Amadey)", "value": "f5700a8a24000e5804ea1fca273c4ee563d4934561e2f5ba22943d7feb9b9e42c32403683f940608db80244d65164e45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407866, "uuid": "e0ecdd1e-2ad9-433f-91aa-ae1a36336a47", "value": "T1C7F40253EAE86167E9B517B018F743C306377DA0AA348357674FAC6A4C73524B23836B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407866, "uuid": "ed9d5247-437e-4add-bc75-978238f3cd04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407866, "uuid": "682672b4-1d03-44c1-9f93-915cef3ac370", "value": "12288:7Mrjy90E1f4mZ2+59Hc+J+SX6csXKc+5guQRpkFk48mo0RXIaejXxwMeeZZo6:Eyt98+JP6cMKr5guQ/i8mo0RXIaiaMfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407866, "uuid": "2156fcbe-9208-4e2b-aa89-28a90f0caea1", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407866, "uuid": "a48d550e-ab44-4513-96c7-623b720f03ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407866, "uuid": "413e349d-3926-4743-b4bb-7a55c4282121", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df8103c-ac4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676368837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368837, "uuid": "a66f103c-e137-459f-9fa1-11f0eec15f8f", "comment": "Malware payload (SnakeKeylogger)", "value": "160185aa548e3086c272c866dc32fa28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368837, "uuid": "c3e7f155-2986-42c3-b0a4-1bdb1e52735b", "comment": "Malware payload (SnakeKeylogger)", "value": "3f0c5601bba6d7745de7e14a7f7d47dcc3b22f55e7269e98403f772b4f616378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368837, "uuid": "6f6900c9-5d92-42a5-bbe3-a8a9b3e27ea4", "comment": "Malware payload (SnakeKeylogger)", "value": "51dc67dda50589f756e59dc9210db5f158b788a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368837, "uuid": "d5de44d8-c0c7-44c3-bd0c-bf8e6af78c2c", "comment": "Malware payload (SnakeKeylogger)", "value": "0dbaf18c230fb0427becffd7aa067414a8272fbd7773dad43779086b39581e7fb166a6314de9dc09171472f52d0a1fd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368837, "uuid": "d2a81e24-a054-49d8-9d7d-72493c32b650", "value": "T171F412061E699621F4F69E7D073DA5A84F206DE82BF3E2780ED159EE6013763C00A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368837, "uuid": "b9d9680c-4dc1-4a00-b9ea-ab39831d58db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368837, "uuid": "b473844d-c575-494d-b7e2-2badb9650aef", "value": "12288:zC5IgQ71Vd8AYC0NDxcVDjayyiiWZQa4YojsBategiMN9nn2Jsh6q6:zIQ7jVQxcRjayhnZ5HoFcG3nn2JsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676368837, "uuid": "e9dccfc6-ab4e-4587-865e-71aa83835523", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676368837, "uuid": "53b1648a-06de-4029-8bda-2e61311d6cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368837, "uuid": "7edc88fa-075b-4c1e-93a1-4d444ade25d6", "value": "Final rooming list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1680c57-acb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411040, "uuid": "47fc0351-d97c-41e2-af09-d0bed89f71fe", "comment": "Malware payload (RedLineStealer)", "value": "cf572edb3a45215da1248d111f59fa04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411040, "uuid": "b7f24aa0-449a-40ca-8b8e-132884366421", "comment": "Malware payload (RedLineStealer)", "value": "3f12b77a2f5d3b5399a957b765c4ec42143efe19ef470ae87337df56e90bfd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411040, "uuid": "d0801468-8124-47f0-bff8-e5b365c09537", "comment": "Malware payload (RedLineStealer)", "value": "2caf5adfcbc266b5493fd5cff05ab6543541d25a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411040, "uuid": "d9b0f16b-7e1e-43c7-b968-aa93e0e351f0", "comment": "Malware payload (RedLineStealer)", "value": "95459204b34ef4f650cb6d90539e4b085990c6f40f69d32955a02422552dd001d7f212c568076e922562c685f9c948aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411040, "uuid": "20e1d6e2-dc1b-402e-8608-e4563005e8f9", "value": "T1C0252357ABE8C063E9F91BB01EFA03D306367DE197B49287634D8D191C726B0A13476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411040, "uuid": "ea38c6cf-b1f0-4b26-8701-ed6a607ce5af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411040, "uuid": "c86e0508-b554-4975-ab05-69d14f2886f9", "value": "24576:4y1bfX6IC7hEXohE3taH9ItIKOAa09Wy3Gk/JV:/BfXQhEXohdut1a09WuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411040, "uuid": "0b1da1b6-f87b-449b-9bea-6db196249888", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411040, "uuid": "87770f30-fe7c-4ff8-ae66-43fd15753b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411040, "uuid": "0aec9953-9c71-4889-9267-463b74ba3964", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0062fdb2-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399576, "uuid": "d4c991bd-17a5-43e1-8e7e-56beb46f7d72", "comment": "Malware payload (RedLineStealer)", "value": "b5b088e47af91c344e3583ef9391586f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399576, "uuid": "f888fa21-9179-43ed-8dfa-914fddb6a521", "comment": "Malware payload (RedLineStealer)", "value": "3f201ce75b624c56d73e6aa11e0d93825455d0ee88d3fdcc8e2f3bafae6cc739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399576, "uuid": "ef697654-a7ce-4792-9408-5dd30a6c6b63", "comment": "Malware payload (RedLineStealer)", "value": "81c28284f693f66d1d30b8ee09f0d69e27457333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399576, "uuid": "95ff4952-3b16-44a0-9fbd-9b25d9abcf9f", "comment": "Malware payload (RedLineStealer)", "value": "ae1b9665fb5c694dce21bb8bc3c48f09e1725d75da7e9c4495348ff2974d0741f5c9067b01a6f3ff3fa38b4b92f21142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399576, "uuid": "b688c725-bf2c-4f89-bd51-37c0de8b0558", "value": "T14654F1263DF1D072C0575678C824EAE0E97EB8F14696C14F13581ABE2EF02E2967B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399576, "uuid": "13a5b9d7-e0be-454a-b678-eb90f5e94902", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399576, "uuid": "f3b3236a-a1fc-47cc-840c-bcdbdd57b57f", "value": "6144:SLHxqLlLzQzZWKGxSkCUVYHyk7MW5U31:SjxCVzXHCUw6W5U31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399576, "uuid": "b5b4478c-b311-4be8-a5ce-6282ba6d6769", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399576, "uuid": "2e9746f8-d2a0-45c8-8271-0045b1a62492", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399576, "uuid": "39ee5225-9d60-4e92-ab70-5203c8b70ecb", "value": "b5b088e47af91c344e3583ef9391586f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01fe38e-ac72-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676384383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384383, "uuid": "11b8d96b-995d-4547-bed2-06818475f317", "comment": "Malware payload (RemcosRAT)", "value": "7a904d47ee91783b4ff379093ddb333b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384383, "uuid": "c3428c65-6032-472b-94eb-8696f2705571", "comment": "Malware payload (RemcosRAT)", "value": "3fa0a1d295887bbf530fdec6ba6ad140b8a185507a630fdb12bff7f0cdf355ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384383, "uuid": "1b97a63e-6df8-4d30-8976-f79ba0f8d3ed", "comment": "Malware payload (RemcosRAT)", "value": "a2d467355cc2933b1986eba160420ac38997a5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384383, "uuid": "2ff20c84-1872-486c-8d85-0de96943f610", "comment": "Malware payload (RemcosRAT)", "value": "efac797b1092a4d1d57e4c92e493729aed90182ef51e7d5aacb1ec1f790af96f116602515c7dfa4ee1b0a071739dd58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384383, "uuid": "47b051d3-d5d9-47f6-980d-ffed48bf4de9", "value": "T105C4F00633988EA2D05CC4B6CCA13B9E073F574A2ECECF827A797591841E3D95797B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384383, "uuid": "962cc4f7-2bf1-438e-94f5-5fa938f87b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384383, "uuid": "7d319c01-6831-4fb7-ad97-ff593ca6ddfb", "value": "12288:X3D1eItkatK3CYLfTVJiqubs5X1SVE8kJ4Km1BQ1jcLP:5BlYSYLBJiPbsSRkJ4KmfwQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384383, "uuid": "fad8eaf8-b095-4ce7-8e46-e3a89b33c121", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384383, "uuid": "e3a2f077-5ed3-4b86-9418-ce3eb37c1d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384383, "uuid": "0e1fe23c-d843-4b5e-b896-5b8c4d7d2f08", "value": "Revised Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bacb8f-aca9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676408140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408140, "uuid": "bb920017-fcca-408d-bbcf-f52ab29a5dff", "comment": "Malware payload", "value": "0804a816e70e900e831d71aefdfc248c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408140, "uuid": "e360d5b2-9f93-47ef-97d8-1c4c7b5b773f", "comment": "Malware payload", "value": "3fbe3b923ff64a83a304581f28bbb00a718647aa88bcc459055fe18636ae9e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408140, "uuid": "5a739f80-b53f-4c29-b55f-850fdc1bad3b", "comment": "Malware payload", "value": "b1cb2a3a0220cb3aa24bea6847c13d5d3c9eebee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408140, "uuid": "2bbc1750-faf9-41d0-a08d-15c23d854a98", "comment": "Malware payload", "value": "450b25234e961411fc2a1d28f1667185a3b62c61fe05512ed5dc11e79be09d160adfb9da5cab5470537c3392bce8aca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408140, "uuid": "9f8e9d44-af67-4435-9c1d-aa7f053e3453", "value": "T125932A0388618F77D0456DB126BB5A300727BD220F4F0F99766D9AF44B4B8CEB51EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408140, "uuid": "d673883b-5b3a-4630-8c82-779f2fa1e420", "value": "1536:IWUoj4w+Ii4LKlhKqICOqH9gzjHCM5h1Wo+j1QEo+ecMnhR090jUeQfXm:Nv0LplaCOqoH55h1Wo+RficMhR090Qer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408140, "uuid": "602cba9e-c4de-4c22-a9f7-559321f3eb77", "value": 95918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408140, "uuid": "ad83e138-b44a-4134-ae30-dca7e9cacb02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408140, "uuid": "01a3823a-3b9a-4795-b0ac-4e350584c4dc", "value": "0804a816e70e900e831d71aefdfc248c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cb0302-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401981, "uuid": "b2615c24-f5c7-46a1-bd44-fa9ce3f96ddf", "comment": "Malware payload (RedLineStealer)", "value": "da34e4771674499717a515ebd08439cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401981, "uuid": "e5fe4c92-f272-43cb-87bf-4ef679ff2639", "comment": "Malware payload (RedLineStealer)", "value": "3fe00972cea01da5ee95b7495905aafd5a4ccc338da94a7997c502016bd2e571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401981, "uuid": "60b0461e-dcc9-442c-a3e7-c2e699fc6776", "comment": "Malware payload (RedLineStealer)", "value": "246f0160d08c6441be04012370d3713f9bbfe841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401981, "uuid": "ec3e12e6-5ee1-4c47-a8b4-4e31f38e6681", "comment": "Malware payload (RedLineStealer)", "value": "bf5ab3799b50a2e8aaa36afae013d0e88968e8c772de12130c6da0163af0546fa2468b3dab332cc87c67f5fd36c5ae6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401981, "uuid": "aee06274-ca2e-4261-8012-f45b25d3e982", "value": "T1C2A4F107F7EC8032E8B5577019FB06C31A7ABD509B78839B665F692A18726B0B131377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401981, "uuid": "3e0e5408-5b97-4b28-aa68-2fcdfbd6302c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401981, "uuid": "079e2ce2-91d0-422e-afc7-ee18f7da3324", "value": "12288:xMrpy90Q6vX2mGHdP6iFEbTdkvNu291dTsT:syfJmeP6FbANnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401981, "uuid": "47578940-6d64-44e6-a216-b0de9e9ce54e", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401981, "uuid": "019e523d-3533-4b93-a11a-a6c09f3166db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401981, "uuid": "046d0816-73a0-48bc-af71-029b50ed9ef2", "value": "da34e4771674499717a515ebd08439cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c357d30-acc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676417662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417662, "uuid": "8a796f03-d19b-4406-a2f4-a3055f6d2323", "comment": "Malware payload (Amadey)", "value": "5e83b59e846df0d8436e0e0472c61b8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417662, "uuid": "679a152c-9deb-4678-8967-829d3248de79", "comment": "Malware payload (Amadey)", "value": "3fe492abd256eca4fc0d77d26168b0abd383fb2ecaa12fb2fbf6528cdcf75cd9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417662, "uuid": "dc91f2e4-3074-4289-84b4-ac817e506da2", "comment": "Malware payload (Amadey)", "value": "b1adfb2d5d99245b20fe11cd12007d794633fcb8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417662, "uuid": "e4302b3a-82e0-4ade-952b-3698fac2e317", "comment": "Malware payload (Amadey)", "value": "1756e347742c0f1943b1bd08aca0dfdad19871739332fa1dcab77251df7e57b2e3da355eb396a93f1e51541e62d3b1bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417662, "uuid": "c7758ffd-bf87-41b8-9c83-493b75cca3a8", "value": "T1F3F412479BFC9462D4B1273019FE03D30A373E749A7843D6274E6D5A5CB29B4A2307AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417662, "uuid": "cd0215df-db19-4f46-9271-a347fb90fc54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417662, "uuid": "cb326678-9f5a-49bc-9703-e90c909b148e", "value": "12288:QMrSy90w+fkg7k9HGJZUELcd+tLWH8oLxTUWdaK+WpApxq1Db6W8rSG1T:Sy2fkX9HpEYd+k+K+Wpmq1Db6fN1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417662, "uuid": "f6d749ac-1a3b-44c4-9156-2ad86e45cb06", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417662, "uuid": "38364cbf-0452-4e41-b646-c3d92d2fbf93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417662, "uuid": "36d7286b-87d9-4a13-8e8c-40b0a958db2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb434a2-ac01-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676335710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335710, "uuid": "6d4750da-24ed-4e8b-8b52-f7c606971e6c", "comment": "Malware payload (RedLineStealer)", "value": "cd01e0685e9af2782116206b7002af22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335710, "uuid": "40c38217-574f-4e1c-9531-3bdb95cec39d", "comment": "Malware payload (RedLineStealer)", "value": "4051ebbfc4ffa7d4baa4f9c1bffa93e8faed682631026bfe39a6bc2564bc8db8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335710, "uuid": "b57ff2e0-34c8-429e-bf4e-9e6457cef273", "comment": "Malware payload (RedLineStealer)", "value": "5d4ace61fc19ffda199ab2ed210148b218239c29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335710, "uuid": "0c1f84d4-1ee3-4a04-9e5e-eee60e9f12d2", "comment": "Malware payload (RedLineStealer)", "value": "aa0a6347a1d3b275361ce083ca0af0a29b1acb3562266aae0e70bb2922589c38a712e4a6edfd4b01c4175237a9bac6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335710, "uuid": "b135e610-4582-4166-9c5c-a6a422857609", "value": "T15BF41207E6E89432E9F4A77018F607D32B367A105B74865E278E782D18737A0A23577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335710, "uuid": "c34d2a39-b9db-46a5-b380-3dd896ba81c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335710, "uuid": "94ca22ff-539a-4445-bba9-aa1b59d40335", "value": "12288:+Mriy90N5ffWfC5QZc3ycAnv08fZMvjieJwPbEnqtlHJ5BRNhctPD6Qoi9tGdE2:0yY5fefC0cgvhMvfwPbdJ5qP+Qxtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335710, "uuid": "b6f99dd4-ea40-4701-8252-86eb91852883", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335710, "uuid": "1c2dc33a-b965-4a09-8423-2358e75b9248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335710, "uuid": "cbe55d6e-9d1c-4d7f-bb90-7b5392391fcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324977d7-ac0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676340819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340819, "uuid": "b33c26e9-ae09-4052-a7ab-c1a2d862d9bc", "comment": "Malware payload (RedLineStealer)", "value": "890622342be709919fb09b6d7317de34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340819, "uuid": "632ed4d4-3838-4555-b304-6a6a6c459b08", "comment": "Malware payload (RedLineStealer)", "value": "405d0858c5c005333cade82d1f2a2fbcec72147eea777012efef2f1d3598c04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340819, "uuid": "1b336228-2235-49e1-ac06-c5013f5cc53e", "comment": "Malware payload (RedLineStealer)", "value": "d8f2615426c7b9ab772b85d89ad0a7515051e941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340819, "uuid": "83c46de3-b59e-453d-a4d9-82cb858f9312", "comment": "Malware payload (RedLineStealer)", "value": "3f49951be324f3c24f7db1dda87144a7462473515c820a646df9c4884b74744a454dd783fd3c96a2311b4f9d4b460ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340819, "uuid": "42ec7f25-a199-416a-b0b3-868c1591c5f8", "value": "T1F4F41203E7ED9572E8B083B019F303D32A367D705A788757225EEE6519B29B0A631737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340819, "uuid": "208bbd2f-090a-47b3-a787-d33635252a37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340819, "uuid": "9d1d7127-6c79-45eb-94ed-67634f1f9e39", "value": "12288:OMr3y90+YhVsItW70N8ZjTfSwYeDEkuFMTL69GZBOQOM:pycVL16T9YEyCTL64ZBbOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676340819, "uuid": "126c61f3-245b-44e1-9237-6d5304e70001", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676340819, "uuid": "d2ce0a32-e846-4a6b-85ab-b8cecc518270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340819, "uuid": "3543d564-2a57-4db4-ba7e-4a69d4756cb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e70634a-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382420, "uuid": "7e120707-447b-49dc-b5b0-3130127f7073", "comment": "Malware payload (RedLineStealer)", "value": "e1eb37a6afd5b99ea7bf21d07201e599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382420, "uuid": "e9d3a8fc-df59-44b9-9cf3-8de6fdae2af9", "comment": "Malware payload (RedLineStealer)", "value": "408d7b778f16ff3fc4edcd0916e895b04f9a1a1d9d2af2c18405a9dd230288ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382420, "uuid": "34c42feb-fd54-4b0c-b6a9-df96cec65769", "comment": "Malware payload (RedLineStealer)", "value": "94a53a7a162f48dea76bb694d4afc65799823006", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382420, "uuid": "8ee66d5f-7ec2-4b80-b5b4-242a57e6448a", "comment": "Malware payload (RedLineStealer)", "value": "a2bbbddee3bba2a78088f7b32d2a6e043af87151efbf2e9e3d22bf9ee395b3af1d6e7ace2cee3af947ae44b8ad237f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382420, "uuid": "180e33a6-57a8-4301-bfca-510709418ce0", "value": "T1FEA4020BF6E8D062D4B007701DF606D31A367EA25A3443AF228F9C6E19725E5B63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382420, "uuid": "7e847b03-3048-4eca-9370-7722d0649599", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382420, "uuid": "ec3bfdff-574a-488f-9373-83db25bf63a0", "value": "12288:eMriy90nQ1a+3SKZEI1PNY9XrOCZsoSSzjJo/:gyGASiEIw9HsoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382420, "uuid": "89ebbe7f-565b-492d-bd2f-d1b62f356e91", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382420, "uuid": "d9fe1f76-9be6-4095-8df2-bc409923742f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382420, "uuid": "2b9af32e-5721-4ba9-8bd1-81c373a31325", "value": "e1eb37a6afd5b99ea7bf21d07201e599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f7ea50-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676382114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382114, "uuid": "f7d4f54e-a01b-4672-a45f-a02c9412199f", "comment": "Malware payload (Amadey)", "value": "513de9948fb8e77a755b6278b72c93b8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382114, "uuid": "2ba3d236-5d5a-44ed-9a2c-3935f8a3a494", "comment": "Malware payload (Amadey)", "value": "40e9ed40912b3f29776dac2661bd144740ac143fbdb1f450ebe07845d97671c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382114, "uuid": "0266b9f3-f372-47c3-b5f2-f528674e07dc", "comment": "Malware payload (Amadey)", "value": "0bb77c70b9a95919abe5d99ec6167e63508ca615", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382114, "uuid": "427fc736-5e85-4566-9a55-9cd00faf6174", "comment": "Malware payload (Amadey)", "value": "3ce351211f6bdf650c716cc4190b040d42b6dfeb6edb659685bd2d9257a00ffb0897b71e83789510ea4aba2ade1ecc68", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382114, "uuid": "aa223f31-eb2f-420f-86b9-4d626dd22f65", "value": "T154F41203F7EC9022E8B2477019F603C32A367D616A3883DB674F999E1D729B5653136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382114, "uuid": "371a2fab-a386-4544-9820-c5fa4de02ed8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382114, "uuid": "6aae2131-0c31-45f8-bb5e-d36c5e23234f", "value": "12288:ZMriy909Y+V/t9NnaPkLHklFJMD54BA5sY7m1yFVEA1IXMvDc11/CoK3Gol5KN:LyknV/57DeBAcGVZKcvDymDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382114, "uuid": "9a890e91-3c2c-4b1f-a70b-b53ec9272ce6", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382114, "uuid": "9d2b4e27-33b9-43a8-a579-b9111a4c6e82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382114, "uuid": "253de481-7c2a-47ae-ad63-6b6552029520", "value": "513de9948fb8e77a755b6278b72c93b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfee5e1-ac1a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676346744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346744, "uuid": "068bc964-8579-4b80-a401-db410e61339c", "comment": "Malware payload (RedLineStealer)", "value": "16f1fd6f1cc9f010059dc72d18a802fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346744, "uuid": "89a4f097-ef99-45e9-9c40-10e06322ddda", "comment": "Malware payload (RedLineStealer)", "value": "4111c34d83215da13fe371bddf6e240c603a36795dfabbd0758800504e8e29e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346744, "uuid": "556752e0-e9d3-4b63-96d1-6dc48b509f4f", "comment": "Malware payload (RedLineStealer)", "value": "bacbf0798f30cb7df5ff6bc9e88b0924761b5880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346744, "uuid": "6eb3940c-d22b-4025-a98d-91209812cbe1", "comment": "Malware payload (RedLineStealer)", "value": "170ed673579933fc11fee63939f8c5d687b693e6bb893ac81e3eeaf52c1e18acd2dc39c865627fa333383458008bf3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346744, "uuid": "120b83fb-2e07-4631-a5d0-7bf5debcf885", "value": "T14BF41207FAE88162E8B457305CB247D3083ABDA16B38835A624FBD5E1D733F0A570766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346744, "uuid": "61620500-b865-4ddf-8a0a-6cb910426931", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346744, "uuid": "5d403b81-fa38-414b-9d9f-c4698136f5bc", "value": "12288:FMr2y90FSpIq0fygqMFr+EzVavDExJ3rfiqfzU/tAu7EgNdZTaN9xS:ryohq0fylSavDELeqfAl/EgNdtW9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676346744, "uuid": "caaf2ee4-cdeb-4a3b-9622-7e519649a903", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676346744, "uuid": "96a81f66-ae9b-432f-8769-59507bf7e2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346744, "uuid": "820fb29b-c231-451c-9372-bc9dc3dcf8a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52b0316-aca9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676408148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408148, "uuid": "ad578994-6baa-41ed-a315-021f895ae8d5", "comment": "Malware payload (Gafgyt)", "value": "128e4ab51a5fac2d0dbec5f99ab2ecf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408148, "uuid": "d80a2356-7f00-426f-b6bf-bb3fd1034aa3", "comment": "Malware payload (Gafgyt)", "value": "412eafe68515fcc624b87190cd42c1e062fd5e073d1c0a41a50de21a6c05c128", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408148, "uuid": "d2f6673d-c046-4d4e-beaf-b189520aa9c8", "comment": "Malware payload (Gafgyt)", "value": "5986e410e2a6fd2930df1fbaac1142ef403bfe87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408148, "uuid": "df64dfbb-04d0-43ec-9c47-b59b6a1ffc5d", "comment": "Malware payload (Gafgyt)", "value": "d3a53b7e78533697736093678d9c12f5858f8b8c925f0a56fd16f63402589a1222acbec67b7beb6b7d7d432babde32b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408148, "uuid": "1e95b17c-6f29-4d30-aa31-373da295e1e0", "value": "T1CE241624BC16D217C0E3FFB9EFE4BA9AE719E2C70B8592036570106D1EF5A59641FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408148, "uuid": "5119553f-4989-4bfd-af8c-e6f1ebac6dff", "value": "3072:hZeILcYNGwH8VKcCiFyQKKslJtlxmksDQ42mNK4/X:htUwH8fFyRxmksDQ42mNK4/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408148, "uuid": "f5ed15eb-c664-47f2-92b4-e662b6e47a61", "value": 222062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408148, "uuid": "5c2ef09d-1332-4848-96a8-b492ceffb42b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408148, "uuid": "fcfccb11-94ed-4948-bda6-b8c31ed7443b", "value": "128e4ab51a5fac2d0dbec5f99ab2ecf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c61b37-ac47-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676365702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365702, "uuid": "eb7ae9c6-bc35-49e9-aa16-fe2d2da95610", "comment": "Malware payload (Amadey)", "value": "97576c8c67b1a67139b2c535dc75d76e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365702, "uuid": "2234ff7f-44f3-47f7-995f-bd7e38931e04", "comment": "Malware payload (Amadey)", "value": "41ff5564a1f38161977504c52bb22086ed972749f4db28e2fc763e41684d2f20", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365702, "uuid": "dc4d9925-c3df-4465-9614-6b9ef6751dbc", "comment": "Malware payload (Amadey)", "value": "570424838cfbec9377c7070d5bf40efa1a735c25", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365702, "uuid": "bb60a8c2-378c-4c4b-bbd0-e10db571fe5e", "comment": "Malware payload (Amadey)", "value": "4172bbf7430b9ca6bc916cbd4b2d4f0b16a5aa97cc6cd25f5b6cd9319b568e3511806386050a0ed71518904cee2e7b8b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365702, "uuid": "5873cadf-df62-41b6-9048-438cff9cba8d", "value": "T124F41207E7FC9022E9B497B119F706D306367EA05A35838BA64F4DAA4873670F235367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365702, "uuid": "0af23721-beae-44a9-a0be-591545e6326d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365702, "uuid": "0b1fdc3b-a2ce-4f86-bd45-059030ca54a2", "value": "12288:JMrty90BC7ayqdIXptRGsuQunIFy4ZOOEnDc7d9z2DBNbYyBOsv:cyZ7RqatRGsuQOoZORY7r2DjbROo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365702, "uuid": "8dc95ba8-1d21-48a0-aef0-34b453594f56", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365702, "uuid": "7252db84-ffc9-43f3-ad8d-37e4db1c9e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365702, "uuid": "81cda5e5-f91b-468a-a529-5212e864861b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d41f595-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419167, "uuid": "0a8a266c-d53e-4542-a736-2d1a38c5e9f6", "comment": "Malware payload", "value": "070b16e9a08b598f4cf8e54c0f3e1641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419167, "uuid": "050d7dfb-895c-4968-90fa-ae08aae9f1a4", "comment": "Malware payload", "value": "423b48b419817a48900acadd7e98cbe7abe609a7e7d0102bd1ab3fecd65d9e85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419167, "uuid": "5fb9fd50-d1e6-4d86-add2-2c32a3dfe977", "comment": "Malware payload", "value": "cf5e3c6c92d93d43543fd1c1d476270fc364a64c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419167, "uuid": "17a52c25-f02a-43f1-bbc4-16ac724efe3e", "comment": "Malware payload", "value": "bbbbdede27b8da8be1dbd7bb2573dadc39bfafd0d9d6e0da867ab286196df19ed1d23b163b8d4eb2117688fb72c89d2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419167, "uuid": "c58d47ad-3110-4a1e-8f7d-2bbbf504bd6e", "value": "T1B9534C0037948F07E8AA5EF5283F17D583BEEE4016E9F0846A0FE74A8235E735559F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419167, "uuid": "5e367f2e-9da3-4c37-96a0-b49dc7043454", "value": "768:SECdw4BNERp6KrRaDtW4+3Tdti+ZMid+yQG5wU05YNY+cOGchU5dxWinp6orkPe9:2ZWn4+fUi07fdB+cOGNWkkPebVHXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419167, "uuid": "5b651e33-c677-4aef-b03a-e888124e1584", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419167, "uuid": "1ec45c8e-ce55-4637-bd0d-db7490548b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419167, "uuid": "02600b80-9f61-4071-8a34-77ac8a3feedd", "value": "070b16e9a08b598f4cf8e54c0f3e1641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca87bd71-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676393044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393044, "uuid": "792136ef-2754-4784-9b25-887a7ba60368", "comment": "Malware payload (Loki)", "value": "b32e77ccd63a02348105bf3ae46bcdc1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393044, "uuid": "49fed452-1678-40c7-b625-61c2e4d97d1d", "comment": "Malware payload (Loki)", "value": "4247d8c4cc8ced5bde8fa9dcf8f8dbea2aead9fe95704e8034208b4170f19b1c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393044, "uuid": "86f5541e-d78b-4554-9f1c-987c3b2044ce", "comment": "Malware payload (Loki)", "value": "8d7b4962d02d11b1397e2e0733a3cdba7f518455", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393044, "uuid": "3171b46c-f2d1-4d24-a7de-ddb6d42f2f1f", "comment": "Malware payload (Loki)", "value": "2a0add7d90581c110f1f3f81a9a2881e4449285f9c0ff22d49f57bbcf3a2ed861bc1178293e9cb3676deb85410e2ecc5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393044, "uuid": "88810745-2b42-48c8-991d-9062e64a8008", "value": "T1B613175AE39F0268CF511277231A0A899AFDB33EB351556134AC933433EDC3E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393044, "uuid": "ae8fd1e1-45cb-4c1d-8563-0e24b5e0e6c3", "value": "768:DFx0XaIsnPRIa4fwJMXJFhzCk2Ql3ZK3Deu23PJ8p5TilW7fr:Df0Xvx3EMXJbzCk9MTJ23PEilCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393044, "uuid": "cecf6dea-a627-4335-8644-36f427f9e04b", "value": 42004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393044, "uuid": "c7f7928b-4c14-4ac0-ab76-82390c979031", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393044, "uuid": "a53e87e3-a074-494f-ac4d-df5dcfac1ab1", "value": "Invoice2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2ecc4e-ac58-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676372996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372996, "uuid": "70af9860-f712-4657-bfd4-3b8300ee94ca", "comment": "Malware payload (AgentTesla)", "value": "809b9865763e2eaca305dde6e8da977d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372996, "uuid": "2555b304-d3d1-4f20-8b00-c5b72593a526", "comment": "Malware payload (AgentTesla)", "value": "42506f07f9a1dae12669d6efdc948d3e981be578316d3839554d252bbb741b2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372996, "uuid": "8ca3fde9-aab4-4dad-9689-0aa8e4eb74b9", "comment": "Malware payload (AgentTesla)", "value": "77b4d0e3667d5dadb01d681147eaf21120112bfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372996, "uuid": "afd130b8-9b8b-4fa6-aa01-1a693a745ef1", "comment": "Malware payload (AgentTesla)", "value": "35c8ea1f902b5024b5e0905ee296928f961d03b22766d310fce0f16900ffcd400a75310ecd1b90f1f3620d2c0ba11205", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372996, "uuid": "fce7645a-0b6a-40c8-83a7-c66de15fd151", "value": "T126B4232CAC9396D69D8F334C7BD9A4682EACC205756193B563F00F3CD46D43326AA25F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372996, "uuid": "7b0e555f-624b-4900-8b6e-7804ee593130", "value": "12288:K1JRmOUr+OspPdunmx46t3JwSao1TcXYksjlYNYq3Fl:UJRG+OESmNaITcXuiNPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372996, "uuid": "a0135e4b-7f26-4aea-97f2-262064d4bc04", "value": 506549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372996, "uuid": "05cef39b-850a-45aa-8bc9-d48cd895a210", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372996, "uuid": "4bb027ff-048c-4142-9535-95762f4ffcd2", "value": "62,842.51 USD and 31,101.87 EUR.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb4bac0-ac05-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676337641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337641, "uuid": "156b58bd-0f34-4380-8097-6ce8219f3654", "comment": "Malware payload (Smoke Loader)", "value": "6b7824623a3b9a2cd0bd318cf68bfd5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337641, "uuid": "88a23333-9582-4e6c-942e-e5ff1fb7444a", "comment": "Malware payload (Smoke Loader)", "value": "42911040e66ed6ae8e068259d18083cdcd89aaa36195e0b90695529ba0fbf607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337641, "uuid": "61f5844b-20b6-4740-865b-1611a80021d4", "comment": "Malware payload (Smoke Loader)", "value": "8020517bf58ed22bb1ec5e1ab81d01b41d8f043a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676337641, "uuid": "8e00d944-7965-420b-8630-e508f547fe3e", "comment": "Malware payload (Smoke Loader)", "value": "3f2a1a8144dc748046b25e2205c5c393c7a9d1cf75b68921c81541066b154fdc32b18a6eb13b136d397aa6256b5e40a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337641, "uuid": "c8708106-cfb6-4cd2-8e98-2b590b5f857d", "value": "T1D714CF22B3A1D472E8265A314D76D1F47B7EF8215B759ACB33946B3F0E702D08A76342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337641, "uuid": "2a63e58f-c0f1-46b0-b2d6-8fdfe0d9e55b", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337641, "uuid": "22a48444-ef98-4288-b100-0245f9d6f296", "value": "3072:WJQu1a5z0mI90/t5wLT6iR0pJE9NJSuHS03FOE5U6MC:W5Y0/cjwLTufaHzfZ5U6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676337641, "uuid": "49c77142-8c36-4d7b-9464-0720fe4bfa4c", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676337641, "uuid": "028f06ac-cc15-4cfe-ad25-887b701c7fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676337641, "uuid": "ab39578b-bb5d-4d16-a36d-9347cefaace3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd804c-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1676399334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399334, "uuid": "abecb372-858b-4089-8760-bf7fc6fedc37", "comment": "Malware payload (LummaStealer)", "value": "2e4931b68f2ba37d93dd6cd9dc2a45eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399334, "uuid": "1ab31852-0a90-4a5c-96ba-e70cafbba217", "comment": "Malware payload (LummaStealer)", "value": "42944063ef13019577bc5dc43df4ee39581a1ce2de95703fcacd84c5549a9b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399334, "uuid": "56436820-ac98-492b-8c07-12fe809073f9", "comment": "Malware payload (LummaStealer)", "value": "262a0998fb05dda5b543745038a42c3d87c36b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399334, "uuid": "0bb8f83e-6f7c-44ca-b986-a9c4b65b326c", "comment": "Malware payload (LummaStealer)", "value": "636f70814c529299a1ab5364c552cf38fac9df3319c7cfc537000a25b5c5f80b6da0732231960751b1bbca7b11921a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399334, "uuid": "3b4d30ee-61a8-4a09-b76b-460b89123b72", "value": "T15266337313B02185D1D2C93D8A3FBDE5F0F6526EDA4A9CB99AE69CC124168F5D213E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399334, "uuid": "fcd28825-f3d9-46a5-9de7-3924b5494fb3", "value": "de12abdbd84b3d27dd49eebc3491abf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399334, "uuid": "af3ded94-f0a8-495c-b96b-8207bdc196a2", "value": "98304:xFuRNCvw5gV1QyD202iRzqKsTAH+AGhdnCzBP57cTRqp89cSsx9cC27fZXaHWRdG:34gl72S+KTaGBOcpK8otX+WRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399334, "uuid": "8eff4e31-624f-4447-b060-fa50d10d43b2", "value": 6638592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399334, "uuid": "6ff7845b-2e9f-4042-a8e4-5b4ac795f45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399334, "uuid": "09ba3169-d63d-4be7-a10d-c77c44c09700", "value": "2e4931b68f2ba37d93dd6cd9dc2a45eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b4fdf9-acb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676412207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412207, "uuid": "71aadaa4-95c5-44d7-962a-ab0f50eeda5d", "comment": "Malware payload (RedLineStealer)", "value": "4460a0bd4c085a9c6d52ed0085eadccd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412207, "uuid": "be5287c5-a11c-4475-a003-8b46ec55fdcb", "comment": "Malware payload (RedLineStealer)", "value": "42c0cdf588b3b55cb533fb1b96306642621c5664cc1c94ac4809d4dffa4dc06e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412207, "uuid": "1dde5751-6400-4f0c-a9ab-9b2f6f0eb40a", "comment": "Malware payload (RedLineStealer)", "value": "afb75ad6c5816fb0ce6ffd7336fddb2e98f78a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412207, "uuid": "b6eb3ce8-5ca4-424e-bc66-a0e0a7eaee18", "comment": "Malware payload (RedLineStealer)", "value": "99177ccd51926514d5f00b15a8dd3556143e5be2c41ac2f7fd0bbda1e15c8e9ecb1d1160fe7df70d5f6815b9a2eeb01a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412207, "uuid": "6c2e23bd-1190-4d26-a471-48ef648cc6c8", "value": "T1D7A40217E3E89062E4B567B058F703D306367EA15B3852DB274E695E08B26B0B73136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412207, "uuid": "5391921b-487c-4571-921d-ce7b90857323", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412207, "uuid": "71780ca8-9e05-4a67-a766-b4e50855b3af", "value": "12288:7Mr3y90BFLzLqN/08lFyzINpsx+9mredYxLZ8L:Ay0FvMXNpsxipdYML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412207, "uuid": "2c811169-2926-4afe-ba82-9a8944878591", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412207, "uuid": "1d3e830a-db86-4776-ad4a-f04e50dd50dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412207, "uuid": "ff4c170a-ec73-44a0-9be2-34bb1078618e", "value": "4460a0bd4c085a9c6d52ed0085eadccd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37736702-ac5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676376047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376047, "uuid": "8cea6058-bbba-43ab-b510-970395909426", "comment": "Malware payload (RedLineStealer)", "value": "b2978f807240d20a14815e7ccf253897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376047, "uuid": "4795f8ce-eead-48c5-8475-0fb0aef36069", "comment": "Malware payload (RedLineStealer)", "value": "42ff764c2e6f0d6177436238331340e11c4235bee8a50decfb435eacf90c1cb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376047, "uuid": "be749859-172c-4339-9b9b-fae5713f116d", "comment": "Malware payload (RedLineStealer)", "value": "f221c40cb93b985738023fa56cb6897eac155754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376047, "uuid": "85c94136-95b8-4d64-90d1-d7ea7a9525a1", "comment": "Malware payload (RedLineStealer)", "value": "2a85a8149999db930fe07b6b30eaae157ee014feeca2d82a36208689b224682aff1cd35c8991952c710b51396d204a47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376047, "uuid": "a49acc28-b91e-49cd-b199-406cb5c1416b", "value": "T1D8B40217BAED8032E874677019F607E30936BDA05B39834B275FAC5A1CB36B0A535367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376047, "uuid": "ce4c262e-e2c8-4834-8e42-e4c48d4007f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376047, "uuid": "b2d3e42e-50f2-4e34-8cb8-d07805af3ee8", "value": "12288:oMr+y90aXns40EW9iELpkETGXMvgp1Ee79lKSVOSnAepG:2yRXs4k9RdkEicvg1h9XpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376047, "uuid": "d2034e46-5b2f-4a0e-964a-145e355c7d57", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376047, "uuid": "e3dfdf17-ec72-4fea-bd50-e84dc062a650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376047, "uuid": "f402ce08-3edd-44a3-867b-36fa8b836791", "value": "b2978f807240d20a14815e7ccf253897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e30596-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676386489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386489, "uuid": "5968265b-411a-47ee-bc29-d61095babfdf", "comment": "Malware payload (AgentTesla)", "value": "04dded6677bbb2a2e3c0d2d77418c09b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386489, "uuid": "1ebf8221-dfa8-4c6d-8c76-013740cc7b58", "comment": "Malware payload (AgentTesla)", "value": "430b243c159c1263e0dec6b0f332193351d15e723c5d413dadca8c240107f6da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386489, "uuid": "23fca104-532b-47ee-a937-269d33ae6ef9", "comment": "Malware payload (AgentTesla)", "value": "6314a64b93b868b25780308485164679c4efabe6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386489, "uuid": "d4a7cd4c-6217-4010-aea6-532402a9e4f0", "comment": "Malware payload (AgentTesla)", "value": "b3324fb63254dd2165ef7a45365aee1339ad57b7948d1bd5d5e6c9d68c6e0d2f7c2476dd452b81d4d8937c178797b252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386489, "uuid": "872500e5-bb82-4b35-8166-40f10ff08815", "value": "T145E47C8DC5BD4212EAFD0F7DB19F29480DA0004A266D4D3B97E7F880E57722AB07E65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386489, "uuid": "951f4c61-0613-4e68-bdb4-54eaa0708fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386489, "uuid": "e5a3922e-9fb8-4cb3-a719-d25f31249e0e", "value": "12288:wmecespue387pu4L4sM3AYyVQbvO4Jsuy0yp8/7WsxPcCgjdkyj:ocespVhTh3AYykvOQQKyzja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386489, "uuid": "42c21666-1900-4e0a-94f3-7203f7ee6c49", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386489, "uuid": "d2e3cb48-4c1b-487b-bd47-e8ce25e0f932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386489, "uuid": "3db753dd-c822-48cf-9047-3ff47511dc72", "value": "Teklif Hk DGN A\u20268811600000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c18492e-ac1d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676347842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347842, "uuid": "4e54d8e6-f0f4-494e-ac69-0be1deb5a058", "comment": "Malware payload (Amadey)", "value": "7954396c6605bdf572c297320b958807", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347842, "uuid": "f0982f0e-5b5a-4e72-8856-4ba0b40b777b", "comment": "Malware payload (Amadey)", "value": "4313227f04cf00808b8cab56331560113515a9e9b1d769939f4dea9613a23366", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347842, "uuid": "e6d5274e-b24e-41c0-879e-6c6f59ceaa5b", "comment": "Malware payload (Amadey)", "value": "20408513cd70836652fb0f486cce1d6d45ed029d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347842, "uuid": "5f395807-32cc-46b7-a08d-7533ff6e9f58", "comment": "Malware payload (Amadey)", "value": "2e631c812817ca5ae3b53aa40c98837df9897a4a3040a17f80019ba5a000a55cf241196b00c3e9a698c1c2b6fcc4a843", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347842, "uuid": "020ad139-571b-4ce2-93f7-315e75f34e14", "value": "T1B2F4120BE1EC4565E8B09B710DF616C31B36BD601B3483A7378EAD1A0C73A64E63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347842, "uuid": "418b5ac6-2d24-4dc6-89f3-369196e1e20e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347842, "uuid": "04c11159-a16a-4788-b013-31f87c6649fc", "value": "12288:+Mrhy90wHy7kICaQUd5BcjX6CAxUK47x0s75F84E1ibKzErtAuvYgvou4a6rO:/ypPaQm5+jXFdjEAGg5DYgv749i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676347842, "uuid": "715df89c-0813-4f74-a222-1be44329920b", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676347842, "uuid": "0e41aa7a-a6a5-41aa-9b97-1be18778d3a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347842, "uuid": "673639ac-5793-44ea-909a-c011f716b0ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f8d001-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676399378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399378, "uuid": "0e0d7d46-0213-4b70-88d0-e54e3a68016a", "comment": "Malware payload (Formbook)", "value": "ca8ad44ffc6f370d0993673865a02309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399378, "uuid": "a8939d20-124d-4f1a-800b-1f601be17765", "comment": "Malware payload (Formbook)", "value": "43440434172d5730884fa5f0ae4f7ae73c4815e74618d18bc405d18dd325fed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399378, "uuid": "70af1077-2934-4a76-8d00-809a67dab8de", "comment": "Malware payload (Formbook)", "value": "d3574af3621428399c8eb45ab29e6485da76b8ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399378, "uuid": "0f6b0b03-9d2f-444f-b863-1a58695cebb7", "comment": "Malware payload (Formbook)", "value": "f7038fd3773501b55b06e705a600d64197695212221f3a6d5c109de46516763986b05c3f9c7a5d4a55d46e5404086d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399378, "uuid": "4e47fbed-8d36-47e9-ab9c-93a36c21c61d", "value": "T14B4412117C208053D99707332A35A23E6BEAF626517C9B4F63804B5EB7B2E52D91F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399378, "uuid": "fd1a1d9a-2d30-4de4-8c50-3dea01f923af", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399378, "uuid": "860790d5-1780-459f-819e-ce373e6e8b6d", "value": "6144:JYa6dnQ33CyEJjATHGoC9KtlVzKcfs7wW8jestWRQUQIuwBtMYsEp9zA:JYLQ3SyEC1fBKcfhjfWRQzIumtMYVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399378, "uuid": "2044c46c-30ed-422d-b379-92bf7637c3aa", "value": 278450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399378, "uuid": "761b2db6-05ac-426f-a609-e479c80bba3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399378, "uuid": "df7e0b23-6ca5-4c82-82fc-ee15e8812ba8", "value": "ca8ad44ffc6f370d0993673865a02309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc7f085-ac0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676341701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341701, "uuid": "8c073097-24de-4942-8165-3d77dcd1ca53", "comment": "Malware payload", "value": "303397ce607726948d75a31ab6a31a1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341701, "uuid": "acf2f4e9-f4d5-4329-baf9-38015e482fad", "comment": "Malware payload", "value": "434910ae705aae2b0091cc90978bfcefad00d34a6f907415a3497d2fd7f32e62", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341701, "uuid": "11ddeb5c-daea-4cce-b2eb-c6437378ed5d", "comment": "Malware payload", "value": "de5a59e930d1aac605d90c7bc38edef277d5f2db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341701, "uuid": "54f390ac-9025-457c-8934-d57b789b1e5f", "comment": "Malware payload", "value": "36bde5a06874c2df6f001aa3187696bae5ff1c07478f2a097118fc12d94cd062be87c60bc53c09265430056fa8f702fb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341701, "uuid": "d0dd03f9-125a-486e-8d61-9a595497ccba", "value": "T1843383E3F78D045B53E44789C37CC245E62EC8B995188CBAF09CE16D3BD7439A1A11EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341701, "uuid": "754576e8-24aa-437a-a986-e4a7396ec19d", "value": "768:BNq34ri7ag34ri7KX0fd3Hp8Viam8t6OLXRql0r6ihU3YGHMkLrHOJPqPHp8Uild:jEp3etGmHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341701, "uuid": "a440d4fe-f657-4d62-9911-ec48e32d2269", "value": 51821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341701, "uuid": "de8d1874-0243-4d13-8ce0-d332113df72c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341701, "uuid": "6cf6f49e-0004-4ece-bbb6-454ab16b69ea", "value": "injection-clean.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9481313d-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676398966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398966, "uuid": "b4a9d1fb-0363-4750-a72a-2e7f2062c3dd", "comment": "Malware payload (ModiLoader)", "value": "b3bd950d30d47f9b7988303fdf4250d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398966, "uuid": "52da2e6d-60cb-43c4-a22e-391d1e171bd2", "comment": "Malware payload (ModiLoader)", "value": "43984e10079d105f48900abbeff3ed69522a63fa45d703c66036a8d757dceea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398966, "uuid": "9077bca1-af1a-4b6f-9bda-81dd80d9f9f0", "comment": "Malware payload (ModiLoader)", "value": "0ec845093af3f4e64d90b01b85bf0bdf3097b09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398966, "uuid": "891f2943-c055-4b7a-9343-084cca57c4cf", "comment": "Malware payload (ModiLoader)", "value": "5fdba5b5683ea66f71bf950638a3a08973e59633ea7070e4d73afcce3e3804cb2e08d119d8bcdd7c4be61f6575fd73af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398966, "uuid": "54003c2d-a88c-4303-bf51-9e3b1bb6ff7b", "value": "T1E015B01D7DEC0433D33349394A464E6844256AF2EC18F8F73E9CE848CBE65B5A07AE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398966, "uuid": "bd935844-4dec-42d4-b035-e82fa4b0f0c7", "value": "1662538b13f763bef491d93c57c319e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398966, "uuid": "3d0ddead-a830-4da3-863e-4be358778387", "value": "12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398966, "uuid": "1dbeccdb-2154-44f1-994d-7d103ddfab50", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398966, "uuid": "47e096dc-495f-48ac-8309-cbdcd5b8bc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398966, "uuid": "25e4c9e6-1d9d-495d-8c38-973c985f103a", "value": "m\u0259hsul siyah\u0131s\u0131 n\u00fcmun\u0259si pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2eebdc-ac2e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676355066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355066, "uuid": "bc766f38-5923-4804-9965-ed7dca147833", "comment": "Malware payload (RedLineStealer)", "value": "b73f35405cecac3d5cf5fee2b26f51ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355066, "uuid": "dc5da4b2-e2c6-45c7-9d71-bbbb1e48ff32", "comment": "Malware payload (RedLineStealer)", "value": "43b94f7dad79db6c483201a96ffece71ee3a3586ed34075506d33f12abecf435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355066, "uuid": "183562df-12d4-4309-ab1b-498edad63e88", "comment": "Malware payload (RedLineStealer)", "value": "34b8a629a577c0b09bd2e853adcbf981ce8181df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676355066, "uuid": "d790cab7-5c3a-4321-ade6-538346db7f73", "comment": "Malware payload (RedLineStealer)", "value": "56b727ef0550d7093e4ce1969ce759428554e57fe2040b7522d8dba523353d91c07815d9e00d58e69cfbfdd9b32731e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355066, "uuid": "32c9580d-3130-41a7-89f0-b27faa943d88", "value": "T146F41257E7E98021E8B58B7108FA02D30E357E51AF3886DB674F6D6D1873660B63036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355066, "uuid": "623d1890-aef9-4748-80f6-81e0eba963af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355066, "uuid": "aae60022-5048-497e-9e40-631341ffaee6", "value": "12288:gMrvy90v9/iS3lLvObLwL7vH1BJg2eBwpwcpFN4H5juJmbENWiQmusRCP8h:fy4p8wnH1mOwxH4mRWCPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676355066, "uuid": "90894f76-a317-4939-a56a-c0c3f90a8553", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676355066, "uuid": "227a7a40-b3b3-4113-a40d-81063e6b0af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676355066, "uuid": "5d3b3c6d-32bb-4a9d-9fc1-7cdbb6b27d76", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373bbf5d-ac78-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676386784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386784, "uuid": "1e1a34de-0343-4419-a220-87c0c46ebb22", "comment": "Malware payload (AgentTesla)", "value": "7863097e799fed3797be49b60f40f8d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386784, "uuid": "2941bbe6-3ce3-411c-8849-a4f99c98b418", "comment": "Malware payload (AgentTesla)", "value": "43cf859a54e2d1498cfa0a7f1591215b548f6b789dae1dbe653d453646833af4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386784, "uuid": "57eb4c51-9e90-4f3b-bdb0-ff435588dfc3", "comment": "Malware payload (AgentTesla)", "value": "e96a46fd1f337cfe5722989d039cb170de527ce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386784, "uuid": "a94d7718-b05a-4142-938b-894e97413f2b", "comment": "Malware payload (AgentTesla)", "value": "4b7f82b69456bec9268d0928fd37506727ef34220fc93c2dac413f516a12c1434823bfa5d67a3886a7e0fa1b6459cbff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386784, "uuid": "6cbf08a0-b5c6-42d4-a7c0-765b1575c7d5", "value": "T11A6423117FA098ABE8B31A361B311B1A86BECA23209665BF33745F34BD672C3C447755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386784, "uuid": "43c0fe5f-f084-4d0f-ade3-46fcc4b65004", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386784, "uuid": "0003f864-0fbd-4068-8d68-70386e4b348d", "value": "6144:/Ya6I2WGmBfIH+nG+YAe9O5Wj7LrEh3ir6SGharEOrq1NNQcqvoZb1:/Ye2WGmBfIiX0O5A7xr6SaqEJNQcqvo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386784, "uuid": "a97ac341-16a8-4067-bb7b-1fb2b5bb4164", "value": 320321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386784, "uuid": "95cabacd-6e28-4716-a976-54c7260b4ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386784, "uuid": "2a64b1a2-7dbe-488b-ba07-2f70d05f9c05", "value": "Document 787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ec3adb-ac46-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676365439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365439, "uuid": "c38460d0-9ace-4b2d-9189-c2739eb50877", "comment": "Malware payload (GCleaner)", "value": "8de4447cb99506213cd4b97690feac03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365439, "uuid": "85fd6383-7b04-48a3-88ae-f3271d806126", "comment": "Malware payload (GCleaner)", "value": "4457976aed3361f936e815b67b2054959f619ec61bc31173112c990deb63be7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365439, "uuid": "db7c9e08-8df4-46a6-ac27-ba20853c7a8f", "comment": "Malware payload (GCleaner)", "value": "cc5510480bea59f79a3bdf2c4b4a5ac0e19542d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676365439, "uuid": "9edf1543-8c89-42af-90f3-7aa3976c5631", "comment": "Malware payload (GCleaner)", "value": "121412a4c9a0a5f690138f6f531d81a50a9d413871a4bc88e802bdc960fd27ae165b8948faf0ec656ade946940a72d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365439, "uuid": "30fb7d20-d1f3-415f-8652-1094f012d23f", "value": "T1DEE5127C7605C8ADC281BEB88C3A88E71CDB6EE3D8E0906271DD7F3F5179294861A157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365439, "uuid": "397ac9e3-9791-40ac-835a-b6b2ef1d8301", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365439, "uuid": "9cb047cc-2671-42d3-bab1-ec2f3216056f", "value": "98304:JH4dceiX5Bua3rRz7KMYX2MHV0l17rYv2MR:d4WeiJBua3rBK5mM+brYvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676365439, "uuid": "1d2dd7b5-cdd6-4db5-9db2-160d39ac7fbc", "value": 3191003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676365439, "uuid": "dfd982c9-f36f-4686-85e4-37e41aa4f7e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676365439, "uuid": "1b69db46-2781-473c-b2b8-5f0d5c31cfc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71be4adb-ac1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676346939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346939, "uuid": "5a2218d9-e954-42ff-8683-3fb87869bd9b", "comment": "Malware payload (Amadey)", "value": "96bb3b9a77cf538b39cc303b339438c1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346939, "uuid": "ee5b61ab-31d8-42e4-af11-25388a2a1033", "comment": "Malware payload (Amadey)", "value": "447410d16332ebed878f2fb3a4178d03eed4f4b95c96555975b2376ecce28f95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346939, "uuid": "33ef9f7e-56ec-4645-9bc9-76c32a4db21d", "comment": "Malware payload (Amadey)", "value": "c0e306497d02888a9851938834784ae336aabef7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346939, "uuid": "1d93fc47-2e09-4f20-a26f-389b46e4d151", "comment": "Malware payload (Amadey)", "value": "39855382fb728247058d5314b657ac7ead440c4ebf06b6ad5e2395083bfb98018e323fa852e7d893ca56fc7602cba9aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346939, "uuid": "1fd37764-1be6-406d-bab6-08b92a90410d", "value": "T161F41247F7FC4022E8B1AB7158F203D31E327E6166758796638BAD490873A60B67533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346939, "uuid": "8fa693e7-da43-403c-9612-cd988239d082", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346939, "uuid": "950e581e-a6bd-442a-bdd0-2987f3eeb654", "value": "12288:DMrTy90IqeIlwm/VDfWcjFsZdmimVFT4BGQ0HgzhZtAuokgc8y9a:UynNgVbxs/mlgBFUg9/8kgc87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676346939, "uuid": "d3ebe0cd-7818-481e-ac44-a7c6800ef8df", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676346939, "uuid": "72243c8f-89a7-4edf-bcc8-90dca999e252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346939, "uuid": "22386b7b-bc5e-4a7e-bae8-9d1d607e22c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79a4b92-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676386543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386543, "uuid": "d452cba6-a5df-4c68-a3ba-490771ccc87f", "comment": "Malware payload (AgentTesla)", "value": "e9dc65b433b00c41410e2acfe797a65e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386543, "uuid": "bd850e19-058c-4a44-a55b-8b10f565c962", "comment": "Malware payload (AgentTesla)", "value": "44b3e4f52022238bf5f9a641ce74ed09d857b7e8b06a0a39131b8b7700bd6bc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386543, "uuid": "d6a97429-248b-4afe-93b6-f4d6ba9323b0", "comment": "Malware payload (AgentTesla)", "value": "17a08cb40346756a22fc26c061e5ea5b95a91102", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386543, "uuid": "c3302fdf-aebc-4859-990a-df5bcdb3cf04", "comment": "Malware payload (AgentTesla)", "value": "72d808251e69e434d556bac4496c5c065a39831cdf09a447920ff3c7bc2419b7c2bdb480770f06ea74de4b6446e663d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386543, "uuid": "71a1a7b2-cea9-42c0-93fe-c0defb8b956c", "value": "T1005412A135D58863F5A10E71A97F1556AFF5F4029878DB0F2B400F8DF8AA182DA2D373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386543, "uuid": "16a4a219-b90a-4d31-ac16-ee4d30501187", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386543, "uuid": "7851e685-7381-4a37-b302-2ca17ac0b321", "value": "6144:/Ya63kO4fqhbLtACN7fzwW/T437pSO0J9VNkwLGB4OsTBAWm:/YdkO4aLmeHwmcwO0JDNkwOMBAWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386543, "uuid": "fa8aaad1-5661-46cc-8a91-d80a9310123f", "value": 304858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386543, "uuid": "18388f18-2dc3-4917-b1a0-36f2ed9cedd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386543, "uuid": "c61b49d0-dc59-4280-ac62-dfb318f00701", "value": "MV LADY FLORA 47K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0d5641-ac8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676395865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395865, "uuid": "cf19c42d-90fa-4b7d-9daa-5005f0e1ffe0", "comment": "Malware payload (RedLineStealer)", "value": "e7d2dc2978c53528474c048cc31eb764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395865, "uuid": "fa6888f5-7837-48f7-8f8f-556c83a81c30", "comment": "Malware payload (RedLineStealer)", "value": "451cab0732e0b70e01d47529a19f128b57c555334f2bcedd9b868bd0dc414d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395865, "uuid": "f6daebc6-2ae9-4504-b464-ec78a39ceb8b", "comment": "Malware payload (RedLineStealer)", "value": "36922c3bb2b6f33f03bd80189bc815ad2a960579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395865, "uuid": "ddc67b04-23f8-44b2-8a2c-8f0cdc5578d0", "comment": "Malware payload (RedLineStealer)", "value": "eea415e5f5de8a02ef77a03670fff5cf72ba281d3ea87862416fdb21075a65356d2f7b46cc9fb12f7b71c7c74ec7bc83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395865, "uuid": "c910c284-8ab4-4078-a3d3-dcf208e85d11", "value": "T18454F12231E1D032C86B89B504A0FBA0ADAFBCB17765C98F635506AF1E307E047B5797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395865, "uuid": "9c4a1853-a36e-4f11-8b2b-f43943bf84dc", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395865, "uuid": "5102da3c-6fee-4d89-bed2-441fff8ef4d8", "value": "6144:GL/ZivASrlItFeKhat3WJYsSuUZwcTH8xxf7Oe0xSSi/:GLZ4A5FrhakQZw+8xxf74i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676395865, "uuid": "de87fdb3-db3a-4133-bb3f-56ffcd8a4a15", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676395865, "uuid": "91addf43-6c08-4e53-9706-6334cfd62bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395865, "uuid": "a33fee32-5f02-4eea-8093-324cf9e7c390", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d253b459-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676408948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408948, "uuid": "ba17afd4-96ad-4cc0-a679-31ab085cf2dd", "comment": "Malware payload (Amadey)", "value": "6740dae4c640ce71374ddac5650dc206", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408948, "uuid": "a2949863-543a-48e9-815d-c8cbbda11930", "comment": "Malware payload (Amadey)", "value": "4550dda0ee7fce24f8cdef2feff3046cd0c37cc8348fd0ec809662864f09a437", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408948, "uuid": "03e08e96-26f7-4c86-b1f3-1bf01ba66509", "comment": "Malware payload (Amadey)", "value": "251b4ab1a2eb804c81c3ab5d7defc4217cc6fbfe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408948, "uuid": "aea184b5-5c7c-46a9-98a8-40f22c4373cb", "comment": "Malware payload (Amadey)", "value": "32a412c482ce6e2b57b92967c753f3201d38f005a68d50ced0a917b90cd0449b61044f70793fe25ea07deff9636cf617", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408948, "uuid": "d3e8092a-ea0f-4416-abb9-73b95b210332", "value": "T1C5F4124BF7FC8062E4B1177109F703C31E3ABDA4563586AB138BAC9A0DB2560663576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408948, "uuid": "69bcecac-e477-4ef3-9e8c-80a09e850859", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408948, "uuid": "f1f18a16-bb8e-4531-bdf0-6bf7158e5c7e", "value": "12288:1MrVy90peuVOg17YndLGaG+MGB5XAMD55vt5YEjkROK5xLI1TIFsod:EyGV3B6dUKB5XNDzvt1jkROKEpI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408948, "uuid": "608807a9-0b19-440a-a041-ca524c883019", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408948, "uuid": "6585cbe2-85ee-4bc5-a8c3-306dbfb46c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408948, "uuid": "8ac099d0-209b-4390-a8fb-3668bddb23ed", "value": "6740dae4c640ce71374ddac5650dc206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32a0555-ac80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676390508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390508, "uuid": "f577c471-3c55-4322-85e4-61e70cf2c5d0", "comment": "Malware payload (Smoke Loader)", "value": "5fffd580661b284c6059ed5e4acb2ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390508, "uuid": "84ad6466-6986-471e-acfd-a8481f90848b", "comment": "Malware payload (Smoke Loader)", "value": "455bcfc3c5a58b6092fd6cba0874c4f8146cc1488914553c9cdace1aa25bb436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390508, "uuid": "18bbf801-117b-41db-b9db-994ba2512dc6", "comment": "Malware payload (Smoke Loader)", "value": "5752821499766abb350ce5325bdf255892f3e38d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390508, "uuid": "3dce1a2b-d67f-4092-9b9c-0cfe5ffc0011", "comment": "Malware payload (Smoke Loader)", "value": "cfa2a87d6fc5b12fb605df1484628ee346ca093750abf3381892fc6b4ba7d3e65cc628312512a0bd0ba294dcd39ce499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390508, "uuid": "3d4d25ca-a073-4017-94a7-ed641879efe6", "value": "T1FC04D01179E1D033D56785B01921F6A06A2FBC71ABA5C1C7335C1BBE1E703E28E3A796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390508, "uuid": "437d98b7-b221-4fdc-b7e5-255b3c57fbd6", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390508, "uuid": "ed9818a4-4073-480d-b315-ac27b11bbdf6", "value": "3072:PmjsrLpR15oVctwLsgNUylQKJEVLgCtQAFo5xYUeNOs40FSNARXP1X:+IrLpRAoekCQ1fajrmdVc6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390508, "uuid": "d86a3903-f070-49c3-88db-cd4d0bfc815b", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390508, "uuid": "864da721-6d90-498a-9d6b-4373b707537e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390508, "uuid": "16dd1418-3ac4-4c38-8956-1c1a68cde2ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d57c00-ac0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676339988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339988, "uuid": "6c0b69f4-8717-4fd5-8f7a-970e54ac2353", "comment": "Malware payload (RedLineStealer)", "value": "16f977981f70dd9385ae3ea5526bf2da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339988, "uuid": "fb7ddcd7-897a-4ec0-96f7-dcb4a161c242", "comment": "Malware payload (RedLineStealer)", "value": "45fbd64e4e71a7194f56f7b9486ed659c8476f02e937c2c7cb61dfc0ac111eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339988, "uuid": "2e9ba848-328e-49ea-bdb9-8e95ecb95dae", "comment": "Malware payload (RedLineStealer)", "value": "f0b98d3b16676d7583406a80d08c3d9bd557ad33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339988, "uuid": "1af2ab09-dc5c-4816-bc54-d3729c0f2a5e", "comment": "Malware payload (RedLineStealer)", "value": "37b73d41c1b32c56757538b5fe3b5f72add6d982d8b21daa229df4522447de6bce939100a66009167766f229022ea37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339988, "uuid": "a34fc147-85f2-412d-9c38-31700dd48093", "value": "T10EF41217A7F88422E9B1073055F603E31A35BE601BBCA787234EAD4E1972D74E63573A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339988, "uuid": "811636c2-995d-4c28-b1f1-b649ee4f3896", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339988, "uuid": "8709ad5c-9013-487d-a7f9-1c68e1e3d4ab", "value": "12288:hMrsy90hJpmkhN9/BCm/pLbuwlsCLp/68mtXo7x6lAWN0Wgc:Ry8hH9/nzln1/3m54x8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676339988, "uuid": "01eb19ad-cbf6-4404-a481-768259b1b3a6", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676339988, "uuid": "7cd6b2a2-d36c-4a36-8df3-9cf556067dd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339988, "uuid": "7476900b-aa7d-426d-9d64-312ef8ed954b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0235b52-ac22-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676350103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350103, "uuid": "ad1356f8-b13a-4e75-907f-9bd8482ce5e1", "comment": "Malware payload (RedLineStealer)", "value": "bf33612917562e1df3ec97152aa57f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350103, "uuid": "479244e4-6001-4726-9e04-a2a924a8cbe5", "comment": "Malware payload (RedLineStealer)", "value": "462ff89bab4938e3d6fa2d814f2c3e85ec9677f3476bf6a4050a811507e82e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350103, "uuid": "93784e8c-590d-43c3-b73d-af28d647628b", "comment": "Malware payload (RedLineStealer)", "value": "5d1a96df077eff9f38ad2d0504daa7aaec20ea98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350103, "uuid": "b5237578-7990-4ac1-b297-f4ae51d789fe", "comment": "Malware payload (RedLineStealer)", "value": "98dba21d554aa6629d6de399a42f62c960c9a48abf08311558310d51b5f419d8cab5c2ffb6b6a76302ea0083fc91b5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350103, "uuid": "4a8cabf2-ec5b-42c8-a098-e1e33bdac913", "value": "T15DF4124BA7FC9079E8A153709DF642C30A36BE61197DC6DB234A9C690C77B60A630737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350103, "uuid": "1fe66c2d-a161-464e-a163-16d32790e8e9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350103, "uuid": "29533685-c992-46bc-82bf-2bf2362d3e94", "value": "12288:ZMrty904VLPwyqgckv4ypU4n+JstinFX4/KNJwO1BBPtju+4O3VnF:oytWywkv4mUlJC/KLwWz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350103, "uuid": "a4e376f2-4dbf-42a4-a28c-f65097cf30ee", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350103, "uuid": "c53c472b-53a2-4556-879a-f530039ec568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350103, "uuid": "d395adb3-81de-4bf6-8280-d006b025ec46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4f57f8-ac39-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676359972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359972, "uuid": "d69cb2bf-ded7-41ec-b3df-7f1a104cca9e", "comment": "Malware payload (RedLineStealer)", "value": "c02247ce47adcfeaab2549364644606d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359972, "uuid": "77ee824c-c907-4f0d-bd1e-735d7280961f", "comment": "Malware payload (RedLineStealer)", "value": "4658e8e03e074e0add3dee226cf831909c316b0c15909999413a841cc2f12dd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359972, "uuid": "5ec90140-d93d-4f9c-a129-bd80cbb120ff", "comment": "Malware payload (RedLineStealer)", "value": "d4607963e6f1c9353d6c57a6d46bcc0219a7afb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359972, "uuid": "823d5821-4080-49d4-8c8f-7e04c912b230", "comment": "Malware payload (RedLineStealer)", "value": "c379897207569266c880c7033451d93e09d1ac2bf5462d9ebb7c526b71b8e53c0fcc995644984d47adede069a080c337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359972, "uuid": "6ce139b0-dc36-47cd-b076-9d4c93501b15", "value": "T14354F11136E2A133D6ABC4349523F6D0662FBC71AFE2C19B33541BAF5F311D20A6935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359972, "uuid": "92dbe4e5-f8aa-4875-95b5-5ff8cf0bce2e", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359972, "uuid": "8f82f0f4-64e3-4877-a5cb-8220e4ac3fda", "value": "3072:VotHLISc5fe9/+bsr7jFesxvqAdfTxaIuoBwMiju+SsD8CvZ1gf0Izv0xwOtfRfo:OdLISqMq6xxDVhwRjxQCx1gfLMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359972, "uuid": "3b22c58c-2d88-47a7-9d72-2c8ddfef8958", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359972, "uuid": "fbd6e6f7-a67f-4325-b764-15cd8a34ab63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359972, "uuid": "b95ace34-7202-4eeb-8c2b-90ff090daa8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75cf56d-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399561, "uuid": "8115b932-9ab3-4e43-ab11-08b4ec8100b0", "comment": "Malware payload (RedLineStealer)", "value": "12cc26cd4e7c9dbd98f5db47372b3791", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399561, "uuid": "d705bfc8-d59b-4dfb-b612-76e792591312", "comment": "Malware payload (RedLineStealer)", "value": "466b494ef96d7f7ad6b2bb1c3b29dec61e9114a966d121a213cc8499de9f0374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399561, "uuid": "90934122-d202-411c-9671-abe4b60b44cf", "comment": "Malware payload (RedLineStealer)", "value": "6eaaf20824723e24a10442a7ea648c46191ddf1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399561, "uuid": "f96dc37b-9afe-4798-9588-6a2a3d65145b", "comment": "Malware payload (RedLineStealer)", "value": "5a6ab7146c4a776f1eb860246ae574783eab621c5e09c749ac6b301e8e60a0d35dfa7b8c661b90263a425fd8c759b46f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399561, "uuid": "4894eb43-02b3-4a83-b507-ea5cec6908a8", "value": "T184F4124BEBF89022E47557B45CFA03C31A767D506E38C39B235E6CA91C725B8A132367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399561, "uuid": "d741ec5d-dcba-495b-b9ef-1ff0bf742a03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399561, "uuid": "483c1b60-97c4-4bfd-810a-ca16788b51f1", "value": "12288:LMrry90hKmCG5Rklm3Ess7uJJnqnysKvDcaMD50kg5mrpqo6iDnEIiCjBDcxM5xt:MyGeAOdseGqnys/DWkgor7FiCltH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399561, "uuid": "da2fabf5-1700-482d-8739-427c4946b0c7", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399561, "uuid": "d7a0dfd6-027c-45e1-9a33-be52262c3df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399561, "uuid": "85269b39-cd08-4433-a03e-afc61fa32f3b", "value": "12cc26cd4e7c9dbd98f5db47372b3791.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68499524-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676363244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363244, "uuid": "22a48ad6-24a4-4165-9bd5-eb0caaf6c19e", "comment": "Malware payload (RemcosRAT)", "value": "2c14dbbf5602f2d0677fd14688510f98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363244, "uuid": "9c38e78f-14b6-4520-bfe7-6ef1301c4588", "comment": "Malware payload (RemcosRAT)", "value": "46cf54527bf4f361ec7b9d9d8f3867297057eb1048fcc27c7532393748d0d45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363244, "uuid": "1a336d9b-73b9-4c61-85c9-3d5c9d71e6f2", "comment": "Malware payload (RemcosRAT)", "value": "9a1662a83bc581c86a7578c19d6b060eb1ae0de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363244, "uuid": "12eaa394-b5b5-4b1d-ba68-150f50859c2d", "comment": "Malware payload (RemcosRAT)", "value": "156325e0b94f401e899ec34a428a9d969a4cf2471b14c8012d54d5434fa979d0c4bee1ab16986ab72b3e66e2a4556641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363244, "uuid": "6dc2bad5-6fbc-48be-8771-9b70bdd5c91e", "value": "T1B2E47C90B1455883F82776F1AC1FDA20210D6FDE522DC71E3353BB2A9AD7356216BE0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363244, "uuid": "ee906d8e-bf6a-4172-bd28-d163f4ee17d4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363244, "uuid": "9a3f1e38-99d5-49b3-ab06-ee81af5c16ac", "value": "12288:oYcDqxb52aKtOxSOj+IOvFMGdGe4vURvAvb37Wggj3F0gpasyKL2My:oYKm5BsRdNMgL4Pj3ou9Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363244, "uuid": "256b6604-137f-4661-89ba-d362e653e4bd", "value": 676083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363244, "uuid": "089dbc18-dee6-4d0a-8105-faacfe96789e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363244, "uuid": "3b0dd985-62a1-49bf-b884-fc06ff531702", "value": "purchase order PO# - 574FT784.pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4d6257-ac97-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676400403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400403, "uuid": "e617aa92-635a-4776-b32a-880e41960c32", "comment": "Malware payload (GCleaner)", "value": "7534e8b6f55114c9176d7b4def3e38ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400403, "uuid": "9a96dc1a-7abf-4d8c-a7a5-b347b4293d10", "comment": "Malware payload (GCleaner)", "value": "46d6bbb42d39f630424768ac4ce0da42c670887251f6f672b7df142fbebbf4ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400403, "uuid": "e652ae85-f898-407a-8f88-44122cd73e29", "comment": "Malware payload (GCleaner)", "value": "6e1cd91fe4b3baaf063560e5ecff7664e45b98cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400403, "uuid": "33a23cea-6cc1-4351-afe4-a5abf9467646", "comment": "Malware payload (GCleaner)", "value": "9f3978d2acd17930b7d65e80680d3f2225839b1178535f8252ac6755c127cf3b14117b0a3fd0827908db30e39b39f0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400403, "uuid": "46860618-6988-4be2-9155-bea86611bc77", "value": "T1A1E5123D7605C9ACC280BEB48C2698E75CDB5DE3E9E4A52630DC7F3F51792898B1A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400403, "uuid": "ad57a0b6-137f-4260-8aea-b067855395b0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400403, "uuid": "d2fc1744-cb9b-4085-b6cf-40c7140978be", "value": "49152:rdHoJxs/nIQlOJtJEF00CvYvFJRlCBQCW7lmbRTySQ5jbRepGmLCgv2MR:JHojJYF0ARHIt+LWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400403, "uuid": "ccb3a7e6-1d4b-4e43-8884-16abdf89799b", "value": 3178348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400403, "uuid": "07cdfb7a-b41c-46de-88dc-3148d753b142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400403, "uuid": "9e963ace-8239-4284-8c98-e65c194aada3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d74ecb-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413383, "uuid": "f28f0bc9-c439-4f35-8de3-117b7daf52c1", "comment": "Malware payload", "value": "4f28e4893a5484751b0af933e62b8fe8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413383, "uuid": "b4b65af0-7467-48d9-988f-962b1cf00aa4", "comment": "Malware payload", "value": "470e135c38d75718966aef104232a0ecde7b9845be73afe0abed307159b32fb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413383, "uuid": "da62be38-148e-4af8-8221-8fedd5415833", "comment": "Malware payload", "value": "79a44c89cfa72af837314169cb36755bc5218241", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413383, "uuid": "a6fd8341-190f-4ea3-a3db-87139a8d2583", "comment": "Malware payload", "value": "220ff212163a7b36f091b74ad8e90d10ba89a23abbba9cfa2673f2029edcb4970ac5eeec5320a2c6a78ca04ac803d4dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413383, "uuid": "f96d14de-873d-47eb-b90d-204846463560", "value": "T185C3405B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413383, "uuid": "7133ba3d-4991-43ed-b49b-07695b3cc622", "value": "3072:QISPhPh28cVCSsdCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVlMPgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413383, "uuid": "adea8c13-cea4-4b2b-928a-6c63a7fb6cf8", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413383, "uuid": "6fbbd9ac-d23a-4432-82d9-ba5cec6814b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413383, "uuid": "10383f5a-e104-4df2-9e47-d99b207e17f5", "value": "4f28e4893a5484751b0af933e62b8fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b5adba-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413356, "uuid": "f01e71a4-2829-48ae-8255-c59eaab78cc5", "comment": "Malware payload", "value": "9a0739e0bbe0ec68224fc01e82a180d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413356, "uuid": "ee3d86d2-efe1-46ec-acf1-d55ca8b3f56d", "comment": "Malware payload", "value": "473f377e11def85c21edbed48e1e4a8e0c99899fdc6e6f783a9b46da08c37f1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413356, "uuid": "606c7b99-9f93-473f-842f-23faaff1b0df", "comment": "Malware payload", "value": "feeb0891e6bc12b2763f8b9b05c3514c4c14ce1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413356, "uuid": "39e126cf-e0ac-4f60-8c6b-6a3ff952507d", "comment": "Malware payload", "value": "ab2314d771d4d3cae74ff0dd4266860108a3ae139b22577b999de0b59cbcde10423150784753ae99660a452944fc4182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413356, "uuid": "43ac0680-49e5-4313-9ded-f69191c51cfc", "value": "T1B9337C65F8642CF8D8120174E4788AB9D3939EB641C90CB62CDDE65008FBF5DB68DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413356, "uuid": "2731a6ed-e556-4935-874f-dd223ba4d942", "value": "768:YHm764mELERgEpMEFH9YBjsxc4ea8MK9f7UnGOA92ntVsRaDRmhqmqQkSjkFHgfE:12kQnzFH96kFH4sT9rPDEwhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413356, "uuid": "48029809-9531-4e09-a63c-115dd49f7754", "value": 54144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413356, "uuid": "54f99dc8-d1a4-42d4-ad74-cc339143e780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413356, "uuid": "6d106d94-6fc2-4521-85d6-c84a9cd1555e", "value": "9a0739e0bbe0ec68224fc01e82a180d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bff4963-ac63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676377853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377853, "uuid": "90ac1176-8868-4caa-91ff-a1ae37a1272b", "comment": "Malware payload (Quakbot)", "value": "ac377cea30d0b6227c70ae0ef6871f71", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377853, "uuid": "263914ae-aef2-4d75-b394-06a8a48a3099", "comment": "Malware payload (Quakbot)", "value": "476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377853, "uuid": "e17e744f-5cbe-4011-a98b-7ede368a136c", "comment": "Malware payload (Quakbot)", "value": "1223a42bea918585ed4ea77e6c8ad9b3f151e2a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377853, "uuid": "b08521f5-f4b2-413c-9301-2a5ce4326d98", "comment": "Malware payload (Quakbot)", "value": "d996f713c94bba7afa74274347a24bfde7155ea7ff223f50af2b2b5f075330e62a90e801c9c493347a048c6a436c37e0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377853, "uuid": "7aaeb02b-8a7c-430d-9657-9c4683f708b9", "value": "T14AF43A2AFA0191F9ED1200F2950FFBFB54342B394C65CCDBE2441EADBBB5D60511AB1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377853, "uuid": "76afc5a3-2566-40aa-90cf-861ad9f8f29b", "value": "e62ccf1e5c561da53ca2f798bfd5b608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377853, "uuid": "b4cc0415-ba01-4aa1-af36-151426f38048", "value": "24576:/H81smt4vyVjXe1ikZdtjMsc7MscXMscktkTNd8uB:kefBtkf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377853, "uuid": "2d80da02-3b7b-49b6-aa56-c3ac84c4c603", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377853, "uuid": "ac5c8bf5-45ca-4bee-aad4-02de380ddec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377853, "uuid": "f7737700-f366-4d6c-ae2d-f4c9c50faee6", "value": "187737.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae91dd-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676399366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399366, "uuid": "66329deb-00bb-4514-bdcf-bd1d43bda9dc", "comment": "Malware payload (Loki)", "value": "f463312834654a1110a0163e85e3abc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399366, "uuid": "90b43468-f72a-4893-add3-073bcd84ce10", "comment": "Malware payload (Loki)", "value": "4771d59089777e85be6cc8419d3f8479a0b13ffb80e11625166e9b97dfa5e826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399366, "uuid": "a2481347-5df7-4918-831a-fa04c5df52df", "comment": "Malware payload (Loki)", "value": "2e94f85303a800ba6c64f5e43fd5071cbfc4d3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399366, "uuid": "75bd23af-63a3-4338-a208-96967cb13416", "comment": "Malware payload (Loki)", "value": "64971da13c4beb1f7e04a634ba0194ddf3f7a5e1ed494c869d0c6c67634030c42e0aa70e9d8bd1d54e2f7dbc5b756624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399366, "uuid": "0f40491c-24c8-487a-8243-682762ffe6bc", "value": "T10DE402069D588A22F5F4DEBC073CA6788F706C9D4BE3E1792DD446EA6123723C40A277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399366, "uuid": "3943d416-6083-4a63-88c6-042177cb84df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399366, "uuid": "84d15d93-1fab-4fe9-be92-d0e41402fc18", "value": "12288:GC5wtP71Vd8AYC0ND2U+7PETOl7Qfjr3V+1pzmYE61EPZqhU1Kh6q6:GxP7jVQEOEQfX3VuE61EBiU1KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399366, "uuid": "76fdda33-a8ac-4669-93f1-008fe4f104d8", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399366, "uuid": "020b7675-66fb-4987-9edf-a9813682f75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399366, "uuid": "b2e6336d-f8ba-4f7d-87be-c0ef004c7ef6", "value": "f463312834654a1110a0163e85e3abc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909a6473-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676407549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407549, "uuid": "c5dff15f-4d53-4ff3-9831-16df3c760d51", "comment": "Malware payload (Gafgyt)", "value": "0d1b2be1b00469724a34add4cda64042", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407549, "uuid": "ae20b2d1-ac36-4a57-93a5-df2c8a037bfb", "comment": "Malware payload (Gafgyt)", "value": "48009e4d18196d86b29f17113275741d06800c5d91bf9c92b30d456a755018f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407549, "uuid": "6d984a5c-07a1-41b6-8c4b-6e6ee2b314df", "comment": "Malware payload (Gafgyt)", "value": "a2c4033527eb3e4a15b84fd530af829b76e1b817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407549, "uuid": "a73bf9c1-2040-40c9-a551-fda332f7202c", "comment": "Malware payload (Gafgyt)", "value": "db0ebd5f0518ffdf174b3d7d99b4c7479c1f6c753cd8328f252b88618c5cb79e1715da573fdeb0639e4f458c8078604d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407549, "uuid": "e15b67b0-9387-44ab-89ea-405182257dac", "value": "T157141331AD17D223C0A7EFB8AAE5BE96D629F2D30F45D603A2A0106D4DF4959641FCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407549, "uuid": "4e69844b-28fb-4fd1-b750-3de91985c2dc", "value": "3072:BIwRP+0F6+z5Z1vcCPYZDm/80upImaDY1:Rvk+dXYZDm/80upImaDY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407549, "uuid": "44bea4e3-fa3f-48a1-b7ed-a6cf24ef08df", "value": 201089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407549, "uuid": "2ac46c15-8751-4275-ae7a-728a801989f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407549, "uuid": "0e680cfe-b6fc-44d4-bc0f-034c9e8fb68c", "value": "0d1b2be1b00469724a34add4cda64042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19795fee-ac6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381580, "uuid": "3ff92e5e-cb9b-4ca3-a975-f4f60830e7e9", "comment": "Malware payload (RedLineStealer)", "value": "aab9b433717f917a2c3b4c21dec1e0e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381580, "uuid": "9652e162-1e6a-4fe1-ae69-d29a8bf95eb8", "comment": "Malware payload (RedLineStealer)", "value": "484122398526956e7f4f1bcab7d30bdbd51857b7d154f7cfa436da6e12596a00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381580, "uuid": "5b45dd53-d508-4246-a5e6-e1b24b584fd0", "comment": "Malware payload (RedLineStealer)", "value": "9f386d70b3f8a36e63645f99ec8ccba24d083a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381580, "uuid": "e50104d7-92e8-4ffc-9514-cb81aa7afd53", "comment": "Malware payload (RedLineStealer)", "value": "952de2f1bdb426dd9ea7806398145a5d4e2f471a68721f4976d4a08cff6dd07d6f094f51c8ecfa0d5c14a658578134d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381580, "uuid": "1e3f029a-bd61-4a42-ae32-0038ca877dda", "value": "T15C54F101B5D1D025D19B8DB15921D6A0EA3F7C72A7E0849B33481B7E2E303F2BE6A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381580, "uuid": "dd6e520b-7956-4b5c-8b00-e99df73c6ab1", "value": "033c129a4522b4dc7e5484557290091f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381580, "uuid": "4a799650-a948-4d19-833e-2d164ca3cbc2", "value": "3072:idxLCai5oFr3R2ZxrI+JUx9NHovTYaMkaDayoOiBAwsezsS01irM/p92c1nA1NsQ:ALCaPXaxc+SjHovXamyoOMNz02w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381580, "uuid": "55dddaeb-7964-4988-b605-b1f235f653d8", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381580, "uuid": "79c6e8fa-44f2-4cb8-adbe-453905377d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381580, "uuid": "2e142a87-007b-4078-9d34-eee27a473a7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1bedab-acb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676411595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411595, "uuid": "38fa2abc-115c-429a-ae97-26cca5b0c237", "comment": "Malware payload (Amadey)", "value": "4a71726d66c398e82f1d3103c4c7feb0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411595, "uuid": "d47b3183-5617-4373-b00e-ea22f2291293", "comment": "Malware payload (Amadey)", "value": "4877734fd58cf75e5243fc62cc99d963c1fbae62eb1cbd1d241f868d69344f9c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411595, "uuid": "857c5a27-0c88-4b06-8f7e-23019c568f0a", "comment": "Malware payload (Amadey)", "value": "4a4d272b16ebbd29e0c0f513f33ab762bbc9448e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411595, "uuid": "50c69d86-f79e-47e1-b086-c63937577edd", "comment": "Malware payload (Amadey)", "value": "4054c877731b7b3a21893b4ae3e9bc31f033ad147de95650c3f907b844006d95925085d813205453009f5ac55651c82c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411595, "uuid": "8c31bd7d-903a-4504-93cb-3bc655244b53", "value": "T198F41207F6F8C022E9A467741AFA13C30632BDA45A38838B578F9C8D1C627647576B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411595, "uuid": "6b8d1863-fe49-4203-9d69-08cb0e2c2da2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411595, "uuid": "64017d7d-5dbf-4d39-824e-0c084d865e39", "value": "12288:xMrfy90aMtVbCStQNQH6yB4PufKMD5IW450QKBuBa8lrOaYsRvkXp/AmPt:iy58V2MQ6F4PEfDuW4S2B5FUpIm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411595, "uuid": "7b9224c2-c3a3-4e24-bc19-65df690eaec4", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411595, "uuid": "df1aa00e-7837-4064-8034-ecaca9bece5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411595, "uuid": "4769c975-2ef0-4931-89e6-534bbbd3ee76", "value": "4a71726d66c398e82f1d3103c4c7feb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2d2d7f-ac26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676351519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351519, "uuid": "8bfd3d21-d68f-4749-8292-f930034b26a6", "comment": "Malware payload (Smoke Loader)", "value": "a83c3331bdbae89d5271a4601b3c4cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351519, "uuid": "430e2ce2-ce3e-48ae-98b7-df03e925312a", "comment": "Malware payload (Smoke Loader)", "value": "488747c95f1b20ada2e4b0760bbe1612fb8d919ed94d1f6afc50edab170e23d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351519, "uuid": "4f0ee1c7-062f-42fc-a56d-9a93e3c88dfd", "comment": "Malware payload (Smoke Loader)", "value": "3013f7d859adb81d86a4daa883b73fed5640edb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351519, "uuid": "77a9b8fb-6544-4073-bb99-556730c78965", "comment": "Malware payload (Smoke Loader)", "value": "a7bd6cdb82c85f4793ae892a91df494ac5fd7c268ed6809cbc3593a92d99added86089dc0ce6ba0aadc13013ae06308f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351519, "uuid": "8cbe027a-1766-4f76-9deb-df2e0fd3d0a0", "value": "T1D614BF12B391D872F4275631892AC1F06A7FF8614B75AADF2394673F1DB02D09E3A391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351519, "uuid": "013c0a79-9f95-4dc5-ac4d-672f1b66dbe7", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351519, "uuid": "69ec27e1-1331-43c8-ad0b-9f5a7f92cbf3", "value": "3072:lJ/uma5z7mSD/JLQeaFrgxikGH7DJDIKyqFJ4FhdojcviBEZlwz/VUQ:lE57ZFseaFMMkoJDIA4DUBBEr4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676351519, "uuid": "b9c477d3-c57f-482e-a5aa-7f5354ae359a", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676351519, "uuid": "b20e2f2e-362a-4b99-a1cd-492f28f9fa53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351519, "uuid": "9c295831-647b-4d1a-91c1-2c4bb26ab3a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bc4aa2-ac3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676361974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361974, "uuid": "27ab8d6e-9f35-4005-b483-6ea7f6521914", "comment": "Malware payload (Smoke Loader)", "value": "a206527d5c4eb3f5bfc02217647f92a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361974, "uuid": "13b0b755-1e37-4bed-9e8e-695a6129dd7d", "comment": "Malware payload (Smoke Loader)", "value": "48bf4119d2241e2cbe09a3589a3b9f04f4431e14bce0863fb0e0a6733685b461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361974, "uuid": "d93b8288-9417-4cff-8a9f-b2111ebf8fbd", "comment": "Malware payload (Smoke Loader)", "value": "009de4710e3b62339c2115c1625d7e4a00d316a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361974, "uuid": "1f2e67af-5d3d-436d-a7c1-3069d7c5ef6e", "comment": "Malware payload (Smoke Loader)", "value": "76e1582b47866847bff73414999e8d17e3eef2bc393808fc6e05e112e50992a45c7921f6d1d1e63a26a5763f604b56ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361974, "uuid": "163fb275-66c5-4dd2-8048-4b69e1e9ef4a", "value": "T1A804D11176E2C0B3E4679DB05830DBA0562FBC3266A5D08B3374DA7F6D303E19A79366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361974, "uuid": "120bfbe4-c7c0-4bdf-ad96-e58f1ca2c077", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361974, "uuid": "48c4bf4b-f7e1-40a2-84a9-0f00ddf18555", "value": "3072:jojcLE+j5fXozWTdq3YMMygV6igcoH9P9307ty0d5HpMZik9YIZ:EYLE+Frdq3Hzig3Ky0d5HSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361974, "uuid": "b1d672d6-1e1a-4c14-a92f-7162f3349ce7", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361974, "uuid": "2ce09bf2-db43-4389-92da-c40955f06a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361974, "uuid": "dc60e77c-557a-4f4c-862c-ac084a79bf01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5008385-ac4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676367667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367667, "uuid": "549dbff1-e1b6-4df2-8a50-9c48925d3075", "comment": "Malware payload (RedLineStealer)", "value": "c0eed3d042d6b790796798f312717c0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367667, "uuid": "566b4783-b561-4b4a-a2bf-d7f0d7154f41", "comment": "Malware payload (RedLineStealer)", "value": "49352ffa3e6ee49fcd17f56173dd8c4089f6fa1b0a930a1e6c68355a93489281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367667, "uuid": "ead192a3-81c6-44b1-9f20-cc827a53d8e9", "comment": "Malware payload (RedLineStealer)", "value": "a5d789ce1be1b5bdddf613232f15c95dd97c7dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367667, "uuid": "1968833d-181c-4bd1-b1d6-22e016c505ee", "comment": "Malware payload (RedLineStealer)", "value": "e13ee447cd1925c01e86facecdc19fb053b20b4de6652296675507da9ea05215ee008e9e24c6d43c2fc5696e34680aea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367667, "uuid": "7add5df6-8b86-4b2d-aef7-49c226c5d677", "value": "T1D8F41207B6EC8423E4B863B059F603D31A397D906738879B724B6C5A58B3274A97533F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367667, "uuid": "c62c5c2c-f29c-42d8-8525-1b53a6f5c6d4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367667, "uuid": "cef3e60c-2b11-4271-85a0-3b6dad84457d", "value": "12288:ZMrZy909229fmqthu5MzEOT0W0H8vpcYmBRvDnAJNfEVh7KHzDsYKKx6I:cy0DfmqDu5M30W0OfeRvDn8NfEb7cDU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676367667, "uuid": "63f770be-1bb5-4033-8644-f6f1bc8b16c9", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676367667, "uuid": "f98b4751-dc93-43b1-9b6a-0d2634744649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367667, "uuid": "58430470-3892-458d-8687-e720394388c5", "value": "c0eed3d042d6b790796798f312717c0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "029cafdc-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399580, "uuid": "38abf127-86e5-4398-bd3d-5868525ff53d", "comment": "Malware payload (RedLineStealer)", "value": "78eee89eb1db78a2f3a55dca24fe6acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399580, "uuid": "a564f088-472d-4317-a2a8-e6d11e45b1c5", "comment": "Malware payload (RedLineStealer)", "value": "49872596131631dd7b9c6da08338dcc5391c981d39ef5fe4233e5b286bad1e5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399580, "uuid": "997b5362-7f58-4ee7-93bd-31c917c0ed99", "comment": "Malware payload (RedLineStealer)", "value": "b50ac8fdb6e4ba6a591669b86f848ae1ee387699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399580, "uuid": "983f7f28-d296-47cb-8e66-fbe2f0d7dd0d", "comment": "Malware payload (RedLineStealer)", "value": "392ee263ee9b86690172a6ef5f0320ebe65f0a5b2821122c0481959897f83bd1d21fb0726ead6020779d79c42944a13b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399580, "uuid": "4ae98e7f-603f-48b4-8255-19b7a3f43145", "value": "T162A40207FBF98462D4B46BB019F703C309367D615B38829B374A6C590AB27B46A3573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399580, "uuid": "5b169785-b345-43b1-aada-a03cb0f583a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399580, "uuid": "1f59ed65-6df6-4a9f-8d56-5add2587802c", "value": "12288:lMr6y90Hwn+CIbuRmZH+y2qcfLwYSe2xdA:vyEAIbuZHquLwSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399580, "uuid": "692889c4-cc73-4162-8876-8296b3baa541", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399580, "uuid": "efa8edd2-d1d7-43dd-8266-6986f40b6985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399580, "uuid": "2870298a-05ec-47b3-9c93-62de75426cd5", "value": "78eee89eb1db78a2f3a55dca24fe6acc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e5c14ec-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381346, "uuid": "200c6863-3572-4a0c-b3ea-5311e09130b5", "comment": "Malware payload (RedLineStealer)", "value": "9377a9ac381537c983903c6922677599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381346, "uuid": "a736a4cf-7d97-42ff-8c52-51acc6c0b9c8", "comment": "Malware payload (RedLineStealer)", "value": "499584feff8a289d454fa6ed73126fe7fb814f43ab169c503546827792db517b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381346, "uuid": "2f04cb03-0e15-4d7d-9761-10a402c34a88", "comment": "Malware payload (RedLineStealer)", "value": "0719ba8df725b4d386bf7a4456e1faa9f482eac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381346, "uuid": "dbd01b76-96d5-469d-8e75-297ca777085e", "comment": "Malware payload (RedLineStealer)", "value": "9225655174dfdb512a1bf77f227e42b2a0917bec5cc0fa57fd4a104dedeee20e8bdaf57dbfc1f956487c9e0865eebbd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381346, "uuid": "71eae94c-62d4-449a-b97a-edce9be2583c", "value": "T164B4010BF7E98132E5B15B7048FB13C30936BD609A38465B164BAC5A1CB27B4F63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381346, "uuid": "e13550b7-498a-4234-84b2-3005e5701bb0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381346, "uuid": "d9847b4f-71a3-489f-915c-7bafd6a7e496", "value": "12288:PMr5y90ew8Fpl+AsvXj8ROHb9NRTOocX5:Sy60pl+AkQRs9cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381346, "uuid": "e005aaf6-2cdf-4bc9-a78f-b2ce3d96b77c", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381346, "uuid": "26723720-2bce-449d-b7d1-432d98880347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381346, "uuid": "3c6fd881-374b-4757-9b21-71c4abfecb0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b382e2f3-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676407608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407608, "uuid": "7b3b4ac9-73ed-47fb-bcf7-9707a6465a3f", "comment": "Malware payload (Gafgyt)", "value": "d2d8c2f040ba06dc0ca80d1082f00f93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407608, "uuid": "53481cd7-d846-4346-8101-cce4c45651c2", "comment": "Malware payload (Gafgyt)", "value": "4aa01ce2e7a7aeaea77bc345b23dafed386bc3ceaa1d126db96f8ba2cd7936f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407608, "uuid": "2810d5ea-23b1-432e-8a42-830b4dc2f214", "comment": "Malware payload (Gafgyt)", "value": "c292ba102f07cb4168ddbac062a148c856f68f9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407608, "uuid": "05fd42eb-3088-463a-b80f-56ca9a10a3cf", "comment": "Malware payload (Gafgyt)", "value": "1aa3800010554195255691dda4ad6ced46c67aa71faa5026fbe3cea4b0ef921200279c6f6f544e3cccbf9dc2a91ed2f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407608, "uuid": "769f2918-3b03-4817-bfc8-f37de4b8a982", "value": "T1AB548734AD16D213C0E3FFB8EFE9B686A715E2C34B8692036570117D1EF5A59681FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407608, "uuid": "b6f04e8f-f357-49f8-bc8a-945cd09e409f", "value": "6144:3cSfV8kAaxwxYaB+ry/BmM/9ra+mOwfsd6da:sSfV8kAa0Ya4rmH/8+mO0sd6da", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407608, "uuid": "6b1a6f39-6908-49b9-9c44-9afcf123c34c", "value": 281728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407608, "uuid": "ce617867-6639-414d-8166-5a63c49a51c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407608, "uuid": "56ca69e7-8d8a-4a56-b011-b7f04b63ab74", "value": "d2d8c2f040ba06dc0ca80d1082f00f93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dbd54a-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676363243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363243, "uuid": "a51eb7fc-4d24-48c7-bdf6-7c6f85c4e6a9", "comment": "Malware payload (Smoke Loader)", "value": "e8b67791214be4d76d9e6259a37e0c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363243, "uuid": "6f9d40b6-05e6-457f-a13b-456ed3052f98", "comment": "Malware payload (Smoke Loader)", "value": "4c3b5b00b2b234d9c9fcf08b88a149388761e2b4dadcbf476b6b4b2f29afd6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363243, "uuid": "1a3dd039-38a2-48b9-b736-5b8bf09bcc7f", "comment": "Malware payload (Smoke Loader)", "value": "695df2f7deb7d3d665c11f959e15c507942e90b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363243, "uuid": "cbb9cbb5-eb58-47f2-b589-842b66cb624e", "comment": "Malware payload (Smoke Loader)", "value": "1734a8d97e126c205894d25938a72bbf76122e2246a19038bfbc3a63de2aa420ada084ddb3d4d4697e7d295ec8477067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363243, "uuid": "5ee58adc-ee1f-4309-882f-f52ab1f0408c", "value": "T16D04CF12FCF18033E46781745423D6A16A3FBC726FA4809F23882B6F6E316D29965777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363243, "uuid": "0185c120-c0c2-4f0f-a256-12331a9404e1", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363243, "uuid": "bf8a42dc-012d-432d-bd95-b9ee0fbd585e", "value": "3072:9oHVcLxc525feBwjAl2caVD6GK8/O68aXD3EY0QB:m1cLxc5ceue6628agY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363243, "uuid": "b80ca495-1f37-4087-bdac-efe58d791884", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363243, "uuid": "221ff443-4b5b-453f-a875-d10bf0b4fe60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363243, "uuid": "38526216-1e22-4710-8be4-3ded5b8a675c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94901315-acbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676417005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417005, "uuid": "d1b30c80-2bbb-47ce-8842-fc706c58863c", "comment": "Malware payload (Amadey)", "value": "9fb9f09e88a093236cc7bb4fa480d727", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417005, "uuid": "75374cd8-d61e-4545-842a-271c8da4941a", "comment": "Malware payload (Amadey)", "value": "4c5ef83b6359a9425ee3cb1da16209924489e0b315bad1a3ef4ac243e85a8fbe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417005, "uuid": "7403736a-b2ea-4cdf-bebd-f0a94e4a2e4c", "comment": "Malware payload (Amadey)", "value": "0e983bf489015d0dd9d6588999bac3ab0c9baaac", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417005, "uuid": "6c44a96f-e9da-4cc9-9aa3-f69b14694773", "comment": "Malware payload (Amadey)", "value": "5d033f5d4795b2a87db79bb053fd93f5bef71a0f89bae5188ee39158586fb7ee304054952eb3faf2229b395244da8caa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417005, "uuid": "52fe956e-3f45-4c01-ab6f-17feb7f42757", "value": "T172152307EBF84432EC7203B009F7478317367D906A79979A260EAD6E18F35A5B13536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417005, "uuid": "4b8c464a-aca1-4b2b-aae8-e1e4fe093105", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417005, "uuid": "1abdeab6-c707-4131-86ad-62a85b0f84dc", "value": "24576:OywhIAdfGX6Vunx9N3KrWarEaSKz1xCQ:dwZfy6K6/E5o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417005, "uuid": "f912d7c1-5456-495d-a91e-38e2585a7ae4", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417005, "uuid": "e4f0b296-7a5e-4094-851d-83ca984d075e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417005, "uuid": "20216f0d-64cb-46d0-af1b-fdc5ff845d11", "value": "9fb9f09e88a093236cc7bb4fa480d727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd87f31d-acb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676414926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414926, "uuid": "1927ff2d-8aeb-40f3-a70b-43e06eaab73d", "comment": "Malware payload (RedLineStealer)", "value": "88797d554dd2847988bde9d46fabe5e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414926, "uuid": "1c708493-29a7-4bb2-9912-063a9ca8ea05", "comment": "Malware payload (RedLineStealer)", "value": "4cccb853d1425b58a2ed53336e9cb00742581d172701feb527eb4fc716112238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414926, "uuid": "ec535082-9a65-4c85-acf1-539f1a2b8e7d", "comment": "Malware payload (RedLineStealer)", "value": "b098fbd1bbf8f00aaedce19a20c8ef7662c9704e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414926, "uuid": "f9434ad7-4cb3-42da-8f9c-692513435b19", "comment": "Malware payload (RedLineStealer)", "value": "6ce1b718c3d8b96b3777bb29d2df46ade576111023639202836635d098da7164d21a7f105c89fb4d907d74e9089e17d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414926, "uuid": "bae258cc-65fe-4478-a929-643069b0b8c1", "value": "T166C40107EAFCC172E8B517301DF603D30A3A7E615E78835A278F6D6E08716A1663572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414926, "uuid": "6a7f06b8-5afc-48c2-9e1e-bd3a8e90fe4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414926, "uuid": "8ac4e555-fc76-4c8a-b8ae-ee408823f30a", "value": "12288:NMrmy90Gl88LwkyFJ806tefRvTthqh2E/d7opM:rytLPS803DER/FoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414926, "uuid": "04c7f886-b13e-4856-94ac-d3f85ce99132", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414926, "uuid": "d18cd687-e453-4ba8-b0c0-a0d509380815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414926, "uuid": "e3e52a68-cacc-445c-a69b-5ad73ad8fb27", "value": "88797d554dd2847988bde9d46fabe5e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cb0407-ac72-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676384464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384464, "uuid": "a28228b8-4a68-4403-8950-6e8ac66dfd15", "comment": "Malware payload (AgentTesla)", "value": "12c65b6d43379a25390eaf1412961200", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384464, "uuid": "9e024bbe-0231-4d2e-b883-9fea0192b7da", "comment": "Malware payload (AgentTesla)", "value": "4d03c943357d8d9eee2af30bf38efd3f5a6f6be442b84c866932815cb336ebe9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384464, "uuid": "39d57cce-4ceb-4131-bbec-98b137571a23", "comment": "Malware payload (AgentTesla)", "value": "ae3186954976fdae0a786eb3538e195d1091c26f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384464, "uuid": "e2235e6d-2c1a-4d43-989c-84032a9c4e8c", "comment": "Malware payload (AgentTesla)", "value": "edfd57bd4d82fef5aa8ae9f3b5d5c644a1022f99b59ca13b4f2b3d540a0e4d5623ffa5584803b39cb23ab97ea3f6fa1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384464, "uuid": "69cd652c-7084-4b27-b5a2-d3512a718e24", "value": "T1B0E46D8DC9BC4611DAFE0F79B19F2A080DA0844A266D4C3797F7F884D1336AA70BD65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384464, "uuid": "08dbc73a-3971-4f63-b6dd-69f2b8e67bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384464, "uuid": "5ea60e36-c649-441f-a0b0-d154bc9b4edc", "value": "12288:7oeces2lv8DgBskGa7mkObVfsTcKiS1JCkFSuo:xcesWvw0JKRbVhSNEuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384464, "uuid": "06668bf1-295e-4cca-b9c3-5b7400fa0dc9", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384464, "uuid": "01c1b35c-b5be-4d36-8887-206db09468ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384464, "uuid": "67f886aa-fc5b-4792-abe1-60265abe9c7d", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8dd61f-ac4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676369051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369051, "uuid": "9bf714ef-c669-4c5a-983b-865fb4dcc7c9", "comment": "Malware payload (AgentTesla)", "value": "46d3c7d3603c734d18fb9c1001687277", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369051, "uuid": "db42b154-b45e-42f9-9445-164541fbedd0", "comment": "Malware payload (AgentTesla)", "value": "4d08b5983d47e4e98391a90f216a755b09739ae63e9d1c4216d2a5493c8467b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369051, "uuid": "a985d607-45e8-48f4-b461-2dd7dff27761", "comment": "Malware payload (AgentTesla)", "value": "c8460d7ec9751b63b8b5dfe6f358c37e0dd6e075", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369051, "uuid": "81cd12cd-b3fc-446a-9e35-7079fbe76675", "comment": "Malware payload (AgentTesla)", "value": "27c3052bad6b8f6d65c470f04b78f5af3984f1f61e7b47fa9ed27cd85391f39dfda8c365a753ab8dce65bbececc7479e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369051, "uuid": "5f4e577e-f4fc-47a2-9dc0-cbb0eb4079eb", "value": "T19EE33B17BF004657F8580F3448F38FA52A61ED446B520A0B2629F72DFEF17E45E2AAD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369051, "uuid": "2d939740-c11c-4aa6-a754-7b02c5f50131", "value": "3072:KbZ+RwPONXoRjDhIcp0fDlaGGx+cL26nA19Z6AFsTyez:iZ+RwPONXoRjDhIcp0fDlavx+W26nA1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369051, "uuid": "59fe6f9e-6725-40fd-a832-daa2a101fede", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369051, "uuid": "6d300f03-1c0c-4fc6-946e-c8347ba3f3a1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369051, "uuid": "5667dc1c-7efe-41a7-a79d-d4ac0c2b1485", "value": "PO#106583-4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e662f4ea-ac84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676392231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392231, "uuid": "e1ee7e95-7987-43b7-bcf7-d60b593603f7", "comment": "Malware payload (RemcosRAT)", "value": "57a060f42df2a93a822e350883ae690b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392231, "uuid": "43fb3994-0a94-4ec5-b3d9-03a6faa812b4", "comment": "Malware payload (RemcosRAT)", "value": "4d8144373754035a1f2efa73853ee424d7f69bdd1b8c0cd97426d25733f00ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392231, "uuid": "e8791e3a-805b-4dc2-8bc5-2a42e54fc28d", "comment": "Malware payload (RemcosRAT)", "value": "de327f754c59aaf7faa54523c8f2c9f936c58c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392231, "uuid": "364b2d66-2439-4cfe-9f71-5f2e1235e553", "comment": "Malware payload (RemcosRAT)", "value": "c90e440315bc0ea30672f5fb3013eb3429f00ae6bc062e57101cea57f7bec4b1f3abd6674588334ad702a31aefb730ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392231, "uuid": "85219676-09cf-41fd-a00f-e9c38dd94297", "value": "T163B4230AB2E594BBF5EF33325B325B47A9BDE42A1484D64387E44C0A7C97D44CC0EBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392231, "uuid": "54feec0f-f22a-44c7-855a-0eb10e308816", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392231, "uuid": "b40dae17-f40e-47f5-8ef5-80185f13fb1e", "value": "12288:JYTKdJ3bU3RfIJE9bIkDEx17NTIwZtCUthL29emorG:JYTwJ3bMRAJE9bIkDY9N1FtJf9rG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392231, "uuid": "ef5da27c-4045-457b-8386-4685330d4283", "value": 534767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392231, "uuid": "14782bba-36e7-49c5-a407-7a6b8590df79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392231, "uuid": "b1049018-255f-4519-acf4-0c39665d1aae", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe038b5-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403817, "uuid": "a6515ef8-6387-45f9-980c-c150ad2d12f5", "comment": "Malware payload", "value": "fa218012fb94954f50ea4dedfa0346f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403817, "uuid": "39cc74b1-cd17-4577-a7e9-77f1d0cf9277", "comment": "Malware payload", "value": "4da209f919358e69dce1d1bdb63bd2dcf11d4f87a2d612e291d524f83450c49a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403817, "uuid": "47a72b36-097c-4df4-89a8-f4898cbee333", "comment": "Malware payload", "value": "5c2074ab9b50c9e16b10404a5027aadb33028a9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403817, "uuid": "fe1edc6e-b41b-4a40-9e6d-db9f2f23d031", "comment": "Malware payload", "value": "ddff98ca47646557e420bf3ea2e17a504eac53786d59d3802fe9a95ba14c2f83da7de3dd1d00428b3c72d4db76ad7ca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403817, "uuid": "366e4f67-5cf7-4fea-bdfa-3315a3842b5b", "value": "T1B8937C03B5D19C71E9721D3128B1C9615A3FB9211E748EBB239802AE5F341D1AE35FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403817, "uuid": "340d6b8b-15db-4dcc-8cd9-9d1cf91050b9", "value": "1273eaec87da7c0a308253f29e7857eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403817, "uuid": "de4ab95f-888c-422b-99ea-d5c91879060c", "value": "1536:BXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWR75Pxmx:BE3x5KBDYiKWm/iSw0fRMvygRZxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403817, "uuid": "5a4d4ad3-87af-4065-8a70-3dd42945b01f", "value": 90376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403817, "uuid": "05b4d65f-567b-422c-a5ed-76eaa7510e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403817, "uuid": "d9c2026e-ca3b-4feb-a6d2-8be04b89d785", "value": "SecuriteInfo.com.Trojan.Generic.30350.11493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2954d94a-ac97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676400075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400075, "uuid": "52286503-f381-4d4e-bb9c-2c962b168e1e", "comment": "Malware payload (Formbook)", "value": "a2fc650660b1067964c712db898be0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400075, "uuid": "049fb552-99ca-4994-a0bd-91667169779c", "comment": "Malware payload (Formbook)", "value": "4e76c680beb65149bcd635087a716ec03bbeed03d722482a959a3ddaa8671fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400075, "uuid": "d9ae9dec-6201-4dbc-b451-36cb23435c14", "comment": "Malware payload (Formbook)", "value": "a71d989effca3b54ebbc6599fc2a81ed839179d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400075, "uuid": "35afabc8-5e2a-42d3-9fce-0c8d4be2d224", "comment": "Malware payload (Formbook)", "value": "6c1e1066e60506f96c90f4cf65736750f83e460391728e4d1d2bde3f3ff44989bd40f355ea35d2fae675f13b15d4e17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400075, "uuid": "b8ec2c29-a271-4c95-b116-fdd6e62ab5dc", "value": "T13DC423812161F327C7BD8FF018F454992B79663EA913EA4E5C4B61DC1E42B01A781AFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400075, "uuid": "0e4ee42c-a363-4d9b-bb89-9f5ba2195b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400075, "uuid": "824684c9-4349-4650-a7b9-b0579bfe7995", "value": "12288:DlFFZ6S9fQdkTO7fYbimytvYJPQD4J11wuhCNdcEtvJ+Kzk/5Hm8Z5YiW:D6S9fQdkakUYZKsL4v1zk/o8Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400075, "uuid": "7f1a706a-c8bf-4cf7-bd94-689eb5f719fb", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400075, "uuid": "3a464b06-25ac-4e21-b0db-3305f92e71cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400075, "uuid": "c351e57c-9eaa-4d8d-a6f8-192b67244373", "value": "a2fc650660b1067964c712db898be0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502587ab-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676359338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359338, "uuid": "cb863818-46c5-4423-9c4b-c4ff2cfe7225", "comment": "Malware payload (RemcosRAT)", "value": "97ff322fac5ace537907d0f3831ba2be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359338, "uuid": "a79ae20b-e4cc-4498-868b-54628a6208e5", "comment": "Malware payload (RemcosRAT)", "value": "4e94b723292987a2ee01a5e4ee5721a5ef99c8c3c416c94146804b5385c0f3a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359338, "uuid": "9e254327-f870-4b55-8a92-45e3918381de", "comment": "Malware payload (RemcosRAT)", "value": "dff2beb68300e122547351a0ddad492eef4a22e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359338, "uuid": "14a71f97-0308-48b1-9c5a-a6b350798a92", "comment": "Malware payload (RemcosRAT)", "value": "c77311cdd14063959adb6400d9f7647afbcec9d00bee25fc27cdd8f4bd8360d0a3c0df20a85c85ef6f1ba2abad0cddcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359338, "uuid": "c3fbab49-163a-4d57-91e0-4dcc3486fb19", "value": "T1D7155B3203437E99977B1E8AF54526224CB4BE57470AC138BEDA3AF43A7711CBD194B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359338, "uuid": "72d0dc62-b8bc-48b9-b506-d5a52cf54bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359338, "uuid": "6ce80ef9-0eaf-4041-8958-c2ca4d065fc1", "value": "24576:4uqH04zaDQ/fJKlDHh3b7dNbzZtUv6VDA5PApwmFt75qN4W+sd3PQUxtX:yEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359338, "uuid": "18b63be2-2867-4118-b476-5fbe00c1813c", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359338, "uuid": "bda5f064-a45b-40b7-bf2d-d2f3ee70cc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359338, "uuid": "8ddc0c8b-9b94-4556-bf33-4b12b7fc84f9", "value": "Bklbpnn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fb1969-ac74-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676385082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385082, "uuid": "d8867f78-7314-4ba3-ab52-4d377cd4094d", "comment": "Malware payload (TeamBot)", "value": "9e30f307c56a3e262e6b72f3e9820ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385082, "uuid": "cb2fa7ed-2165-4af1-8009-f501ff7b1756", "comment": "Malware payload (TeamBot)", "value": "4e97ec295bcc3f1d71125f03251291c93874e154ea9b1479ac44b4bf3c72b75d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385082, "uuid": "1100d695-910d-4ce7-9836-8f3c7b5f0e88", "comment": "Malware payload (TeamBot)", "value": "27876cb9b355d08ae620380680b227f9b6399653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385082, "uuid": "95f30fcd-aba1-4e9c-ae96-394623560d8e", "comment": "Malware payload (TeamBot)", "value": "74d7835b09b8e7917fcf3ad3bc7def080fbe944e210def53e32e9ebcacdaa5c6983b459b5eb875a453a04a88e424f75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385082, "uuid": "a875e619-2c78-403f-9a06-a0ee48308ab9", "value": "T17004D01279A0C072D25781BC1930F2A86E6F7CB1A37685973F44467E6E312D38A7B71E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385082, "uuid": "f4315147-0496-45d0-befe-e66fdde00692", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385082, "uuid": "76feed3b-aa1e-464a-94ae-89611f5daea0", "value": "3072:aWXQvLltV5oV3eIRRf47Zb8/r0GuELhMKx4jLDHMD1X:5gvLltg9LRd49bcrpuELh/44pX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385082, "uuid": "b619dde4-6eda-457d-8f65-a0df0608ba79", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385082, "uuid": "4a81503a-6a1f-4ea5-85d7-25b1b2f74829", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385082, "uuid": "e7c6bd2f-a89b-41ca-af0f-4a1df148a34c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39c877a-ac59-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676373678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373678, "uuid": "9e63bc2f-509f-43eb-8991-d50119ade27f", "comment": "Malware payload (RedLineStealer)", "value": "2d45cc5191f2859f0101bb15b9833366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373678, "uuid": "fc5decca-3a93-459a-a459-f2e599d74a22", "comment": "Malware payload (RedLineStealer)", "value": "4eaa76b38029bd6f986a54ac49a009636320c39fdf00b9e830e9c435585f097b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373678, "uuid": "81c52349-b9b4-4466-818f-a20d539e0bc7", "comment": "Malware payload (RedLineStealer)", "value": "34e41ffea89dc2697ecccd4c052dfca7bf1263a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373678, "uuid": "52e54009-8398-4a04-a59c-8caa0052ba7f", "comment": "Malware payload (RedLineStealer)", "value": "0227ab4e4b13d81753f8ddc360688bd1abb92b4304e5c3384f184b8ff0d8cdce78959b054caedcccd4b3df74aea44289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373678, "uuid": "9a3a99e5-4b2b-4ff9-a274-b0615e8db69d", "value": "T10CF41207F6F88132E4A5637468F503C30536FE619E798297274F6CAD2D722B8A57132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373678, "uuid": "cdfc15f7-e3e1-4e44-81e3-f441cc1a0fe7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373678, "uuid": "68bf6aad-49d2-4109-9e13-b8333d65939a", "value": "12288:2MrBy90Zc1oV+kJC6e8sA3xYGvDseJMZQpeN73hzNfFUNlpR:3yAcoVvJC6HsmxYGvDsaMqg7hZF6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373678, "uuid": "82768724-cb74-46aa-850b-49cd8ad9286a", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373678, "uuid": "21635a5c-c8c9-43a3-9323-4aee3eb494eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373678, "uuid": "62078003-9b75-4323-b284-ec6436aac286", "value": "2d45cc5191f2859f0101bb15b9833366.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08b55a8-ac37-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676359150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359150, "uuid": "afef6f84-2863-4ee2-bcb1-2406abc82a0a", "comment": "Malware payload (Formbook)", "value": "35ab852e18c2cbb0072c16c23aabae89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359150, "uuid": "1b42513d-1cd8-47b9-a382-96ba71698944", "comment": "Malware payload (Formbook)", "value": "4eb705a138ca2f8b57e12960c2e89be695c156affbd5bb6a606aa685cb3b0ebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359150, "uuid": "053293e4-bfd2-4d07-9cc2-8c6dd40c0958", "comment": "Malware payload (Formbook)", "value": "baa3b463e5fcde8a6dabfb113e7050e39242bcea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359150, "uuid": "61d58832-0eb1-450f-8304-01bf3e175888", "comment": "Malware payload (Formbook)", "value": "3b98a74123346551d94dccd50197827189dabf1c6459e9d94851723bb925bcb85c6b1907581ade467cd19134a1a52d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359150, "uuid": "3996b3e0-8e0c-49a0-b995-6a38ed490b2b", "value": "T13C05220A599D9B67D53DC3F84A36A974D731ADB53D31E6AA0C833BCF20357A0081678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359150, "uuid": "50d71b58-0d08-4659-a22a-dc1c38e58379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359150, "uuid": "3ffc103e-265c-45e4-bb9d-6e4c6268ed57", "value": "12288:vh6q6EMAYC0ND571Vd8sRESXdCJb+v3V1zCRbsjr9IzFI3Y0fwRvALaCK+e0E:vYXgQ57jJEb+zC/RIo0MAOj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359150, "uuid": "e5001b68-786e-4890-bc1d-31196b6e99cc", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359150, "uuid": "07979cca-6182-4e61-a07a-f6162ff404a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359150, "uuid": "15301fe0-bfc0-49d9-b863-1c465d39e39e", "value": "aZDSUPv6IlTFjIz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f4b0f0f-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392864, "uuid": "70a0b438-bb62-4498-a076-a4830481ccec", "comment": "Malware payload (RedLineStealer)", "value": "eb823124ad8b40ed04f5bdbf4587c990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392864, "uuid": "c320f9f0-72c6-4960-a7f3-cfa033e893a9", "comment": "Malware payload (RedLineStealer)", "value": "4f12d1d0c9d51b4626295fae6c9d1f80454f54e40eca62d6107a4e8a78e56e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392864, "uuid": "b238b483-5d9a-4285-a216-1598d75300b8", "comment": "Malware payload (RedLineStealer)", "value": "3b2c198aab7a322c1d2232ddbb6cf11f3ffee831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392864, "uuid": "37f002ed-a2c2-4e31-8cc5-67828675906a", "comment": "Malware payload (RedLineStealer)", "value": "200431a97a956e61d2e59643f1f7d605a8d90f400c47cc21a77dfd863dd5a5f874b3654f1b42b4d7e6968c10cc7345ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392864, "uuid": "c97b3ed3-d79e-4f04-b4d0-797d33a9ede1", "value": "T124F4124BABE84026E9B513702DF703D31A77BD614A75468B3B8B5C1A0C727B0B6707A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392864, "uuid": "a2f44612-b7f4-4a28-8dc9-8f28a11b2873", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392864, "uuid": "1424b39d-6a7f-4964-a264-91e474d209c3", "value": "12288:IMrQy90hbx40vCoo3URW0BI+Uw88hVNIPJIQAwYFkv8LwnkVd5CwcjSHx:Iy6bx4yCoo3URWuUw88hVNIRIDwYW2FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392864, "uuid": "7a2b22a1-e461-49d6-9a5d-be23ce9ba4d0", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392864, "uuid": "8f42b9ff-f2b7-454e-8a70-a87f368360e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392864, "uuid": "2705a47e-8893-4276-a4ea-1c2fd210f09b", "value": "eb823124ad8b40ed04f5bdbf4587c990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb2f165-acbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676416104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416104, "uuid": "64563f6e-9afc-4a22-a2e3-f1cf3b2fd377", "comment": "Malware payload (RedLineStealer)", "value": "2af1f4afcc3ffe11995c86639fbf9bc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416104, "uuid": "bf7035f2-fcba-46dc-851a-4c4eba8722fd", "comment": "Malware payload (RedLineStealer)", "value": "4f6b3c36282db236197667f73be4043f99224904716f2462b2d06e8417c9f2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416104, "uuid": "5dbd661a-ba12-4584-ac90-cc62ffc5ec5a", "comment": "Malware payload (RedLineStealer)", "value": "c33402b8c61077503deb6c2719d1444ef9c6d88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416104, "uuid": "73ba9347-de4b-4900-85e8-16a7c41a40cd", "comment": "Malware payload (RedLineStealer)", "value": "1f1340887757762752821caab33a36d35b159780c478dc422f6f81da59d4477facd6d795aefe817179f937fad0a62c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416104, "uuid": "41d0b3f4-c1f4-4247-88eb-0eb1219c417c", "value": "T1AD051256E7DC8037D87497B04CF603D31F3E7D206B3512A72796A88A28726E4E53276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416104, "uuid": "d4759516-7836-4f53-83ec-a322a3874908", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416104, "uuid": "e427f5a0-e5db-427d-bc0f-57d7422160ee", "value": "12288:AMrRy90IktSEu27shTBkj6cwJVssfHq3sbdB5TgiFfHXPMH5V4YMWK0WjFHV7:Bywu2YhS+bsEKITgwHXPEXK0Wjj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416104, "uuid": "b7c0658b-0d6a-482c-b38c-f19a31374cbb", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416104, "uuid": "4e46d1c2-19b8-4246-ae08-49b3040d21fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416104, "uuid": "267b1771-a59d-431c-b562-00f9200aeddf", "value": "2af1f4afcc3ffe11995c86639fbf9bc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7058fb-acb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676414010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414010, "uuid": "b13212d9-8603-4938-8fe9-a03ca60d1d70", "comment": "Malware payload (Gafgyt)", "value": "732bb83f9c659f57765ecdffdec51a31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414010, "uuid": "bfde7f78-ecaf-4dde-9702-ba21053b219f", "comment": "Malware payload (Gafgyt)", "value": "4f78e8355685a6221608465a77054f2bebe50d90e500f0af3b924d9a52ab4a80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414010, "uuid": "e389136f-4ab8-4fca-9705-e3ab2ab5ff67", "comment": "Malware payload (Gafgyt)", "value": "4766ec0bfbd253c1ded48b339c205209dc97ba66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414010, "uuid": "6617e93e-16b4-4d5b-a608-2403eb3db698", "comment": "Malware payload (Gafgyt)", "value": "6b5fcf2ec54d3589b740d8cfd437345ee94f0237c45787a5b8131a04bc1d385f488e64487c473c6e41b02ef7bfb329bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414010, "uuid": "45c6c972-9c3b-4e78-83a9-150d388b494b", "value": "T105B3F805D9905737C2D23BBEF79A82CE73261F989797331186287AF41BE5B9D1E39020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414010, "uuid": "4501a0d6-ca2d-4a63-9162-e63776f8ba08", "value": "3072:I6z1WqLgV4ZQGBcD3i/lMpaLhmVAg/iLezaOMzUxglryYl6A+BhbqUJ2W:j6zaOMzUo6A+7qUJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414010, "uuid": "24e5e172-de01-404f-8205-9ba5dd846329", "value": 117420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414010, "uuid": "e9b434f6-3845-4ebf-9f6b-587dafcc3d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414010, "uuid": "97033c51-9327-43da-8b24-4454c1f62755", "value": "732bb83f9c659f57765ecdffdec51a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1556202-ac54-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676371634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371634, "uuid": "04bc036d-97b6-4f5f-a30a-a38a4bb96453", "comment": "Malware payload (GCleaner)", "value": "2e84a907456f0fb10973f4ee1a0ed579", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371634, "uuid": "5be999aa-f1e5-4cfd-b277-4bde119e3413", "comment": "Malware payload (GCleaner)", "value": "4f860af9736b4e6ce2cf98afa378886c69022f264586bf911ad31344d2ae2692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371634, "uuid": "4a816cfc-e550-4584-95f7-65d5a19d66ba", "comment": "Malware payload (GCleaner)", "value": "752921d583c12f81dbad318f16b765d5e21700c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371634, "uuid": "21c3a5e9-269a-4285-b91d-ed1abfb38290", "comment": "Malware payload (GCleaner)", "value": "b8078e80dd83c6156e29bbe3f52c6866f04242aeb0bfb9ec406a1fbd8696b6beb60e735ac6e4287ad23582c0e3f7d168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371634, "uuid": "f794fe2f-3080-44ba-be32-8424984543a4", "value": "T10BF5127D7105C59CC280FEB49D26D4E36CD66EE3E9A0902770EC7F3F52B92899A19207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371634, "uuid": "5b2dbfda-11af-4e20-b293-f97b8d79faff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371634, "uuid": "ba9e8564-9d08-4a17-bead-f2ffb531d0a5", "value": "49152:rdHAXMhz90fEphN/XpIRTNd7O+l9BsmFXIoIT3ppSJ4OruJfkgIp/eLCgv2MR:JHAy0G9Xp8hTZXo1pAOJfxPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371634, "uuid": "39eb7818-2faa-414a-82bb-0624ecc0ebfd", "value": 3363377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371634, "uuid": "71cff16e-f99c-4adf-9d61-ad6186f7a937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371634, "uuid": "69f25e67-73ab-4190-bb1c-7e75ec91d1a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153b5df3-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676403477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403477, "uuid": "39cfe854-f387-4dd8-a68c-7fbadce7a5b7", "comment": "Malware payload (Amadey)", "value": "5d0b9882ae1a42112fdd6f7cc2066bae", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403477, "uuid": "139506fb-4aab-4a8c-89f8-8849efce9c30", "comment": "Malware payload (Amadey)", "value": "4fc7a05b1e1f87bbd9bb1920dc36949c01d6d854c75f328494217e3fcface091", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403477, "uuid": "446b2a06-443e-433f-95e2-f1be8b6f8cf9", "comment": "Malware payload (Amadey)", "value": "4006e6865ab2d95230fa12fa4e727b450b05004b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403477, "uuid": "e9421d2b-e797-4e57-a85b-d10d572e0b89", "comment": "Malware payload (Amadey)", "value": "ca2ea833356e4207f95ea2cc871aab57465c5246f3f4b03e412d52ad636e19b29674a2bb437014381ff35fec7e91ed3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403477, "uuid": "8525a069-5c4d-4660-8b00-083e82fc9cff", "value": "T1A4F41217E6E88022D8B6A77019F243C30B367DA15B78879B174F6CA90D736D4B630797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403477, "uuid": "066381a0-94fe-411c-8c96-5acc441231bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403477, "uuid": "a7ada512-13c0-4956-a087-9f3466df2793", "value": "12288:HMrMy90oUYyc7ANZpI+tcuBkbe3KB6KxMD5GNf5C+XCY0qwps3X1tUQA9bU3gPuU:nymc7ANHI+tie3KBEDkNfpXC30HDUQMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403477, "uuid": "0d9f4fe9-e904-483d-94a3-db17d774c7a9", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403477, "uuid": "12b9c02e-1c0b-4cc3-8b32-59922f94e4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403477, "uuid": "02898e42-637f-4967-9fad-7c6602c45fd4", "value": "5d0b9882ae1a42112fdd6f7cc2066bae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbf3a8b-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676408187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408187, "uuid": "e73ced72-91f2-450b-96e7-052aa3da56e2", "comment": "Malware payload (Gafgyt)", "value": "75b6def8ec238eb00a82fea2adaa5428", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408187, "uuid": "f1117ee8-050c-4ca7-8ecb-5a471e974198", "comment": "Malware payload (Gafgyt)", "value": "4fe70147b6070c3d2063c816e628d9e788d548617a88ea08045c830ddd5ec5f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408187, "uuid": "7b72e881-168e-46d1-85ff-e6e4d85e7598", "comment": "Malware payload (Gafgyt)", "value": "9ee1a16699b30e3310dfbce249ec9f7659eb3027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408187, "uuid": "245df906-5235-4135-b2f3-1ae8bcafbb5a", "comment": "Malware payload (Gafgyt)", "value": "aec2b85093cb545e8acd2e91998ae4988e5b0b8603ae6a72613ff113d48f9d0bbec4c07ebe0d930993b806df0a737a96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408187, "uuid": "35888560-846d-43a0-8727-00af1ebf1281", "value": "T1BA142331AD17D263C497EFF8ABE9BA96DB19F2C30F45860362A0106D4DF5999241FCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408187, "uuid": "04a385db-6a34-48e9-995f-b93160b4b4d2", "value": "3072:nSwag7dYHOb+p9mt29UVcCTgmX80upImaDY1:nZ3ap1SgmX80upImaDY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408187, "uuid": "39a940ab-e41f-41a8-a03a-35f5d8f979be", "value": 201089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408187, "uuid": "6e49506e-8b7f-4827-9df6-7f8bc4689e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408187, "uuid": "4f585f8c-4e39-4a9e-ae8d-8d68a0129500", "value": "75b6def8ec238eb00a82fea2adaa5428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a562d2a-ac73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676384561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384561, "uuid": "4b236393-244d-469d-b6d5-eaf6bd512d1b", "comment": "Malware payload (Amadey)", "value": "586937e79b3e491b5ac0eaffcc8ec8df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384561, "uuid": "6dc94def-df16-40fc-afd6-34b72d752f0d", "comment": "Malware payload (Amadey)", "value": "4ffc5ab75f9a0222962286d528edf8a9daffd22cb9618bbfec71dc54641142d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384561, "uuid": "79e7ccfc-e186-4bce-8e83-a14a4070cef5", "comment": "Malware payload (Amadey)", "value": "c5457ccb105770f45242cf9cac45ada3c94b3d79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384561, "uuid": "fdc78b9c-c8f8-4815-a1bb-d483d058c7b5", "comment": "Malware payload (Amadey)", "value": "9362c78a4c7f6a3ff489e5081a1021405c515de3a88153a23dfbdb2f88a5d6590f63dad0b5d0c3d9aa9d909105956dfd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384561, "uuid": "4681504b-1c86-4756-8fa9-93c537036399", "value": "T1CFF4125BF6F99071E4B4A73018F303C309367EA09638939A678FD95948736B0B23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384561, "uuid": "d4c3c3b3-87c6-49c7-a381-d24a47e749ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384561, "uuid": "709e8b4e-59c3-4f08-aeeb-dd35bc6c63f1", "value": "12288:5MrXy90wixmG+ac8koF4ZIi2Fz4TgujFMyy2Mpr/kK:SydixmRaTF4ZIirTFnCr/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384561, "uuid": "fee69407-76f1-49d2-be3e-62a058183e9d", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384561, "uuid": "e927b4ec-ad4b-4953-9d20-96cfd3e8875e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384561, "uuid": "31ca5083-e636-4762-a8f8-f5100468e069", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55265471-ac74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676385116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385116, "uuid": "a81b3909-9316-46f5-8d00-5a6e1b4fe34b", "comment": "Malware payload (Smoke Loader)", "value": "fe34302c261cb7af3d5a691d71d8ae0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385116, "uuid": "04c1b303-6e67-47c3-9857-2de18d1abcb7", "comment": "Malware payload (Smoke Loader)", "value": "5059141a3b1e85068913889cf9cd34ab9cea558f4a013cc7bb999da441b7c2f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385116, "uuid": "96eeb71b-f84c-4ff1-be7c-e3eb15d1e5d3", "comment": "Malware payload (Smoke Loader)", "value": "ee52eb5d62897a30ae427720587eba4913a08015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385116, "uuid": "f104cc79-1853-4133-a02c-290d3427c2c0", "comment": "Malware payload (Smoke Loader)", "value": "2fb77626911a24d679f4effa01e4a9772edb536ccc89dc61a030b88bf830da7a0af1b1bcf5010eee1bba4f901691d639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385116, "uuid": "34e5f702-3862-437a-b81e-0b589e95d487", "value": "T1D604DF1279A1C077D46784745561D2A06A7FB8B2B7B5C48B33780F6F2E307D28EAA353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385116, "uuid": "1ecc2d45-8f72-4911-a1b7-eb628ae2782c", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385116, "uuid": "da27b03c-da2a-4dc5-8f18-b1d87419d209", "value": "3072:dSLNMpcLOq675oyje3uiUmupjs/M0p2uwpZ6Xka/IANMa:dC3LOq6CGiUmuB7XpZ9ath", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385116, "uuid": "e7a8c851-1484-4de8-b5db-28cf96cff22c", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385116, "uuid": "47ac9b28-0f5d-4a7d-96ed-248200ca67e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385116, "uuid": "0b8a2150-41af-4667-86b3-68c6320b604d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a7cf13-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676408719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408719, "uuid": "38587f38-b802-4170-8f79-5e33ed1ac4cf", "comment": "Malware payload (Mirai)", "value": "d97de36f41f6f87840d0fc111105c470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408719, "uuid": "adfb946f-7d08-441d-b2e8-5857e8d7b8e9", "comment": "Malware payload (Mirai)", "value": "50f08770740415685d97521a2164245cdb83f0147623173d00f13279eadeb50f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408719, "uuid": "b6d20e1c-b5b6-4d69-a7d5-90f88b42fe30", "comment": "Malware payload (Mirai)", "value": "409af1fede597889d6855f4e71207b2805b9ccd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408719, "uuid": "cc151bea-b969-4798-8b5c-55aac1382bc4", "comment": "Malware payload (Mirai)", "value": "e93dbe4b77b29448f2504f2121edaa755907da1be6db84f65c995ac4471a7ecfc06fcb852ede507aef8b0718962eec25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408719, "uuid": "58f5de02-cbae-4fb2-ac3b-b7e1c1bb293d", "value": "T1C463C60E6E219FBCFB5C873447B78E21A75833A626E1D245E15CE9011FB034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408719, "uuid": "34fea6d7-7398-4b60-814b-3fb48c6d45a6", "value": "1536:y1xZeojGvZuKrgFrmWRTBzHZtIgMX6bJwxGvi9UJtcf0ZSqav:y1xZeojGvZu9FrfRTBzHZtIgMCSzf0ZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408719, "uuid": "6835d6ce-0927-4ece-bdde-ddf9adee9519", "value": 67808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408719, "uuid": "c86d6f74-2c53-4db0-b914-fa10d1db1e35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408719, "uuid": "2fb7753e-e558-4718-90fe-37ad1217b6ad", "value": "d97de36f41f6f87840d0fc111105c470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db71a8a-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676382473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382473, "uuid": "0d4e4d07-cfeb-4a91-b4f5-f851b5921796", "comment": "Malware payload", "value": "ffab17d009f232456d176effa87f9e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382473, "uuid": "bc7a0698-a7ea-471d-88ca-3e51a9cf8e25", "comment": "Malware payload", "value": "517bf5edbd1c1d1c2906561fa88e36aabd33fa2b0a94ee7bf4953ea6b0844be5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382473, "uuid": "46385b4a-513d-4c8e-a209-9278a5f7bcc5", "comment": "Malware payload", "value": "2b60155e187d127e829a03209f2ce8fac5105268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382473, "uuid": "7e31ad1a-2d1a-4a2d-afcd-4966fb523bf0", "comment": "Malware payload", "value": "8fa0f23cc460deba1dfbfc07ba172aee68058274950e5daf80338e88aaf62f3b9f4240ce4175633df35e21c217a90c3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382473, "uuid": "e8aa3ca2-8777-46cf-b607-e7ceff6d4fdc", "value": "T16B54122122F06D77CBAA52B01A7B97B8F276F70613C2074F07541FBE2826585CB1B65E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382473, "uuid": "0da89361-8911-455c-a40e-aaa75d5f67ad", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382473, "uuid": "68c84d36-7c32-4325-abab-12b216b9a41c", "value": "6144:nzAJ6RvMR9tS8oz3zWnjiVvsRgiaIk3FOjImLHH9taM6kEodBam8A:zLuy8oDiavDIk3FELHdt8oBhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382473, "uuid": "03cfa984-c22b-4adc-bcef-e2a9e580d8da", "value": 290504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382473, "uuid": "1cc6dd7e-54fc-4af1-85b6-fd5a9ea7cc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382473, "uuid": "ef8dfafe-1d94-44b2-8d53-3028dfa4b8c6", "value": "DHL_AWB_NO_#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e775e7df-ac6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1676381066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381066, "uuid": "ddde4988-2d9e-4917-a416-c94cfb9981dc", "comment": "Malware payload (Guildma)", "value": "8e6e404149c3c6a3fa8447478549cd2b", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381066, "uuid": "2250341d-cd8d-4cd4-8b72-06b66ccf5af2", "comment": "Malware payload (Guildma)", "value": "5219fc37d75ca18e5979e2ed1f742425f4f8dadabbeace41275d12f2e50ae569", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381066, "uuid": "3253df14-7891-407a-92a6-41665c39b732", "comment": "Malware payload (Guildma)", "value": "cf886da89c02be230fa5acac02ced8afcac6e467", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381066, "uuid": "47da77e2-b810-4421-90b5-f9a50a1ffbd0", "comment": "Malware payload (Guildma)", "value": "b7c056a36b29bf872495414adc30a266a53d15d32b959f7d095a9094d11ae15de847b375b45a6d7d5e3d7ba69ed45aff", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381066, "uuid": "d62b3253-1f48-4623-a19c-998e162968e4", "value": "T1E0D216884097A1970172C738AEAB805CFFA1CCF6A465D8D5F9C52470ED71B2721B4FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381066, "uuid": "71e291d0-8b42-4d8e-aa5b-40bfb3274c25", "value": "384:ILA46OiWuNf+tI44QOAVjcn5pFSUbwsh/:kAQ7L0AVjcn3FSUbwsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381066, "uuid": "100dad34-f4be-4c0c-8974-8524477d9198", "value": 29754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381066, "uuid": "bb566ebb-5ae0-4774-a5eb-d8cc51fa1712", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381066, "uuid": "8d6b4d1c-2398-40e3-8010-a33a41df77c0", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1447d4e-ac3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676362104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362104, "uuid": "6ab08b96-32c3-4c12-85ff-9b30f3142d61", "comment": "Malware payload (GCleaner)", "value": "96c52ddf1e2309f00321ca2a7ab69d0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362104, "uuid": "37c7f7bc-4f3f-48be-ab2f-9bff20183b7f", "comment": "Malware payload (GCleaner)", "value": "525ac54c896863cb822c4d078ab2316e6f8fda10dde66358f0825b458dd55145", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362104, "uuid": "2a98c1cb-b647-4d53-b4f5-0382b81831e5", "comment": "Malware payload (GCleaner)", "value": "51112333f427252bb22cfd9b14f3f59b38601f46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362104, "uuid": "53eb7564-8d46-46b2-b523-adca0cb33fff", "comment": "Malware payload (GCleaner)", "value": "f8d1c8e63467deaae72628e7d7adf6ccb32ae1b8b337496eb05d45c2d0506d7f20e9cab9a0a4db20ceac8f792743c952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362104, "uuid": "6daefdd2-734b-4214-ba99-ec8e983205ff", "value": "T1BFF5127C7105C57CC680BEB4883AE8E75CD66EE3E9E0A56370D97F3F91792898A09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362104, "uuid": "d52721b2-aa81-4573-b9de-4d15c2cad96b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362104, "uuid": "b853fe46-af60-43c3-a552-67199152756e", "value": "98304:JHBBAkMDIJd/1+MLKlX83R7Xk1tFMzv2MR:dBa34jSCizWvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676362104, "uuid": "11cd4619-beb3-4aa4-87b7-c2cd9486ca41", "value": 3332011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676362104, "uuid": "1b9b30d4-a63f-4ed1-8e00-311dc558c51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362104, "uuid": "021fe815-3f8a-43bd-bd48-23a1301356d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c63762-ac97-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676400012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400012, "uuid": "2ffc1916-ac7b-4f32-bf51-cb5a6bd6e4a9", "comment": "Malware payload", "value": "c91d4192a658b532c7e215c61a3a0916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400012, "uuid": "d034798e-3c77-496c-9001-b084ccb1d8a4", "comment": "Malware payload", "value": "5272ac99491e6d0b91b3665dbd06bbaee0fe1c87e5e4335d80d059def88f078a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400012, "uuid": "d788d6a2-aa2f-4a2d-9515-9e8336269d48", "comment": "Malware payload", "value": "77016b6a788480c6e330c907b068147a6307cd74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400012, "uuid": "e2a5f22d-f4d8-4bde-9b06-161d5d327a59", "comment": "Malware payload", "value": "249a70e8e6293768d5cf20c73439930909c3e46aac287bb63bd129c622faa3abac8477bb81d72920c2a28dd3fd1619f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400012, "uuid": "8f59eb95-1c8b-4fbe-a397-1a9b80825ae5", "value": "T17475F159103E12D9D2BDC564AA47649FB3A8ACC5632CCFCF689058E613235F9B37F290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400012, "uuid": "71c4b9cd-4678-43fd-9507-dbeda783856f", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68vi1:Vv08Ro21BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400012, "uuid": "73242866-bc9b-4d5b-912b-de7aa98d2a07", "value": 1627298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400012, "uuid": "ebba25b3-465e-4aaf-8b7e-5417ab8b3fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400012, "uuid": "4593841e-6ea0-4afe-b326-d83edaa747e1", "value": "c91d4192a658b532c7e215c61a3a0916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222a8bcb-acba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676415095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415095, "uuid": "b9bc9c3a-8849-41c4-9bc7-736a02462e5f", "comment": "Malware payload (RedLineStealer)", "value": "9067538a9b6a1f37b8e895b71fd6e923", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415095, "uuid": "29671dbe-7f1d-43bc-b56c-cc51894c5597", "comment": "Malware payload (RedLineStealer)", "value": "5285c8a186aa851fb22ed68faf396c625ba349cb5f510f931747fb947b4d59f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415095, "uuid": "94ddf414-835f-428b-a9dd-c98d1c460768", "comment": "Malware payload (RedLineStealer)", "value": "45f4ee05e41587039bb453437f9f5de496dcfd6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415095, "uuid": "c3f5367e-71bf-4603-bfb0-7a8b58f627ae", "comment": "Malware payload (RedLineStealer)", "value": "0dc8c1226a1f926f83e56956fac9b716843e3a40a1274174028c760dfc29a84c721bc424463ea406c5c4d49a1f63b1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415095, "uuid": "28a6a4c2-af68-4961-b8eb-dc54f8b03a38", "value": "T18925220BE6EDD461CD74677009FB02C32B36BDA0AA38829F534FAD5D09726B4A534367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415095, "uuid": "a6bc28ff-057b-4caa-8b1e-2b6aeafd16f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415095, "uuid": "12a283d6-a52c-431a-8231-958d24fb5219", "value": "24576:Uyy7CEu/roEjBBQFIxyGsPAgYxKCi8AJnC:jeCEup9BQF2yGsPABxW8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676415095, "uuid": "e2d708e1-b2b5-4c4a-994d-dd03a2cc4bfe", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676415095, "uuid": "decbf48d-49b4-4d88-9429-f78554491514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415095, "uuid": "78d18bb9-7e9c-4286-b767-43dbe84c9cc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fdc3a9-ac52-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676370727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370727, "uuid": "f0a36d0e-84a2-4ac6-8b64-d012428feb57", "comment": "Malware payload (RedLineStealer)", "value": "6ff223c4f19f667bca874171a5b82ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370727, "uuid": "2df71cff-e8d6-4a30-94c0-5e477a9abea5", "comment": "Malware payload (RedLineStealer)", "value": "5292a4e1dba193d4c26b0c6c41c1148321339d87d971d79dbc5622e24d93943b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370727, "uuid": "76eae6af-f299-44ae-95d7-661baa18d4f5", "comment": "Malware payload (RedLineStealer)", "value": "542d1691e0296b013a7075b3e224469e862b39ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370727, "uuid": "9c8cdcc9-896c-4b53-b386-7be6f6486536", "comment": "Malware payload (RedLineStealer)", "value": "0fae78a198e27bd32684fbc992b77368f7b5cf736b7188978d99a4724873ec6a29fecac116e78f53cf98d781fce00ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370727, "uuid": "1f3efd9a-140f-4bd4-a30e-0ca7fb3c341d", "value": "T1FB54F15139F09073E797C175E822D7A05A3FB87272B0819762482B7F29323D2AF6935D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370727, "uuid": "2ce49812-1bc5-496d-b9d6-25ab81ae6682", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370727, "uuid": "f9d23438-4737-499e-bbf7-80315261f1a8", "value": "6144:ydLz9XeK1KKToHV6bzAG3pC/rG2DcaNoTV:ydtf1K66MzAAChYTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370727, "uuid": "84733f78-2021-431b-afa5-f6611a3ee458", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370727, "uuid": "d599b0c4-7bd4-42af-aaf5-8dfecc401db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370727, "uuid": "242cccf5-bfeb-450a-8090-84e1626e3a54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137382a8-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676412493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412493, "uuid": "0d32c792-6477-4df9-80b4-670be8348f94", "comment": "Malware payload (RedLineStealer)", "value": "ef26afff5a41d3fe5d83d30385e3ba20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412493, "uuid": "5030f725-35d7-4a32-9999-c41bd0d454b8", "comment": "Malware payload (RedLineStealer)", "value": "52e1065ebf95aff0ec2ad29b7436ebf61a8fa6749b2f8811089a13c72bef8651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412493, "uuid": "c29832b9-6d3e-491d-9128-b4d78f718b27", "comment": "Malware payload (RedLineStealer)", "value": "dc66d2bd58d53926631e14de458ec9750eb425e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412493, "uuid": "0b91f41e-736f-430c-87d6-88300ec1b268", "comment": "Malware payload (RedLineStealer)", "value": "813246625e59abac23e37338376491ac3b82784c561f2b39514a2c9054e184614f545812b9ac390d8fc5200355ac6a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412493, "uuid": "aa630ea3-04e8-4722-9321-75d281c24e7a", "value": "T13BE41207E6ECD1B2D9B517B018F616D70E377D606A78839B234E9C6E1CB2160B67072B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412493, "uuid": "01c0fa01-cd13-4c3f-b6e4-068f4b69f1eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412493, "uuid": "ef03bb1d-f9ef-4ff2-8e38-a71c830b9190", "value": "12288:9MrZy901zse9uig5q+IFundD6HfDEOe6RvbnJKh2E2pkepnXsk8O:oyDekiMFIoD6/DzVIR2q4f8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412493, "uuid": "13f4e4d4-4f94-4812-afc6-3ea9c719b695", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412493, "uuid": "c4efd9ea-b401-44bf-8ed1-5423c428e9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412493, "uuid": "662d1f97-f803-46bd-9695-8227a444e410", "value": "ef26afff5a41d3fe5d83d30385e3ba20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0231b9-ac42-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676363763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363763, "uuid": "42bfd364-2d86-4330-8e7a-a57425febe40", "comment": "Malware payload (Amadey)", "value": "4b993a91e80673620877b72c21c9892d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363763, "uuid": "2610edb7-9670-4a06-a9a5-50254f646d2a", "comment": "Malware payload (Amadey)", "value": "531159c12893cd3b37dc9e6337c6e410686cb43c6648139f5e52833d3c22a9f4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363763, "uuid": "6b7f24e9-b87f-4fef-a99b-f89a7731922f", "comment": "Malware payload (Amadey)", "value": "02b535421cab781abf8c06176052d00306ba243f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363763, "uuid": "0a635953-edfb-4a74-8e0b-bb5246c716f0", "comment": "Malware payload (Amadey)", "value": "7443d154e38e5e77a87e74c5a2a4349ae63f03577a51fd60ef06cea48d2d40ddbdc392f8d046982f78cd3ebc9d611039", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363763, "uuid": "ec47c775-c770-4dd1-b189-76a1c8d0a146", "value": "T11EF41207A6EC5126E9744BB019F602E31937BE602B7583DB274EAC6E18731F8A134777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363763, "uuid": "60450c10-9889-418e-95a0-f093209a7702", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363763, "uuid": "8893efc3-6dd8-49d1-84a7-e20ba9b1e011", "value": "12288:uMrwy90dSjPxmHM6G7DLvokg6UJw2gOSvDRcJpdXfr+HReAtzc/tAuPSgrGQBM6:eyTPgMJ7BN2gOSvDRgDvrett4lzSgrd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363763, "uuid": "f3f5516a-654f-495e-90c8-577d04dcb426", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363763, "uuid": "8ae8b606-f6a0-4c0e-a0a2-7e562e6caeb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363763, "uuid": "896968d8-f3b1-45dd-9ded-3ea5c464746b", "value": "4b993a91e80673620877b72c21c9892d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b9e6ec-ac04-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676336981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336981, "uuid": "5e046f7b-b060-4e1f-89f7-9113e6baa699", "comment": "Malware payload (RedLineStealer)", "value": "ba2c56687ba7d4ee0c988e208e353108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336981, "uuid": "02e706d8-e383-445f-850c-6b6361ef02be", "comment": "Malware payload (RedLineStealer)", "value": "5340f4c0475349259847930bd25970a58492c16922f21eb507a85f40d5e6111e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336981, "uuid": "633ced81-d4e2-49fd-a9d2-6c03ab20ac68", "comment": "Malware payload (RedLineStealer)", "value": "478e4ddb7326f632a5a464567bf406b5f690c341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336981, "uuid": "8440225d-af97-449b-b18e-b5631bdb7770", "comment": "Malware payload (RedLineStealer)", "value": "c7154a874f0080a7613936de74de911f4599926372c819d7225dae8c6e79441b85477ddfee6f15b833fc11917e7630d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336981, "uuid": "e0e9be73-d662-4c86-9243-56db373c6c2d", "value": "T1C9F41207E6ECE423ECB0677058F607D30A3ABE614534831B528F6D6A18726A4B13977F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336981, "uuid": "2c4c4159-8df9-4a7d-8e71-bbe6758c362f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336981, "uuid": "38a90839-4dff-47dc-b01c-f5f6cbb69e1f", "value": "12288:JMrDy90xtXfHwRGJ/RttWAc5qlbeJqENCOvKRGiNHPD6Qv21GYR:CygxfHZ5RPRczzNYP+QvK7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336981, "uuid": "fa6415f0-bd14-48ea-94ac-4bed8418fb00", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336981, "uuid": "cac4cee6-69b3-45e4-bc30-ac1b5e035a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336981, "uuid": "e38dcce5-c91b-4b3d-afa6-2706ec416d60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643c0a71-ac3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676361089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361089, "uuid": "73a69dc9-0590-4cd1-ab9b-b7cd8e490cf7", "comment": "Malware payload (RedLineStealer)", "value": "bd4303368d872be1393bb3e4c632873c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361089, "uuid": "3375c2e0-e84c-47a9-bf58-af5a4eb7627c", "comment": "Malware payload (RedLineStealer)", "value": "5364c238ef44ce516464cfbb772b49c01f94356697a62375a5598f6a05640114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361089, "uuid": "1709532d-d639-4cb0-bf8f-c958956cbe15", "comment": "Malware payload (RedLineStealer)", "value": "d20137496ab22d617391b9d4fd7a94b65d7fbf61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361089, "uuid": "410d0d8c-68ca-4993-a719-d98066ef1d27", "comment": "Malware payload (RedLineStealer)", "value": "610fe66231e7931b8fb13c99a111f0b617f16e30e0d7254fca314972fc13264b69bd29ba3eed9602a47b6213a57c36b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361089, "uuid": "4a293f23-e213-4090-872b-3945530d45b5", "value": "T18EF41217E6FC8122D5B553B058F606C31A37BD609A79839B678E9C6D0C73660B13932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361089, "uuid": "aba1b504-3734-4ba3-b0f9-d880ae4b7844", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361089, "uuid": "50b9e7f0-40e9-4298-8253-ef083435e8ca", "value": "12288:8MrEy90t+wRF/LHbloFxJYYOuQNfxFT4uOwPoSEnf6YbbzyOyDiV7r9ZA:Qyi+wXJmJxOuQVEuzPDIidgzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361089, "uuid": "07d5eb9f-8c3a-4292-8840-92361a0346e8", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361089, "uuid": "7575a670-73a7-4663-8a3a-15fce27a7648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361089, "uuid": "0def4fb6-8983-40ef-a81b-ceaa1f120cab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aa40cb-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676399040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399040, "uuid": "b843d1d1-05a9-472d-aff5-e6ba111be51d", "comment": "Malware payload (Formbook)", "value": "f93a962e5c922b2612c99ea55f6faa56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399040, "uuid": "29be533f-6c39-41a2-acd8-11405e904aa4", "comment": "Malware payload (Formbook)", "value": "539d920211675f7cc535698b9223aae7d732e46d747bae86c00234e8b6dcb3ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399040, "uuid": "d6155232-db76-40cd-871e-10e773b79e5e", "comment": "Malware payload (Formbook)", "value": "77d22e4ebf723e5b80174cf3f7796f5d24521f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399040, "uuid": "5d5abc28-a9fe-41d6-bd18-8dd4111a414d", "comment": "Malware payload (Formbook)", "value": "64fba534b06cc3ce8ce233d46b2b0d3c4de563f53d6cb429b293e7a6f0c79d13c069e399d7d2d018907c3015f1fd6a08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399040, "uuid": "63ca7bf6-3672-4b68-b8bd-f0652d6b9efb", "value": "T16F54125EA0F8C4FBC7524FB36A3A9B56B7B54803101493AB5B50CB0D7967582DB0FB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399040, "uuid": "20ba56ff-f46f-4f3b-b2e4-2484d351c37c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399040, "uuid": "2cc8ef5f-ddae-4ee4-935c-77b3edf769e9", "value": "6144:/Ya67Am9qlOoGPPoXOI4WCdqccDunDfttsEW1X8AMUkDYDjfKIBVIjWo:/YRAmwlOZnoVccDunhWB1X80T/SGG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399040, "uuid": "1f9f5d17-d681-42c7-8788-ed6148d84510", "value": 290061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399040, "uuid": "f9c7b249-35a5-4044-b34f-e68cdbe9b681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399040, "uuid": "1a3265aa-b7c3-4ba0-b298-a949333cae52", "value": "CMC \u00d6deme Tablosu.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd14537-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676372110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372110, "uuid": "ca822f5e-8abf-4d8d-b51a-e314713c6c35", "comment": "Malware payload (RemcosRAT)", "value": "b94bc1f645591425fabed08234d668dd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372110, "uuid": "3075352f-5372-4491-bb51-a10caf5bfea7", "comment": "Malware payload (RemcosRAT)", "value": "53a35d0a8b95fb9a8d2bf146d1a25283ade24cf75df41328ff8336df06b218f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372110, "uuid": "9de820b7-3745-4af3-a950-0cc9e86a41ed", "comment": "Malware payload (RemcosRAT)", "value": "51175a0db51d96bffd758c9d8e195e684ecd308f", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372110, "uuid": "3456b451-158e-4a54-b0c0-3fa0dc228630", "comment": "Malware payload (RemcosRAT)", "value": "115c4a4f56fc18fd22bfaabf0721ea5fe3d476efff4e2b66df26acd24f387ca9990370ae70f1dc2960bcbb73f50b2e5a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372110, "uuid": "b9e95979-c1e9-4789-99c4-1a6657ae99dd", "value": "T127B423F5E39A28825F745E8CE050ACD17D95D091E094D98204E1FB44BCE83BCF1DE7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372110, "uuid": "2ad5ca3e-9bdd-49b5-b675-29086601a9fe", "value": "12288:+3i4qMgKzlG77X0L08baiYjxCR9VxHAHsFh7R3Il5EBkow6b:+3i4qC2A08Z+Wkah14l5EBkh6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372110, "uuid": "3e5f2bb0-d753-4f60-be3d-3a5bb9a7635c", "value": 501361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372110, "uuid": "6c1c2ae2-a021-4c98-b90d-bac100d2b9d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372110, "uuid": "10bb0c4d-4e16-4d29-9dca-963fd5ac91d2", "value": "doc 20230214004004000010100.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda9d7e1-acc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676418819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418819, "uuid": "536435a8-5315-4be4-ad3e-e8b7e6bb1baf", "comment": "Malware payload (RedLineStealer)", "value": "ab47bc4d86c98e4f63ee5d85a99b66e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418819, "uuid": "ebdfffeb-625d-436b-ace9-c98ef0df8af5", "comment": "Malware payload (RedLineStealer)", "value": "53b06ad950cb626caad751e6be90b71feaf86bb98fe683922ed2de5896b73df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418819, "uuid": "fb1a8bca-3a96-40cb-962b-7b7a9a8de53c", "comment": "Malware payload (RedLineStealer)", "value": "1aed785ad9f050d01dfdd8c194b32b1c9846736d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418819, "uuid": "95229bf0-3f40-4587-b646-ae5007b1730d", "comment": "Malware payload (RedLineStealer)", "value": "381723c1353b022c56167f207d227fb33d57b4ee035f8010edda1a107b707755ec6737792e164a70ddb41f9a32954c9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418819, "uuid": "50b5e4ca-e4d9-479e-bfb7-9e9e8dbb02a9", "value": "T17905124BEBECD423D8E1573048F312D306367E91AD38839B174B9E1E2872A54B635B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418819, "uuid": "afabd9e6-641d-49d7-bcc6-7c342a948771", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418819, "uuid": "fda2065d-020d-4e68-8a58-166cd3a938a3", "value": "12288:lMrsy9094tBh1QiVoAB2tBinRQGQD7ZweXKd41RRdJ2DS4YMWK0WjFt85DP4:ByiG8rinaLD1FdeKK0WjX894", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418819, "uuid": "aa1bf557-7231-44df-8ffc-ea05f31624fd", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418819, "uuid": "1d89dd7c-0af6-4ea1-b71f-e571a68f7757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418819, "uuid": "a76583b3-4ce0-4fc1-9498-8f423bf7c64a", "value": "ab47bc4d86c98e4f63ee5d85a99b66e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4bcfe83-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676399960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399960, "uuid": "09f582bd-4645-44af-823c-ff5850ed7270", "comment": "Malware payload (Smoke Loader)", "value": "6cf228753a605faa339ed5509a3a1b84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399960, "uuid": "5b59213e-d1d7-4afb-92b3-9eafd43a3001", "comment": "Malware payload (Smoke Loader)", "value": "5456903fe3382ca3a494aa5c2d626ddbc57ce8c977893d546ff5345df484bab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399960, "uuid": "57c89b58-7446-4761-80f6-37d1be01d96c", "comment": "Malware payload (Smoke Loader)", "value": "340fa64fb659c183a7d040514be806e51ed33abb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399960, "uuid": "6f0d39e6-922f-4f97-8581-5292388be6b2", "comment": "Malware payload (Smoke Loader)", "value": "2b82052e48bab400d4d83c2debbb6e76b39bd2dece65699e6a406afdd42dae460b9254df32234d8ea92d7627669bfca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399960, "uuid": "cb6b9472-c660-44b1-a41a-d6ac98981c62", "value": "T1E044E122F3A09472E46746318D2AD5F9793FF8225B7496CB23946B3F1EB03D18A76341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399960, "uuid": "8602e92f-f6ab-4294-8d3d-eb0bc473dc27", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399960, "uuid": "82c1e3c7-d462-4214-a07f-c636829a9735", "value": "3072:nJquja5z/maBdTt4Ocv7L0OuuUKNkK5HEUhk+rPkhdhuYBq7c8FV8z7:nH+/VfiOcvcuUKNXr7kUcaVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399960, "uuid": "0bb263f6-6811-498a-8499-1e71aa508dc2", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399960, "uuid": "338aeccf-4664-464f-ba5a-cf76523ba83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399960, "uuid": "609a75e5-0a80-4825-9101-0492c8eb0770", "value": "6cf228753a605faa339ed5509a3a1b84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5c4105-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676408693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408693, "uuid": "9c3cfe14-3f2d-4b83-aba4-fda27c99d3fa", "comment": "Malware payload (RedLineStealer)", "value": "10a0bcb137190dde474eacea2b36c98f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408693, "uuid": "af64b212-059b-42fa-bdaf-359838ecad2b", "comment": "Malware payload (RedLineStealer)", "value": "5465f68cae00f40317098dec592d37a647607b23dfc78c0807bd68de85961ab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408693, "uuid": "5f92a70d-6d35-450e-979d-79ba1d595c4a", "comment": "Malware payload (RedLineStealer)", "value": "4812ef4dfb617c759766d886ae6bd7006729a72e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408693, "uuid": "1ff92279-1125-4195-a32b-00669840a4eb", "comment": "Malware payload (RedLineStealer)", "value": "b313dc18b00dad5bd554b4674043f22490574c8c4bc4a79e09bbc62ea8fc2cdbc3390eb5233606c3de007758f520fdab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408693, "uuid": "7cad6f94-6505-4b9c-bc8c-ee14b02dce7b", "value": "T184251247F7E880B3E469137029F307D31A39BEA19F39934B664F596A1873270663136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408693, "uuid": "cd10feb9-86bf-4dca-8c13-85dc1ffc5aa0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408693, "uuid": "73ace823-d530-47e6-8712-4dede1a40cef", "value": "24576:xyRfi7mwAniZjZKDIam7ItsKYlgKwJ36Q6iObLb:kRa7jZjZVstY5wJ36pie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408693, "uuid": "f442bb1a-49d6-41cd-a25a-75e9f37e7b85", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408693, "uuid": "2ed5d2fb-e25a-4a8a-80f4-ac8da717cec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408693, "uuid": "7387967c-4cb1-4a0d-9fda-8cb470f3772e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e987ce-ac74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676385089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385089, "uuid": "2a390065-8e9b-4191-8074-65199d18ff82", "comment": "Malware payload (Amadey)", "value": "3d58b689b867491c223c5090667c0643", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385089, "uuid": "72c55307-c707-4c52-825f-4e4bc431b06c", "comment": "Malware payload (Amadey)", "value": "5485a1ee587bd96cdcaf3414f701499990f8a1da2d76f75ffa54300d008e522a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385089, "uuid": "d360f079-1185-4972-a850-cb90578a0d63", "comment": "Malware payload (Amadey)", "value": "14cf81286770731c69cc05f1710f3712aecc7656", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385089, "uuid": "0f26c53f-f25b-4ab7-bde5-da3dc2e98de9", "comment": "Malware payload (Amadey)", "value": "02ce6307c8b81ddd3bdba1c214468dced7b979eaa0d8c7512bf6bc8b87f676832a7bf9055e880c08b2521d791eed1c90", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385089, "uuid": "584142a5-3d8f-4af9-aff1-fabb5b77cf6a", "value": "T103F41207A7FC4021E5B5177059F302C317367EA1AA38975BA78EAC185C732A0EA7477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385089, "uuid": "62710947-7ed5-43aa-b2b7-a5203656fffb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385089, "uuid": "899f4959-05b5-4994-9644-74a6deccbcf6", "value": "12288:kMryy90xu5u9CUxFZfg43ZjvM20Ds84yOGjI4Fb4NPspYJ+TC255rT1fBgz1ha:Wy3agg1F0DsE+NPJADrRBo1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385089, "uuid": "33ff22c3-ee70-4927-b93e-9e6cdb3503b3", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385089, "uuid": "6a666da1-c865-419d-8442-9877fbe9f4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385089, "uuid": "7618ac0b-6838-4a55-8ac1-5c9d3d34163b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b76135-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676399394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399394, "uuid": "0a2346e3-43f2-4dea-98ad-b5072fc65719", "comment": "Malware payload (AgentTesla)", "value": "fed8c40adfabd39c2940308b4657da03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399394, "uuid": "342d37d9-994c-4581-be9b-ee29605fdd36", "comment": "Malware payload (AgentTesla)", "value": "54a7e0191d3c855394a316900d3a4c722c395ef1cdaea718ae4f7a7a709ff647", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399394, "uuid": "5878244c-5207-4b6d-b646-d606dbbd8478", "comment": "Malware payload (AgentTesla)", "value": "670c48df80340beafb4ccbf12276a6042bec191e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399394, "uuid": "01bf36f5-66a6-41fc-b879-764103e665c4", "comment": "Malware payload (AgentTesla)", "value": "9ad2f6dbee08d35c4c726502f34b4ad2b762472055fc92612559bf56ae09b844eeef39b3cc526b90f38ac731cef6f499", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399394, "uuid": "d70f2810-9417-4e10-a037-0b160af27f87", "value": "T1DAD46C8CC5BD4212EAFD0F7DB19F29480DA0044A266D5D3B97E7F880E17326A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399394, "uuid": "bd6f963f-48e3-46b1-b06b-2d57928cddb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399394, "uuid": "c11a7ff5-4626-4d96-a7e0-91253544a224", "value": "12288:QZecesuh6MnJWZ/ovSeKE2oPX48CRulSi3C:ncesw1Jwj5E2oP5CRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399394, "uuid": "28961c4b-c9c8-4d56-9734-0abb3e189703", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399394, "uuid": "7f06e405-eb87-4a88-a45c-f890fbac78c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399394, "uuid": "68e371ec-28cf-4a4f-9a75-baf405d82f3b", "value": "fed8c40adfabd39c2940308b4657da03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c735d036-acc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676418378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418378, "uuid": "b27f1a6b-fbfd-4e3f-9fa7-c5deb2621a32", "comment": "Malware payload (Amadey)", "value": "ce8e84e92998d13ad0252cf6c65a7ade", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418378, "uuid": "48d048ca-bd09-4549-8770-bb327f438648", "comment": "Malware payload (Amadey)", "value": "551110bbdb28c8633e7aa9745497f5ddc60e068a19c2a4ab493f4102e3917d55", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418378, "uuid": "65bde461-51a6-4316-87ae-1c8d2789d4b3", "comment": "Malware payload (Amadey)", "value": "f109bb624a6ecf63b014d8c936d37d57bb195118", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418378, "uuid": "2b24b900-7303-4e18-900b-216ca5552842", "comment": "Malware payload (Amadey)", "value": "e9d1a33b1015e5e6eb9a21729751b6f9ff9c6d5a9e508bf20bf9590e759477c5b5dd3c6059ee11e1272f52d11742e94c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418378, "uuid": "2d6bb8c5-3a24-4359-a143-1d92e8a4639f", "value": "T1D725124BFBEC8062F835573408F707C309377D505A38C66B338EAE692D6266466717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418378, "uuid": "ea9bab79-4610-47c3-b2bc-7c47bec2f1d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418378, "uuid": "ff89d039-c4f5-4d3b-99a7-037375df7943", "value": "24576:RyKzVX/eqj095mzJA5qKNW6maBcmrQQE4RlV:EER/eEo5UqpfLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418378, "uuid": "e9ae896a-f804-4412-9edc-8aaeaaf03ba4", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418378, "uuid": "daa3321b-b256-412e-b7f2-cdb113276294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418378, "uuid": "aef0b463-4c0b-446c-90ff-1d6709ed2a42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5640fb2-ac8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676396095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396095, "uuid": "e1d02b7d-f53f-4cb5-b237-d39be11a7158", "comment": "Malware payload (RedLineStealer)", "value": "4273b55f525547873c4924e50cf82222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396095, "uuid": "9e3ee2d4-5028-45ba-836b-eda5080a2683", "comment": "Malware payload (RedLineStealer)", "value": "554b8804832b6d3c12905210c996dc87a73d0e123ac621b67b800adaccb30b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396095, "uuid": "009ae98d-1e28-474a-8bbe-cbfd6b093c7d", "comment": "Malware payload (RedLineStealer)", "value": "2beac19a5447555a5df4a5ad0baaf1c23e509a1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396095, "uuid": "2e38bbf1-a58d-4e46-9003-51ac016346f0", "comment": "Malware payload (RedLineStealer)", "value": "86228c2dc0ba033c5ad809cd9feb8d98a4ac1f867229de57c8ccf6b7779274c936dd0f4e5c5764ac85e811f1a5aedebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396095, "uuid": "26a090a2-7765-4e1c-b3d9-9bd2080e9ed7", "value": "T136F4124BEBE88072E970A7701CF603D32D327DA00A34879B664F9C6D0872675B27975B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396095, "uuid": "fb193cd0-4224-4347-9c86-250c3ffa1e53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396095, "uuid": "00478024-1c20-4a7e-9f4e-2d1fa648c8f1", "value": "12288:WMrOy90ygjqABq1eBbHBLEwKdkDJd+1iF24u8V6EjsdiCEtv7E/Xb2:oyMqABqKTVEp+Jd+1Gu8V6EjsdiC6v7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676396095, "uuid": "89da8205-f39b-4a55-8707-1d70034599c6", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676396095, "uuid": "d479902f-9bb3-405a-8df2-29d653e1260d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396095, "uuid": "42b779b3-d4ae-4276-a944-a7b130d09a9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4a2d3e-ac8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676396649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396649, "uuid": "9a2cbcff-efa6-45f0-b6c7-020d179d517d", "comment": "Malware payload (RedLineStealer)", "value": "7f5a1dd9c365bb9852142217d4a5bdc9", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-trust", "colour": "#0AAC27", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396649, "uuid": "bb99d069-e040-43ca-884a-b1e5942a9ca6", "comment": "Malware payload (RedLineStealer)", "value": "556b5bceecd77e3e76536d8061c6c85bd2977cf8e73154afee3867d804e7decb", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-trust", "colour": "#0AAC27", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396649, "uuid": "405925b6-78b9-4a71-9e68-0a03fb420c08", "comment": "Malware payload (RedLineStealer)", "value": "d342019d4695c8f0cf5d5b907703832bd96476b7", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-trust", "colour": "#0AAC27", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396649, "uuid": "d619a0b3-834a-442b-b1c7-5176599792cc", "comment": "Malware payload (RedLineStealer)", "value": "a8aa167a66e8df16341b1eb2661924a6c7f47d79ed43217efd390928be908588f201df904deedf684debe8e3c4f93414", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-trust", "colour": "#0AAC27", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396649, "uuid": "29229ff3-7482-4346-bd18-0d3fdc25bb1a", "value": "T1E876334D1FC0430FB35C2FCE9E045F7BEC94DDDE6AB22CA376619AA36A458951DC0A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396649, "uuid": "72a6d895-8506-4313-879e-b96dd87ea924", "value": "196608:jMV/JIEKnF8faLqpcYjmAW64qJRxFIoFcovjEYSH:Q5KnIaLE3xB3x1eovglH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676396649, "uuid": "059694c1-b094-4b42-a0ed-7d4359b41d52", "value": 7168542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676396649, "uuid": "f42ab9fb-9b3e-4f96-8a93-8ba3b5512ea1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396649, "uuid": "265fdc57-a69b-4717-9adb-bbf4776e21c7", "value": "KID.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e197bfe-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kovter)", "timestamp": 1676350637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350637, "uuid": "75e1f710-d5f4-4476-8b2d-106c87fc0bd8", "comment": "Malware payload (Kovter)", "value": "8671949e88bc1ea76daf4fe896eb4c63", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350637, "uuid": "645d65c8-4e03-48d1-8518-6edf4ff3078d", "comment": "Malware payload (Kovter)", "value": "55754358ddd26b3c56ca27780dcc408711f8a9fc42b1c9d305d1045146f40f1c", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350637, "uuid": "9f8c27b8-033f-4c39-b9e7-7ea462138452", "comment": "Malware payload (Kovter)", "value": "be4aaeee532c884086bed8d93cf0118ea0869042", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350637, "uuid": "9f02355d-f6d4-4fe1-92e9-b2c5f41b3dc9", "comment": "Malware payload (Kovter)", "value": "63fc77e30be80aeeed7bf859f46c7ed0947ef29c755f2af17ae570265907d7ee1f4fa300e0514935baec2356c34113fb", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350637, "uuid": "50504ee2-44ce-4ce8-85b6-1a751f9b2182", "value": "T14E455A39F640D537D42518BC9E0FE2D5A579F2302E381957BAE51F4C88F92836E2BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350637, "uuid": "7deadb04-b898-46e8-ac89-50a650b3f715", "value": "12288:ZuSBJp7R7ns6RPHCAjP1CenKui47xLHGKdFPH3h/H6U7W:ZuQJlRo6BHLj8eKuiIxLmKPPH3paUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350637, "uuid": "2635e15e-e0b8-4c56-902b-67dd4e1a2a8e", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350637, "uuid": "7c176cdf-5ef3-4760-8890-3e75c1e2c598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350637, "uuid": "52669113-af08-4e5f-9b64-71316313592d", "value": "2023-02-12_8671949e88bc1ea76daf4fe896eb4c63_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a00ee3b-ac53-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676370843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370843, "uuid": "ea09903d-640c-49d6-843e-6d021172e2ee", "comment": "Malware payload (RedLineStealer)", "value": "2e9d8fd1ceab10a6db6fff22bffdc105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370843, "uuid": "66fad3e8-0dff-4db9-ae95-0147ccdd9669", "comment": "Malware payload (RedLineStealer)", "value": "55886c6ca1f919306f9fb917482d230f8485b394ec997e8c94de7430453ca27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370843, "uuid": "09e48ba0-dfd2-41d8-8372-375f50e51006", "comment": "Malware payload (RedLineStealer)", "value": "ae5e69ef5d777809ca93176a9a64fef525db7407", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370843, "uuid": "8986b797-d8f2-4ade-b29e-48b5db09d318", "comment": "Malware payload (RedLineStealer)", "value": "e8a73fa1b3f078fae7c50633ca2b4fb680c8de0942776b439f7780236f1ef7d6a3c0003c5fce393ae422d9004f58bb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370843, "uuid": "95393852-a885-41c8-85f2-bb42074f7dee", "value": "T10F75BA37E758E5ECF7BDCCB7203868110A99E82FF05E58B919D6F15F0E62B270A46106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370843, "uuid": "50d3adbb-6aad-4620-b0f3-e524d76653d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370843, "uuid": "acfc52c1-9101-4dd0-ab3c-cddb800abc57", "value": "24576:fnUverXwQUCHazvUGKVmklx9m+ZtUqUOCUbUUZUeUwUNUqUGUpUVUFUYU5UYU/Uu:fUverX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370843, "uuid": "68833b6a-eefd-4754-8956-2d0705ebec42", "value": 1593472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370843, "uuid": "2233b842-f570-4dd6-86f5-eee73a23878b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370843, "uuid": "c140bd05-4d18-4efd-a331-4ef76636fa02", "value": "misshas_document_contract_promoutins.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c161034-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676381289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381289, "uuid": "e775494b-1e73-4cfb-a830-ee59f3c2a415", "comment": "Malware payload", "value": "6467594d22c1832c49a9f0974cc94474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381289, "uuid": "698ac965-49a4-4808-b297-28c2f15e848b", "comment": "Malware payload", "value": "55a81dfc94ee6f6ddfa489e703421e90aa91a9825f8edefbcccea454dbd7c3ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381289, "uuid": "7e1d2fe5-33c7-41d2-9834-dd5d86cefd3b", "comment": "Malware payload", "value": "bf7357bb5c28a11c46a7cb14e736558c12f9e2bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381289, "uuid": "f6da12bb-137f-4098-9fc4-773a3b5307e9", "comment": "Malware payload", "value": "9c5191ba39ff13dcaf906bd31c22d83eab21fdaccb8578864d55978a6321b3b1a2b4c539845c7a7a9dead8522c9ca474", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381289, "uuid": "5928d111-c326-443a-a530-6655d06c21aa", "value": "T18B649E1133E1C83BD5A311334E53C799B6B6BE51AD36424B77D03B0EAE70182DA39B5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381289, "uuid": "450f9092-2393-472a-be1d-9d052991fda7", "value": "bf60666e24b254e53946b3d3f367089f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381289, "uuid": "9669a00c-80f2-4320-a4eb-44cafc0f744f", "value": "6144:IviyYPpr8AE0W0H2Xe1L8AAXb25160uYR+ktEPD:Ivh0W0WX8L8TXO60uYRDEPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381289, "uuid": "8ffa90ba-da8f-4dd3-b357-8d651166cc0c", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381289, "uuid": "5beccfc5-f555-4216-9f5f-dd0ec1abec84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381289, "uuid": "cd34425f-1108-4dda-a809-7cf1311948e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e6def9-ac15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676344239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344239, "uuid": "39992100-f4bb-44fc-b089-52488c434921", "comment": "Malware payload (Amadey)", "value": "f67ea7a9fbca756653524ae36a6d9541", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344239, "uuid": "1d9f6049-344d-4d08-92a5-c310a27f5d48", "comment": "Malware payload (Amadey)", "value": "55ad067f656a7eafbba511509fc1edff69c40069250fe68c022e0afa2f491cf2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344239, "uuid": "be0d3b13-d8bd-4cef-b611-a2ec1692319f", "comment": "Malware payload (Amadey)", "value": "ffc55f1cf7867cf9db4cf26e3e232814c92474e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344239, "uuid": "bf6d46af-601e-495f-ad47-87eac3df8e80", "comment": "Malware payload (Amadey)", "value": "6645831dd076997dd6ae5a30bebf2256159d972d43e39becc2cb4a0b4625a402f42526d2f38566c5d745ead094d4bffd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344239, "uuid": "aaba1d82-3a0d-41cd-ace7-b1ee843e6379", "value": "T1D2F41207BBFC4072D8B19B3019F642C30A33BE516F388267674EA95A5C722B4B539767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344239, "uuid": "52da3fcd-ad17-46ae-a8fe-fb646b9e6642", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344239, "uuid": "be86c063-638c-4247-9561-15cbb95f2b21", "value": "12288:tMrjy90jHWvvsuMY2V+LKlte+ybqJ5HeFOlMx/O2vvUHbaFN4zcLVyC89z2PtAuZ:CyW2ns7jVk8kzqJdG28/vnGb5zcLYr9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676344239, "uuid": "f18bad3c-53d2-4a56-aa51-87b9daffeb28", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676344239, "uuid": "06e705f7-af87-429f-8275-03d884be3732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344239, "uuid": "1f3c6734-cebf-4f6e-80d4-d7e06e99fb5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced1b7c7-ac54-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676371576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371576, "uuid": "673490b2-e9ec-4c3e-89d2-c0aa47031f2e", "comment": "Malware payload (RedLineStealer)", "value": "f106aefb7b2998029a49f9cec7b0ef03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371576, "uuid": "f0ef632f-4ba5-4530-9f83-19fc9db7b1b6", "comment": "Malware payload (RedLineStealer)", "value": "55ec2897787b708706ba51d69b38d2bd240eeefcf0e477eb516ab2f6136a6795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371576, "uuid": "af61fc86-4ad6-4698-801e-970137fb5bfc", "comment": "Malware payload (RedLineStealer)", "value": "5d761484523b7f8c19d762dc8b17b2b9ee2d495a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371576, "uuid": "6221830a-9378-49af-a66b-d2a5971f08c9", "comment": "Malware payload (RedLineStealer)", "value": "4ac7b27fb886f6e0f29075093b13000ccae6b18000e78cfd663bcf6d62780bf7fc5377381cdfb0208141121348eb3df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371576, "uuid": "2c05743c-6b4c-4386-b498-077d9f1eeb16", "value": "T1BDA40257F7FC9072E8B557B018F603D31A367C906A74879B628FAC4E0872560A63277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371576, "uuid": "13ba7bc8-6466-40ee-83c2-8779f73c6286", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371576, "uuid": "29f913e8-953e-4661-a2b3-072a8d8a13c1", "value": "12288:VMrGy90VxBKeVqnj9azQfOhIbWfTEakS:ny0xBpVyRazRhIbrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371576, "uuid": "a5b3d1e6-c399-46fb-a82f-a435a748dcca", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371576, "uuid": "91ed409a-42ed-47ea-867a-5ccef4e6920b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371576, "uuid": "cad2745e-14ba-482c-a527-55d7ecf07f1f", "value": "f106aefb7b2998029a49f9cec7b0ef03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c649dc96-ac60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676376716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376716, "uuid": "fc5d5bc5-fb56-4970-8796-2c0e5f73735e", "comment": "Malware payload (RedLineStealer)", "value": "71ea8b14c4dc3c2f0e8eaf248dfcab49", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376716, "uuid": "63992d1b-9918-458f-a0bb-5adf10cf497a", "comment": "Malware payload (RedLineStealer)", "value": "5622de07e19f716902218eef8ee58cb97fa861175527b13b651cbd221427e8fb", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376716, "uuid": "0f828496-d070-4f4f-94dc-f5255b8e820a", "comment": "Malware payload (RedLineStealer)", "value": "c191508e843a49c164f1982783cdeb0e5e47b1a7", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376716, "uuid": "b35b4121-b021-409c-926b-8125a48059e0", "comment": "Malware payload (RedLineStealer)", "value": "555063b9287ca2937bb224e9fad9c4404e44421e5aa2e5b9b9b00d276ef6514e4ebc681eec9702a8c1c0e7c7d79dfd0e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376716, "uuid": "7ea1c008-4036-47a1-a2a1-2064380d2d07", "value": "T1B13623643B5CCBEE91C1E5559A72E84C7A24BE7F4809B6ABB6865FDF078C901FC43021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376716, "uuid": "9a7a0eb0-c43e-43f5-9a7c-daf64cdbea5c", "value": "98304:CLIuMQmJx/d0qYLm0pt2i2A8vlpwS4z68LSDWAK8dsbAfnKSOF/fyyFSVTqGhlWD:CLlDOYLFiA8vlp14z6zqwdHiSOF3yEOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376716, "uuid": "e4fdc615-ca5d-4873-b57c-c06208b57742", "value": 4917241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376716, "uuid": "a6089cb5-f1fd-4da3-887d-e53fde4f60b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376716, "uuid": "8aab13f7-b7f7-42b7-aac4-6cd699cc624a", "value": "Install.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f620e8-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399826, "uuid": "e007367e-a7b8-4b15-aec9-122b3ffd491f", "comment": "Malware payload (RedLineStealer)", "value": "40da49b9d654229fa82a2c8aae96dca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399826, "uuid": "7fd5ec00-4b5f-4e34-9dba-8ce9b8a957fb", "comment": "Malware payload (RedLineStealer)", "value": "564860f03614ce16f2045bad5c41d60e96c0b71716c69bf12eb5d11dea839e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399826, "uuid": "1e6daabf-d1eb-4b37-833c-318bc45b32e0", "comment": "Malware payload (RedLineStealer)", "value": "61c76133639533c2f9789fdb58221e3220bda1b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399826, "uuid": "6b74f7b0-bb53-43f9-8b82-b5724575fefc", "comment": "Malware payload (RedLineStealer)", "value": "c2e3be54dff7227ed935611a47065518dc1335a55411348f388f3867e1b3c48e9eecf2a18887e3ee69f396b5252cf72e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399826, "uuid": "91b36180-8a64-422a-acd5-fae36c2bf29a", "value": "T1DDF41207E7EC9876D4B067B068F603D31A367D616A3CC29B174BAC6A2C73661B53035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399826, "uuid": "94848b05-f9c2-43d0-9a30-cb72550a7a0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399826, "uuid": "246d973b-b740-4c60-91cf-3db9e02a4910", "value": "12288:bMrFy90yzGiN2dOFzNFjyarCKq/884kiIPaqY/WJsWwen0aGrE8Fijoy4:uyk6uOFz3yarCR/884kiIiBeJsWjl6EM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399826, "uuid": "0ae0255a-567c-458e-8a1b-5131d4b98f97", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399826, "uuid": "66f6db9e-4cc0-40c6-9c35-3bc5ec677254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399826, "uuid": "107b3a6f-6971-48ae-b6ab-3f1586e08c74", "value": "40da49b9d654229fa82a2c8aae96dca7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23c64f7-ac30-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676356093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356093, "uuid": "b6b2cec3-7ed5-4f8f-a9f7-08956a7f5a14", "comment": "Malware payload (Loki)", "value": "d2e73fea888d8211ad76f41abfda425c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356093, "uuid": "c680b56f-f49e-4fec-8a8f-25f4b1621b5f", "comment": "Malware payload (Loki)", "value": "568992d76d78888f7c3cd7f0253328b4c806c08d3604991b4c1983b30914ad66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356093, "uuid": "fd65b296-eaa9-4d76-8e82-ffd10c88e455", "comment": "Malware payload (Loki)", "value": "b744803db1bb619782e0d366ff887add6b5277a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356093, "uuid": "b3d7bcdd-9375-409e-ba08-ff6684d67e20", "comment": "Malware payload (Loki)", "value": "c8023f9707f048f5eefd895e4041526ea2a163cf7cc40aa8614131ff5729ed0e30e124569a51145f18e37513ddc0b8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356093, "uuid": "cc75bf9d-2441-47e1-b490-1637f782b271", "value": "T179A4125972761397C7FD8FFA2DA4A1860331336A7923E64F4C8A24CC1A5BB025641BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356093, "uuid": "855d224e-4cff-4d1c-ab3d-b7d52feb6bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356093, "uuid": "b48b46fc-4d83-4dfd-98b4-bbd47ceccfae", "value": "6144:bepDFF4oD6A8weJbCYlrz35YJoBtWZILW4tVkVKS5X0stYQUN6xJEI+KXM+bCMau:qFFZ6Xxv35YPO0VKSFa7NSjzLaHUDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676356093, "uuid": "76daf6d3-592c-41e4-92c3-0e277656fdc8", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676356093, "uuid": "1771c0e3-f7cd-4b82-8d78-e721b19098c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356093, "uuid": "9134a524-2c9f-4243-9e31-dda2bc85723e", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.25379.930.2120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d2f686-acbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676415657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415657, "uuid": "248a5d0a-dbbf-411b-9f9d-66e16e81032a", "comment": "Malware payload (GCleaner)", "value": "1efeef15b13742f434d3ba82c113e9ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415657, "uuid": "195c38c5-cf5f-4934-b181-d30b7165883b", "comment": "Malware payload (GCleaner)", "value": "56b9e36dbf915d7e622362666f5e4bd694b6d5d5585affb303a5c5ce188f1c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415657, "uuid": "6a8f105b-f93e-4769-8fb6-2c1ac0d0bf7b", "comment": "Malware payload (GCleaner)", "value": "9840c8f118baa8bdb02e9d54eba60478fd2971aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415657, "uuid": "608254d2-efb3-4411-8002-068be7b22b81", "comment": "Malware payload (GCleaner)", "value": "68315f07e5d64901b41a6c4c0cf67e4487e7faef786561cc2ed6181c8a3f43c5c5e51262e570c77428ea3c30ebc559a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415657, "uuid": "3af3e4d6-10c3-4d00-8a4a-17c756110fd9", "value": "T1F1E5127C7589C5ADC684FEB88D3AE5E31CD66EE3E8E4902270C83E3F667D1845A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415657, "uuid": "959e4f49-2cd9-4909-90db-2762da4de3d4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415657, "uuid": "34630685-ba5e-4c59-91b8-f0a3a820b4b0", "value": "49152:rdHGOqcKAR/QTuRQ8DVAzxwSanQo3xT6QCTZztNfOGCGTYe0+YsjMwnLCgv2MR:JHGOmGO8ZQxwhQo3xixbVTFgAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676415657, "uuid": "a3eba53e-9e3a-45e5-bd9c-af20da5229fc", "value": 3193203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676415657, "uuid": "02dacae7-a57d-40ff-b19a-2fe3306b34ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415657, "uuid": "44447419-3e12-46b6-98a2-8391112adad7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d921909a-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676399081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399081, "uuid": "371cb838-89e0-4257-9123-5ef820cf6825", "comment": "Malware payload (Mekotio)", "value": "8f675ae0527093724c07edf26659a6f4", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399081, "uuid": "04122925-fe55-4d3d-a84b-1f2b2a1614d2", "comment": "Malware payload (Mekotio)", "value": "56c3d1b1cf857948ea902f3dec47b29a7c84905d1533d26c1b11175a6c828649", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399081, "uuid": "3ff5645f-9657-43d1-b736-5fffba6dbc3e", "comment": "Malware payload (Mekotio)", "value": "1c266b914a1dcd40fa2063f31575d169bdbffe31", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399081, "uuid": "42acd635-e369-4722-b299-65da6294e12e", "comment": "Malware payload (Mekotio)", "value": "7a7e95e929fbf11c953c2d5f73dc7d197cd6b05a05cf5a4d4ad1fe7ecac7cbf471fcfbda9eca30cac93b6daedc302ca9", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399081, "uuid": "2b8884ef-060d-498e-8b86-8692d206bb36", "value": "T1BF96232372968122E1FEC67D0E27BEE620F627294372507BB5941ECF31E27D056E2953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399081, "uuid": "a769e79f-0781-4c1c-ac84-bd38835b3ab0", "value": "196608:ZssmTbjbV7bsHn2HA3Ydwx8OAWYdrQg2PbSh+xk:ZssmTjFbsWg35HYdUgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399081, "uuid": "caf9a593-52e0-408f-a7cd-f14d498d9c2d", "value": 8952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399081, "uuid": "d915a137-777a-4531-861b-f5df79d27a2a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399081, "uuid": "aa3cce8c-da78-437d-82fa-cdf739284d30", "value": "FACT63eb9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436b7009-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676382509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382509, "uuid": "c1c8a9ea-7e3e-4cd0-94aa-bbd4146606d5", "comment": "Malware payload (Formbook)", "value": "30d8c6b25f21dd61e4b9f3bf19cb9a79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382509, "uuid": "b552bc6a-bc3a-468b-9f78-abe22da62348", "comment": "Malware payload (Formbook)", "value": "576e3168405699f48e603e3d52162c5b63e1a881c27ac2f8436d3c5a9639df6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382509, "uuid": "01d22215-dafb-4d64-9bbd-e20d3169ada3", "comment": "Malware payload (Formbook)", "value": "95ceef5d8507d51403c9b6247dad8e7d10239837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382509, "uuid": "9dd43935-0593-4c19-8149-f8fe811cb212", "comment": "Malware payload (Formbook)", "value": "2f79f1d0211f86376e7c90be105b3aefab0e944814e6e058a71c91feeb16f89da586aaaab41ceb308eef4e135b0d9aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382509, "uuid": "a3b7d3c3-b556-4805-96f2-063e1de94b89", "value": "T1B1D4230867D4C4DFC9E306B21FFB29547FF5BD662025625A67B81E8B7831646EC0A233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382509, "uuid": "4e6ca94d-6713-45ad-bbb1-c3698f502158", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382509, "uuid": "b614dd70-9bf1-4225-8d13-bc32b7ec09de", "value": "12288:PYkwlnkqhqOqj9TDzuvhaG1u5rpX/7dYaXKSZh9JDPnaditPvla0iOIGapQKJx:PYkwlnkPx0+JyirL9Ta0IvlJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382509, "uuid": "d32ce2e8-b761-4bb6-b7d0-014eb6cba65f", "value": 641767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382509, "uuid": "5ea70463-b369-48e8-b69b-fae95785228e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382509, "uuid": "da6cdfc7-f7f3-4756-985d-b5fe726f0b18", "value": "LZR-VAT. VATIKA - LZR-VAT-001 2023e-I003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d106a3ba-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392625, "uuid": "61d1215f-6dd6-47d6-a8b5-cc755c5e694f", "comment": "Malware payload (SnakeKeylogger)", "value": "ab641301bffe48e4b6889215a48ab110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392625, "uuid": "591e898c-9305-4990-b8a7-eb51e774df5d", "comment": "Malware payload (SnakeKeylogger)", "value": "581c551c6629325cd764cdb54c101d3cca9150e1d22d16149d721b8e4da20e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392625, "uuid": "4560b107-c7d8-4c0e-b701-9e66b4446fdb", "comment": "Malware payload (SnakeKeylogger)", "value": "326067321c6cd671e1ed168dbf6896c8d1e1e439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392625, "uuid": "34449cd3-e0e9-44be-aef1-e2275b04bf91", "comment": "Malware payload (SnakeKeylogger)", "value": "6b9b389810b2fb1faf9415957eaec22e0a1c18e56019e1dc3d678cae22a53cc6ee781a85e37338d736050ffe127060a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392625, "uuid": "c3607808-33f7-47e2-a455-638b05acfb36", "value": "T103C45B8DC5BD4212EAFD0F3DB19F29481DA0044A266D4D7B97E7F880E17322AB07E65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392625, "uuid": "8e1eb943-45c9-45c3-b100-39b04df50618", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392625, "uuid": "272dea4b-b3ab-4faa-aed6-1a191a5a3d6d", "value": "12288:ihecesvd5w6g9jTbi4ktONwGw9mJ7HcFk:9cesvdzyXm4alm7H6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392625, "uuid": "2d0845c0-f171-4a61-903a-980b4a6b47fb", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392625, "uuid": "fee75311-a237-4461-89f9-548841d60cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392625, "uuid": "56000799-3e5a-4ff0-befd-72fcb850d246", "value": "UMZCZFCHdPwwNmS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90615c7a-acbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676417427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417427, "uuid": "2da0c883-7532-4126-af87-582f0dcc8061", "comment": "Malware payload (RedLineStealer)", "value": "b3118474951a230fdd66cc6f58931d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417427, "uuid": "c65200be-671d-494c-94ba-9fd24c833e82", "comment": "Malware payload (RedLineStealer)", "value": "5848db1fc3cae274e61b861f34914532aa48ae266dbe72b4b780abd4397f5626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417427, "uuid": "85f60ab6-2012-42d1-a622-113537742db3", "comment": "Malware payload (RedLineStealer)", "value": "0852722b0498fe3294e4d47291c156ad9ed37529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417427, "uuid": "fc911be6-7d0c-4138-b2ee-a87813c27714", "comment": "Malware payload (RedLineStealer)", "value": "861263e31c81276953fe7ebd1fd53a628223e0da30a5b70851c991360739d2f67c18e5d86f87020e9e12fbbc2ea8db95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417427, "uuid": "75b1ca05-d2fe-4197-beb1-213a801804b8", "value": "T1D725234B96E8C066D5B5173018FB02D3173ABFA0567C539B335F686A1C632649332BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417427, "uuid": "19164d98-0d64-4ef7-b094-5048f56b6a18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417427, "uuid": "c869904c-a886-4cae-baff-d35ac18a739c", "value": "24576:Xyyx19Mv6iBjQ6+1W4T5K0WFBAypjVv96uc:iSUD9+1WnrAy1996", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417427, "uuid": "d008f1fa-0947-4bb1-9085-f47e7aa77d7a", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417427, "uuid": "99bb2fbd-1c36-4fb2-952f-d21e82b0bdbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417427, "uuid": "d4bea12e-7da2-4366-b776-4cdf57315d99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7231d6-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kovter)", "timestamp": 1676350634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350634, "uuid": "e45eb9b6-6f5f-4363-a75c-f49b32c618ae", "comment": "Malware payload (Kovter)", "value": "7dff7785bb3ce66af440677c9594b4c2", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350634, "uuid": "a14fe38d-ac30-42c9-b268-5f592c4725cb", "comment": "Malware payload (Kovter)", "value": "58bb3b8b3e4443d5edb01042ada8e7ef38144ce9c5d4e96ce2f0de5a50a9853c", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350634, "uuid": "cfd4da88-a376-4e87-9783-4f008072c6be", "comment": "Malware payload (Kovter)", "value": "04703670d9acbb4d3633ed6e8542fe13ef63cebf", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350634, "uuid": "b9ad89b2-b488-48a2-9aff-635dfa663942", "comment": "Malware payload (Kovter)", "value": "2beeb6b7de4a350c3b5cd43a0962d66e25c2b68167da3a5e157981e13d6511731d4d5ae3b044a4c85e65aa4164c10b7f", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350634, "uuid": "877295b3-e75e-4806-979c-d2a2581fc715", "value": "T1F9454A39F640E537D42518BCDE1FE2D5A179B2302E381917B6E51F4C98F92836E2BA43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350634, "uuid": "4afbaf3d-352a-412b-88be-b267fccf0d0d", "value": "12288:b4j6PWHIFXWJQvxuHyivzQui47xLHGKdFPH3h/H6U7W:b4mPMeGmvxyZvMuiIxLmKPPH3paUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350634, "uuid": "a7f7239e-a6c4-4e02-aa0f-50cd59c9abde", "value": 1204224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350634, "uuid": "7f1342ae-5d78-4ff8-8f9e-03f45de24c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350634, "uuid": "3e84d27a-346f-4b3b-a9d4-7e3e4cb51f59", "value": "2023-02-11_7dff7785bb3ce66af440677c9594b4c2_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16ed62b-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676407578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407578, "uuid": "4eb8368b-1f45-4684-a20d-a9c24817ba7b", "comment": "Malware payload", "value": "142e8b3bfd4ec11f9bb7c422e55d65c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407578, "uuid": "db169447-805f-4ecb-b344-a0828824d1b7", "comment": "Malware payload", "value": "58db6b8b6c1d41d48f8d4489a6fffc52787263f3f237ec08c9a1f8f529eeb62a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407578, "uuid": "1f4f7274-c347-431e-9bb9-982f8fceca07", "comment": "Malware payload", "value": "5c0946c663891c47064253165683da8edee34268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407578, "uuid": "7c95a1d7-3021-499b-aefa-c71c2c662950", "comment": "Malware payload", "value": "f0d622b49f5936075c156f53122fd073c91606cab4785c5100f521d15e1d08ad8e92354ff81f0aa6176675ae6dc31f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407578, "uuid": "ed4b13a1-7915-4c4b-afcf-e47867ff9bef", "value": "T130242231BC16E213D497FFB99EE5BE56E668F6C30F81920362A0206E4DF5599341FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407578, "uuid": "a47d5c79-4a0e-4a0a-9f19-4bbe03834cdf", "value": "3072:fhbHTVemd3uEyvFR44tkbEKSMG8T5uJmvl0KCNoaseX:ZDTVemByvU4GoYOmvl0KCNoaseX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407578, "uuid": "2b5ff705-c33c-49b2-9a65-5ae30dd2822e", "value": 217135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407578, "uuid": "7cfe8f63-e462-4e1e-aae9-005d27f9841c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407578, "uuid": "42e4fe28-c202-400e-9b68-5bd054a54a03", "value": "142e8b3bfd4ec11f9bb7c422e55d65c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0615632c-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364367, "uuid": "6e654da0-d613-4456-9bcd-24977f1de880", "comment": "Malware payload (RedLineStealer)", "value": "e606885fcf2b9df3a2675157252ed406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364367, "uuid": "a59263a5-7746-42b8-b16f-0d74f9579fc2", "comment": "Malware payload (RedLineStealer)", "value": "5960de39a5c99b774aad2ae885bd88f4ca72a8039cd914b97d124b249d13a5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364367, "uuid": "3c2b844f-b87e-47bd-a32e-8b1d92d95977", "comment": "Malware payload (RedLineStealer)", "value": "ec436a7472ab53eb95ac6ac50e30d8b87fe761ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364367, "uuid": "c7b9904a-9f62-4eff-b92e-5533156a36d8", "comment": "Malware payload (RedLineStealer)", "value": "03d3564ff476b603f74d61a15e1e0ddfc47573aced83964bb96a8a0e676faf389f9bd488dc61399ef5e391ea034119f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364367, "uuid": "3cbc4def-c336-4483-86b4-383023510e7c", "value": "T1AAF41203F6E88132EC79577024F343D31A36FDA06A748287634A6D5B1AB36A4677533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364367, "uuid": "06725206-beb5-4b60-8ceb-be49e6a3da17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364367, "uuid": "977236ac-7553-40a5-9f6c-5c0d23595891", "value": "12288:AMrHy90Bmo6CK8VAC4IgAavDhuJGtAz7v93soS3e8i7vyO:3yMmk5V4IgAavDhKbB7ce8ieO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364367, "uuid": "8cdf08e2-d865-4023-9692-4817ffb5aba6", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364367, "uuid": "500f7701-267d-423a-8c69-dc4e87544a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364367, "uuid": "52042b4a-08ca-45d8-b6ce-9637a298c666", "value": "e606885fcf2b9df3a2675157252ed406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dbb002-ac02-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676336092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336092, "uuid": "04e5a425-bc8c-4a60-8d31-c630ad084d3a", "comment": "Malware payload", "value": "fbdcee7e00cb64d9446d7074014a783e", "object_relation": "md5", "Tag": [ { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336092, "uuid": "17135a27-2cf7-496e-93e0-cc9a4b5542f5", "comment": "Malware payload", "value": "597c492a5af56d935d360fcfd2c1e89928dde492c86975f2c5cc33ec90b042ce", "object_relation": "sha256", "Tag": [ { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336092, "uuid": "3f40693f-2152-4a8f-a83d-6cd9e1cd1605", "comment": "Malware payload", "value": "b7804d36820ee82a0946504976520b7b331e7ca3", "object_relation": "sha1", "Tag": [ { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336092, "uuid": "0ee40264-7fe6-43ec-b1f3-3b4f39f70e6d", "comment": "Malware payload", "value": "73c926321307d6531b8119f4718927f23aa9dd3b0ab63e2efdea5ea0b21a4886bbdcccd30bd5472b2355b75a6565c309", "object_relation": "sha3-384", "Tag": [ { "name": "BianLian", "colour": "#F4DD08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336092, "uuid": "3650eb53-daa1-4fc7-86da-ed2e0eaad98a", "value": "T1F7062907F89581E8C0AAD234CA669253BB617C881B3027D32F54F7B82F76BD45E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336092, "uuid": "80e3df72-b561-40cf-955d-9b4cb1ccf13c", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336092, "uuid": "bde3bf15-f9b0-423a-bf2c-9052be1256f1", "value": "49152:IPITjdyq34SY6wrb/TlvO90d7HjmAFd4A64nsfJdeHt1jVNffjiYKx0k5ESuWtgq:4q34PHtBpWEJEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336092, "uuid": "eea6be3d-94bd-40ae-bb86-25eca5478d47", "value": 3803136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336092, "uuid": "7dd0b972-e8ee-417f-bdfa-fe8b71463db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336092, "uuid": "45934b5f-f6a9-4cbf-999d-fb11dd5d906a", "value": "adobe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c580fd3-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391436, "uuid": "f4bf6a47-367a-4814-b2c6-df6e861aaeb4", "comment": "Malware payload (RedLineStealer)", "value": "387ddc848df38a5780704b6d9aec707e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391436, "uuid": "106e6326-7e1d-48a6-a819-2e96a3399607", "comment": "Malware payload (RedLineStealer)", "value": "597ecd3175523d6f845ce0c95b627162a6b4aa25628b904f374f73e6cb2eef8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391436, "uuid": "23ec4300-1315-44d1-bec1-29afbe36d996", "comment": "Malware payload (RedLineStealer)", "value": "ba2e9adb255f5725cf40cbb0318c140d4e84254d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391436, "uuid": "b2c7753c-f35d-43d3-a3f3-491b7db1d91e", "comment": "Malware payload (RedLineStealer)", "value": "8643573d0d30bb642fa8b24b2d897fb3baeae99d063649955e412457defe228ed984844b9de89657b31c3833f2e77104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391436, "uuid": "63de8d70-7ad9-4bda-a4c1-9c2369e330fb", "value": "T10CB40107B7ED8131E9F917B009F602C30636BE616A389397674AAC5D0C732A4B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391436, "uuid": "7fd3efd9-68d3-4529-bb91-887c166524f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391436, "uuid": "c87c06b9-23b4-4fb9-b03f-28bd6c40a621", "value": "12288:2MrCy90cL8+W+2n+7NcP2dBL3y7dJnPzMsCnp4IqtI:gyx8v+TL3y7r2pEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391436, "uuid": "ecc9ee6a-a91f-42d1-8963-9afaa16404de", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391436, "uuid": "44ed1f8e-e722-4de5-a823-8ac6f079b7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391436, "uuid": "5840b8b9-a7cd-4557-80c6-3b00cc0e6287", "value": "387ddc848df38a5780704b6d9aec707e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894ed53f-ac97-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676400236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400236, "uuid": "07278761-a594-4415-8bd3-f79e3a9fd544", "comment": "Malware payload (Amadey)", "value": "7a11384e2d50f301b5b1aaa0ab73fa06", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400236, "uuid": "ca084e1e-6689-4995-a446-0713f6335f2e", "comment": "Malware payload (Amadey)", "value": "59853110efd62edafb9457b1642877d5f8c787447c8e870946fb3fb2067473a2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400236, "uuid": "f823f41f-6fdf-4c00-8919-ab7629a9688d", "comment": "Malware payload (Amadey)", "value": "0e9fd74e27b7a66f31d765bf70d89e8cdbde160b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400236, "uuid": "fa8400a2-8459-4308-9e7e-6a9d1ec0296a", "comment": "Malware payload (Amadey)", "value": "b8389b5f06b51952ba2f0c18a53f1521e4b338d5b50fde8ee8ded40314b8cf2efdd437cbd147a72d8743a2b0596f9ccc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400236, "uuid": "fc6070af-ae5f-4d5a-8139-c4b9584a1961", "value": "T1C8F4126BE7FC9421F4B4577068F203C31A36BE609B788397224EAC5A4C72164B93576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400236, "uuid": "1f9b61b2-9cf5-414f-956c-91151c65402a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400236, "uuid": "409ae7df-dc5d-4d0e-849f-50d09fd5f174", "value": "12288:aMrey9092vRe+hqn0iScimoZ0PXgk6FL4KvR9hG2CzsSkcU5HG/O6m4Ry4Ee6YGb:kyEKR79iSciZ0PXRKvR9lCzsS05HcRmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400236, "uuid": "a55d11e8-c6c5-4ffb-a4f3-cdf6963bb948", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400236, "uuid": "d6b752d2-e914-4534-8e6b-c1ff9efd5766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400236, "uuid": "c7080713-3b68-4d0c-bafd-ef50b57fddd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37df55d-ac3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676361652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361652, "uuid": "14e8b470-af4f-4c49-b2fc-f4502c4c9330", "comment": "Malware payload (NanoCore)", "value": "c5e6c5c7a14f048e25bb1799540202ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361652, "uuid": "841e9e87-c0ee-48db-9dec-2c6565163d56", "comment": "Malware payload (NanoCore)", "value": "5999f4881e035a5c564ee3bcdf39d04082978f3e0bbee2c27b0fcc30493da60f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361652, "uuid": "5217221b-b78f-4b18-a9c2-802d9301935a", "comment": "Malware payload (NanoCore)", "value": "040a4175b56814b84d10f873e9be1d6e8c06a10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361652, "uuid": "ab0571df-330a-40a0-a1da-5ce83d299d17", "comment": "Malware payload (NanoCore)", "value": "1da3283c4668202313bbab3cb1a46b6529d0f3b56c34b55d8885d3b7f2adeab59fabe75aef46916399ddb4eaee5f3dfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361652, "uuid": "cac136eb-f73e-4b72-84cd-fe56426a8406", "value": "T171D41265635B11B7CBE8ACF169A3680623B766767502FBCB9C0DB8E50ACE74003407E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361652, "uuid": "a42bdbb0-b10f-41e7-a92f-df915c719d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361652, "uuid": "299d0135-69d7-4ab8-8f28-d1e7ab206e12", "value": "12288:9yFFZ6yeu3Mg20ZB3DjhFHiGlJ1UYhEmXj4gc7B+7OML3t+ALv:K6Ly2E/H7CYhEhxRAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361652, "uuid": "2de3393d-5865-45cb-b8d1-6138eba50fb0", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361652, "uuid": "88a15a93-ae03-4123-81cf-7b3491a75061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361652, "uuid": "d8a778cf-ddb8-49de-a088-02cb933f20cb", "value": "02-14-2023-0765567887img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdbfa4d-ac71-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676384006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384006, "uuid": "3fc8304b-41ac-4672-9c11-a4d58b0a29f1", "comment": "Malware payload", "value": "3dc5d75ae26ae612abc2fccf54aed7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384006, "uuid": "173d2a3e-7fbd-46ea-973d-dd6885586d20", "comment": "Malware payload", "value": "59c46abf9a1813eac1d5248bc09f75e4dad107738a6d3ae5c980cc74df705c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384006, "uuid": "e1e5f881-8dd3-45e6-a340-95da3315cf29", "comment": "Malware payload", "value": "3984861ed98bfa3aeddadcc2382b7d75cb8704f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384006, "uuid": "08d448e9-7773-4bc3-a3d2-0392c499a4fd", "comment": "Malware payload", "value": "dd78445f8f4c435bbcf1820818b46785ff5d6f1ec6ee88802b90a264ac5196bf9dd0cabcc4fd8e7608f435e2420b0494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384006, "uuid": "11cab85d-ce92-4576-8384-7ad77d75c70a", "value": "T1C3F4BE4BF3E882F9D12791398566E317FA7138041B2486CB73D469247FE76E14EBE212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384006, "uuid": "3cd69349-cb40-40bf-9bd2-244a05fde603", "value": "0439bcdb69aaf470760db9540586e4de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384006, "uuid": "c8a3fcc4-ac21-4589-bb3c-216069bef2a4", "value": "12288:YJw6fb5aYxhiT9b7majx/xSTpuoRcRMbUxCj2AqeMQmhFTSpkP2DnYu+Pkr8Tu:YJwoVJ2T9bxjRxspuoRc6buGKFhFTSpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384006, "uuid": "2eb5020e-27b4-4342-8732-c357048327a0", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384006, "uuid": "c5a27b72-4e29-4743-a9d6-e568100c8725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384006, "uuid": "e9ba236e-6212-46e5-a942-ed705fb906bc", "value": "GTA-Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e6889-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399739, "uuid": "50db25a4-28e3-41d0-bcfe-d782176d9cc0", "comment": "Malware payload (RedLineStealer)", "value": "387425c50ebfcf32c5d7cd9a4e22bcd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399739, "uuid": "e3998dcd-148d-4832-9738-c2bc8b80ffac", "comment": "Malware payload (RedLineStealer)", "value": "59cfbf139a6b344cb06e67d0c75180c808e27e5296a1d9673511f1b1b5a4a77b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399739, "uuid": "a50520c8-ae0c-42e7-ba0b-8a5f9e0ae52c", "comment": "Malware payload (RedLineStealer)", "value": "209ee1f75cc10c19f84311e7357e255b9eb39c30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399739, "uuid": "01b7ea88-afd6-48e3-a57f-1f5682da8e66", "comment": "Malware payload (RedLineStealer)", "value": "8e40c59dae3b90ecb93ab68baf13bb1e61e5ec48bc578cf4952d4c4ed51b2330b210cff142279692d763ed14f81b75e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399739, "uuid": "bec90dbb-3a37-4af6-9ac1-4fb67e7efdc3", "value": "T198F41217E3E85032EC7857B15CF602C31636BD71597442AB274BADAE1CB22B1A23536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399739, "uuid": "c6b29c11-07bc-47b2-82bd-d345a00d6afc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399739, "uuid": "15f5e5ee-5bad-4f58-85c7-ebc74eec97df", "value": "12288:NMrYy90OQTAd1W63QLz+rvm882ZoIPzyLEtq6HVKNSRIYQtPD6Qt8+VR6B:FyJs+I6xS882ZoI7oKVKZP+Qt8+VR6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399739, "uuid": "843a5d25-c472-409d-8695-1b0bb4ecac63", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399739, "uuid": "e0766108-c094-49f2-a8ac-90e2de661388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399739, "uuid": "9fc36ae3-74f1-456d-b146-162214547414", "value": "387425c50ebfcf32c5d7cd9a4e22bcd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b15911-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676375262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375262, "uuid": "5a0e6528-2dd6-43e4-928b-3a310a2b1105", "comment": "Malware payload (Amadey)", "value": "52e030959f84d93dfa5dc67c8053bbe5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375262, "uuid": "65c6bbbc-8404-4a20-b6c2-6e51be07914f", "comment": "Malware payload (Amadey)", "value": "59d6707bc4a71402d0b3ebdf3f87aa38783e61944c55b4f684c005184e46952e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375262, "uuid": "5b870fd6-835a-4219-aa4e-16adff628d50", "comment": "Malware payload (Amadey)", "value": "8f7d185355f33a0abddb76bfcb80cf828b0adadf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375262, "uuid": "c5deb19a-a9bc-4375-9f36-292767fc64e5", "comment": "Malware payload (Amadey)", "value": "dc7f6eb1fe025eb533f481275e5dbfe54a0e2af8b9bc8d61eba9ce10731c82533b06b7e06df58361304daa91f2eb211e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375262, "uuid": "182f5ad8-e7f7-4dc9-94f9-ea63b23fa0f2", "value": "T12AF41217F7E89132F8A153B118F602C30A3BBEA09A398757674FD8691C73A64E134767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375262, "uuid": "35e5d6e8-4cb5-457b-9f71-1b1f95411d1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375262, "uuid": "22dfd896-0023-4ce7-ad7b-d2e13badef81", "value": "12288:mMrTy90vQeTwcjvhHqFoADgLyuQs0vF84UlWrQEXMvdc11/7D6pnnO:FyCPTlvhfGMyuQv1Ul0QEcvdgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375262, "uuid": "eb44361e-7038-4b01-a3c7-e46d447807c0", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375262, "uuid": "15407c4e-5ff4-4406-8f0e-cd0afb728830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375262, "uuid": "29cf79b5-c1e5-4de9-9c7f-bba917ca5d09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b989283e-ac3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676361662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361662, "uuid": "0b3940fe-231a-4fb5-a19f-b96da487dd20", "comment": "Malware payload (RedLineStealer)", "value": "ed27da4dbf914839b31c89c9c82a41c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361662, "uuid": "14f37736-4caa-4e97-b8fa-2cec74028c13", "comment": "Malware payload (RedLineStealer)", "value": "5a285d586509dcdcfd9e9688e874a681f15007e0f9fe46ca1fbe806742e13ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361662, "uuid": "83b9bfa2-d41d-4dfb-ae80-e19bf2cf6bf8", "comment": "Malware payload (RedLineStealer)", "value": "823459bc3d83ecf1d5535cb066fc4084fd77b666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361662, "uuid": "94e715c8-b6c5-48c0-8922-19c058db9c09", "comment": "Malware payload (RedLineStealer)", "value": "256d043b1a134317153cc7f170ffaa715518496c28cf5db0c7d563a9807bdbb26ebc512ebb9e9d6a64b4d78688cc566c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361662, "uuid": "6aea956d-8743-4e47-959d-ad21d5fad8ca", "value": "T1E3F41207FBF88422D9B5637118FA03C30A36BD7197358767238E9C590CB26A5A63476F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361662, "uuid": "350149dc-64f2-4497-8d64-c133fc402047", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361662, "uuid": "f8b88d05-73e0-4bdf-ab0b-c895dff41e1b", "value": "12288:fMrIy90F7xvlGY/6yQP+GeNGn5FF/4aWPq4febzdqc7C06ZJhc:Dys73/6yQveNZaCCxW06K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361662, "uuid": "47d4b314-20b4-4e99-b757-bdd3994fae44", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361662, "uuid": "d85c54ab-6bb3-4af7-97f2-4c4368f57458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361662, "uuid": "ab109b78-8280-4ac8-b838-1325a46e89da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df4adca-aca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676404431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404431, "uuid": "987a906f-4dd1-4519-96e6-691abb224b21", "comment": "Malware payload (RedLineStealer)", "value": "db362f2910c1bfd37b068cead8e1ea01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404431, "uuid": "8700e171-fd90-4cae-97e2-87abb1249ac4", "comment": "Malware payload (RedLineStealer)", "value": "5a85af3e3d8de4f9d8ee3f0e7077cc5560731b0d52caf1495c5332b16f157eba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404431, "uuid": "3652381a-02a3-4e05-8a82-1caf08209d29", "comment": "Malware payload (RedLineStealer)", "value": "676d3fececd671cca2aefce708b5446613d4ae7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404431, "uuid": "edf75ed9-9620-41e1-9d3f-a7a272ad41cb", "comment": "Malware payload (RedLineStealer)", "value": "008e39e638711c50872d741d840fef9a8022daa23fc49c513b1957056ea6f24405e1e34b0e6672b78350f7db2145cd49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404431, "uuid": "07ed292a-83c9-45b0-8d11-6d2863b39588", "value": "T1BDA40147F3F94032E9B45B7019F207C31A3ABE519B35825B378FAD5A19716A0B63132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404431, "uuid": "9daadc0e-fe3a-4daf-9b05-60798821fd3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404431, "uuid": "8da049b8-3c41-4927-8b61-efa5de3ee64f", "value": "12288:LMrNy90GkG4V37J5y1Z/k4CE+ZxlvavO45ME4qFckk:WyaGO3t5y12NZavbeETFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404431, "uuid": "c0fa87c2-d793-4cbd-b0f1-00d989a58c60", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404431, "uuid": "631d640b-7f55-4f5c-8173-29fa02c199fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404431, "uuid": "5590a9fc-c149-42f4-bee9-2e4723f46d5c", "value": "db362f2910c1bfd37b068cead8e1ea01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c6dffc-ac52-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676370761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370761, "uuid": "2fb69f68-f2b1-475d-bc9d-b94b8d1a2e93", "comment": "Malware payload (Smoke Loader)", "value": "dc01a4e846cd5d1976156e771618e94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370761, "uuid": "bc32d153-d9b3-4bfa-a78c-891437f5a6f6", "comment": "Malware payload (Smoke Loader)", "value": "5af673fa350e7dbd250376b06adf9eb0764133af8f1d434d6458f6171ad8ce79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370761, "uuid": "97e80980-ad17-4265-b518-dc051429daf3", "comment": "Malware payload (Smoke Loader)", "value": "0272b0a7bbd93fb95c591e30d238fac62d276af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370761, "uuid": "bb969571-78da-4791-8cdc-df41c1265386", "comment": "Malware payload (Smoke Loader)", "value": "96cd82f0f3b303021dfd8fc52fca0ba6caa4d9e1ba5ab8c1b54e2660cfe371efc254528b9fd0fad2a588840278a30e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370761, "uuid": "979e04d0-f525-4825-b9e0-7c8baffd7a85", "value": "T1EE04DF1275A0C073D76784741431D6E4A67FBC71A7A184BB23782E6F1E30BF29A6A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370761, "uuid": "5dd5fbc4-d0d3-4a8c-b2ab-9c44f7905adc", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370761, "uuid": "2632bcdf-249d-46df-ad88-ceccbc87f9e0", "value": "3072:toWiL30BG5nMD/G9tu3Pr4gea6KnwoDhmBQ3a9aoRbLU3m/2eS:21L3msMr4OPr4ge+wo1mu6a+sI29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370761, "uuid": "5880e52d-0cdd-4e4d-bdfc-6b0055130ee2", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370761, "uuid": "134e83cb-5e9c-481e-a678-304f031afee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370761, "uuid": "2b8ca99c-face-4d5a-869b-e6f6b5cf0163", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6af14b7-ac99-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676401198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401198, "uuid": "ceb5d8d2-7e7c-4caf-bcb3-e27bec2c13b5", "comment": "Malware payload", "value": "f8e0af2c702e50d3385f84159b668598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401198, "uuid": "14545e94-ac46-4947-936a-180e2aa78554", "comment": "Malware payload", "value": "5c0e71629249ba65e56be279251ef7c97934099368064cce60b8b8833a508836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401198, "uuid": "e0d747ca-1498-4d32-b8e8-88fa4db60814", "comment": "Malware payload", "value": "56da2ca1c9a634c6ea00befa5479554311bd3330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401198, "uuid": "6b5aa98c-5072-4dbf-bb52-0755fab6b188", "comment": "Malware payload", "value": "4791b50dc4e80e88aa7c32ebcb7e8f93c7c322c7ecc230c7b140a99feb75700c94c8f5aa49f068a60accffe6020d3981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401198, "uuid": "6068ddd6-7542-4ef7-9413-534bbb163e38", "value": "T1E6154A3FB268653EC5AE0B3245739320997BBE61A81A8C1E07F41D0DFF764601E3BA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401198, "uuid": "1505f95d-14c3-4d8a-b453-24b0ab2a20f8", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401198, "uuid": "28343f23-78e3-44ec-8823-b10a94eb5185", "value": "12288:8S8cmUDowAy0bgTziwE3UCuaWRppU4XPDsTRf2vN2:87FUDowAyrTVE3U5FnXiRel2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401198, "uuid": "3f3792a8-3dc7-44d8-a6c7-a397c583b9cb", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401198, "uuid": "6aa1c252-03fc-44fd-9f3c-17c36cf38c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401198, "uuid": "46393287-001d-4414-bd6c-e1fdae49d99a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a25c41b-ac18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676345503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345503, "uuid": "17d99cfe-ec50-4834-90ac-90348de3f0c3", "comment": "Malware payload (RedLineStealer)", "value": "74fc488cddde3688371330cbd7ab3835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345503, "uuid": "0c0230db-46ae-41f4-8c0f-d33555f6887a", "comment": "Malware payload (RedLineStealer)", "value": "5c138358e2807ee7478a4857a960c14ea42241a0ab05d6bb542467b2af60f866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345503, "uuid": "402dd02b-ab7b-476c-acec-3fe018a63698", "comment": "Malware payload (RedLineStealer)", "value": "c018924c8ace463f513f1a95fcf9e7d6801c9e03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345503, "uuid": "69f7fe54-89fd-4ff1-bb85-d79d0e711c4c", "comment": "Malware payload (RedLineStealer)", "value": "c39fec8929ff4f5544a15569446b1c908e2de78f8ab6b5911ca3680b8c6559edc50e7b6ab1c95361b67e2347ad629a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345503, "uuid": "8600b714-288f-47f3-992b-c6559351cfeb", "value": "T19164F122B3D5D831E46706319829C2B56ABEF4225B2996CB33946B3F0E703D1CB77395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345503, "uuid": "652ab9de-f277-441a-814e-04abbbee2e8e", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345503, "uuid": "fea3ea6e-7889-4afa-ab48-0517cbf570ac", "value": "6144:lMdSTDmuCJRYgFNb64mxYHI7YZ9fm64wwkxhO078TK7:lMdoMJRFFNMxYHgYZlm6xwkme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676345503, "uuid": "e39e8359-fac1-41be-8be7-da24a474125d", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676345503, "uuid": "77b16870-8bfb-4613-9746-e58c85b1528a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345503, "uuid": "4a7133a9-f79f-465e-80d7-d3266ca64120", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d08fd0d-aca7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676407087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407087, "uuid": "433d7d64-03c5-445e-a394-9d36d7b19e06", "comment": "Malware payload (Amadey)", "value": "f374e0de6cf4175ced6980cf205e44de", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407087, "uuid": "3bfdf10d-d3bd-4668-b7cc-fb1fcb0b6784", "comment": "Malware payload (Amadey)", "value": "5c46e527603d3ae47b9fc7963a303bf64d60bfde6c902f8c9b1fd44ea2f74449", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407087, "uuid": "78f4bc81-b63b-48f7-8d97-87e40f83e720", "comment": "Malware payload (Amadey)", "value": "6ec0f8e116b46702b80066ded8e61fead018268c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407087, "uuid": "240525fd-95db-472c-83ac-50d4035ba3b9", "comment": "Malware payload (Amadey)", "value": "9b6d1f9ebaceacd7523a55ea146b74ed60f9cd724a361eac3203716a9ee48163bb2b45e8500bce75bf3078da1f9cc948", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407087, "uuid": "18b66eea-b7ec-45cc-86f3-ae4712d7d087", "value": "T1B8F41217F6EC9031E4B42B7059F703C30A367D95DA39A3AB278E5D290C72670A531B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407087, "uuid": "f865ada7-4100-4c34-9628-559b8636fe3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407087, "uuid": "6372dd51-d5a0-4439-87f0-a6c8e22e8b34", "value": "12288:rMr+y90kQXW8yzjYXBrS06auFrdx4fMD5xDt5eBulnElXo7yfRlhWYn:xyhIyz8XVS06rFrdx4EDLDt8BVXo7yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407087, "uuid": "dd29f7e3-bd23-41df-9652-88297d4c77a3", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407087, "uuid": "b54bf156-80c4-4f4f-b721-9c6c3426b3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407087, "uuid": "a8f6630c-e71e-42f5-bc85-6c7ea6d0e1ba", "value": "f374e0de6cf4175ced6980cf205e44de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e08f87-ac68-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676380062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380062, "uuid": "52328cfa-3f24-4aee-985e-cb06f543c837", "comment": "Malware payload (ModiLoader)", "value": "23ce4c2eb85eea9a1871bf922978ade9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380062, "uuid": "b4db85df-87b4-4110-aef0-b21380c6952e", "comment": "Malware payload (ModiLoader)", "value": "5ca676b334d8a3f4542877a696a7092b29dbdeddabcd70af2a80e5c8384a75b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380062, "uuid": "a7c70ff1-a8d6-4390-8f01-3423cb8e1b49", "comment": "Malware payload (ModiLoader)", "value": "8cfa86cdbcda76c59cea93839115f84b9b47ced0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380062, "uuid": "165c70bb-c094-42f1-a218-a409eb0215bd", "comment": "Malware payload (ModiLoader)", "value": "9062978f83c3a81077871a65a012b66df6253aa734045af4811a2e2bbbf94c86bc3164fa91b4e5bf1dbe1c57c838f329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380062, "uuid": "d6c77bca-bf8b-434a-b3b0-234edc03d441", "value": "T17945161DBECD1037C3330A35A8065E2459256AB1ED28F9F73EACD808CBF66716836D56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380062, "uuid": "74195d78-1e65-47f6-9442-0ba30d2a2be7", "value": "d1aec4d82386c4595521872a7de3a670", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380062, "uuid": "a0dac28f-e32e-433d-9c74-cf1bbc3ee770", "value": "12288:oX8lOqFSsZ40z3QjB2lr5fPx7Zh70WoQzV9hBoSFhAf1nAhglR:Q8ltFSQ3AB2zp7pcf1nAhglR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380062, "uuid": "5ddc6c93-7143-4d0a-8253-07de8a79a61f", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380062, "uuid": "7e500a4d-4d69-42da-aee2-8dbba8889074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380062, "uuid": "422075f0-2c68-4841-927b-cfd4fda65f43", "value": "TT Air Export COSCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cdcba8-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676407348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407348, "uuid": "702c25f9-3390-419b-a48b-8a3274c3b24b", "comment": "Malware payload", "value": "196b4e0f90bdd2c119b7ef9e3a1efa97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407348, "uuid": "12d796d0-3568-429f-b893-701655320221", "comment": "Malware payload", "value": "5caf93ba3ebc06d7df2e84e9d00f488961850d3d014caa08401a4ab4cb0d75e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407348, "uuid": "7137598e-22f1-4925-9bfb-069ad433b16c", "comment": "Malware payload", "value": "955bcb5e2bf7f518bc56b8a2e1822498f08110cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407348, "uuid": "91960435-db5b-481a-86cc-958b2df340bb", "comment": "Malware payload", "value": "fa7091b81bdda89e2ce34b9a344c444dfce76e50d70b9e8638a97a47e2ac87c0c6f5796f62332f0100a5127c340db20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407348, "uuid": "e3dc5678-4bdb-4dad-afa5-14064a0035be", "value": "T1F7763B07F85190E8C1BED230C62692A3BA717C855B3027D72B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407348, "uuid": "29fd325b-334c-4edd-90ba-3d022ca0a173", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407348, "uuid": "3281826c-09bc-4ef9-93ac-6da45e838350", "value": "49152:z+pCapzOib56rb/ThvO90d7HjmAFd4A64nsfJTEtpCNVIR+dUGwlnDBJAUT8e8rr:ctfq+2bF6MS6pc2ElAz4qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407348, "uuid": "aedfc094-12e9-4dbe-b37e-71f98e208aab", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407348, "uuid": "cc600209-bbb8-44a9-843f-ddfb14e39e9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407348, "uuid": "4568c994-41ad-4313-84e6-5cf2676d2e01", "value": "601964e6-093a-4525-a304-c557a4a357be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4f327d-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676412804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412804, "uuid": "d236fa5b-dae4-43fc-8a52-5e37c4ecc324", "comment": "Malware payload (Smoke Loader)", "value": "aa70c6d52c3ba97b53a0979995997ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412804, "uuid": "0508e5b5-bd98-412c-bf25-4e23469ff912", "comment": "Malware payload (Smoke Loader)", "value": "5cbd71dc7c7139ddd80c2eeac337e749a670dcf2149ad36b2e9b2b63b462a32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412804, "uuid": "b5f5397c-9144-4996-93cb-b26e7d623e7b", "comment": "Malware payload (Smoke Loader)", "value": "f6a50a275495a5d74d3062aee80a67c142cbec26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412804, "uuid": "3a896fcb-e278-461a-9958-73e37c7f3edc", "comment": "Malware payload (Smoke Loader)", "value": "31eb5ff082f71b724b78f003662451d616714da06af51ea8f27455df8363a1424c91144e137608055646c5821c9c28e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412804, "uuid": "5005302e-e825-44eb-93f8-052301615b01", "value": "T1B314DF2275E3F076F55B8D384460DBA06A3FB871E7A4814FE39C1AAF1E283E14675352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412804, "uuid": "496eec08-00d0-4336-81aa-bb3125fa8ea9", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412804, "uuid": "ed15f3af-ce48-4daa-9964-b42585979ca9", "value": "3072:ie/NMXLo/7f5FOCBuodE6H3rduJ6A4GTh4Uh8mIGkIcF3b:uLg7/VdPbdzVGTh4L/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412804, "uuid": "81219bcd-824c-4c4d-acca-d85fa777bbef", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412804, "uuid": "e0aef0b4-132c-4078-8ed9-17f99e976103", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412804, "uuid": "2a39eaa6-66dd-4b08-8d1d-b3f07e1e90c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2d46d3-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676372483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372483, "uuid": "625cf250-ffea-4767-95a2-a0901efeae7c", "comment": "Malware payload (RedLineStealer)", "value": "c03fb90edbbe29ce4c7167cc3fce61a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372483, "uuid": "3f052b10-15ab-40e4-ae38-9a5ea8ca0073", "comment": "Malware payload (RedLineStealer)", "value": "5d64c5c6e245fc0ae8c251818229de82f2392b199e9b3c1bae89988ad845b79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372483, "uuid": "8753e564-a863-4f91-a085-ceb814593278", "comment": "Malware payload (RedLineStealer)", "value": "159653f447aeec2f832d13847d75f01538da8033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372483, "uuid": "4d0122c7-1007-4d8d-9adf-c51209e5fe17", "comment": "Malware payload (RedLineStealer)", "value": "588524c3bd3c1c7d658f13f38f937897fbd4b3374b8275fe925a07f20886fd0e4f73aae738e17187b0c068705987dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372483, "uuid": "69f36f46-a53e-482f-ba4b-d42d37a7f42c", "value": "T196F41207E7F80432EDB91B3498F303D32B367E71573482AB265B6CA619B2560E93175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372483, "uuid": "66c66d6e-009e-487f-93db-9de12e9b5ae6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372483, "uuid": "db89365b-b574-4330-99d1-95bf43d50650", "value": "12288:UMray90WCPnVlRdrVlHsP8zLonPqFNuO4h12LVXJB5+x6s9BkSI+VtpsIG:+yCVpPonPqFNuJh1c9Jr+Z9eSI+LrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372483, "uuid": "d6686166-3a45-46f6-b119-a017a16eb0b6", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372483, "uuid": "ba5ccfdd-0f2b-465e-9e88-02d7acf71f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372483, "uuid": "79682967-5ae4-4df0-9070-096c40f9effe", "value": "c03fb90edbbe29ce4c7167cc3fce61a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d3ddb4-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382109, "uuid": "92bb14e7-f8ce-41dd-bb3b-585083db3fd4", "comment": "Malware payload (RedLineStealer)", "value": "6e88575e5a8289855c38133d70e4466d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382109, "uuid": "cefce8c3-a9af-4949-aba7-06e549847fa3", "comment": "Malware payload (RedLineStealer)", "value": "5dddea590a2fa5de71f11a70e98cec2735f106ebe59d84c79f465c2744b89556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382109, "uuid": "595977ff-4edb-4162-9320-9965d1e9c959", "comment": "Malware payload (RedLineStealer)", "value": "f4dba78bb2db07d4964846d2707136ea7078566a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382109, "uuid": "017c2c58-9045-43d6-ade0-f912707713e9", "comment": "Malware payload (RedLineStealer)", "value": "35d731e996a7fa8c43c7f36ffa123f4ef4db2db0b6c79857c1fcb3a677b43ba6b237526d2a4e3352fa0e425f602a2001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382109, "uuid": "245e933b-13ad-4afb-922e-2cb0025c6ac9", "value": "T13354F10276E1A072C16F967D5811E2E0AB2F7C715BB5658B33141ABF2EB03C1D93978E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382109, "uuid": "649df77b-c513-44af-bbe0-7662e4a897cd", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382109, "uuid": "2b436673-17eb-4ab4-8323-0e3febf353c1", "value": "3072:DoQ2ELMhmJB5ndXiKuLSbKAXPJpadg4wdCEj88EJw3sXTGF4g55hgVdUgebPxL:keLM8JrdSKuLSbfPTiEj8AUvW5hE4b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382109, "uuid": "350b85ad-2253-430a-9105-8e95e33ccb7b", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382109, "uuid": "1d227f89-951d-4e27-aecf-1d82bd70e5a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382109, "uuid": "dfea8eb6-46ae-4490-967a-358101919b7e", "value": "6e88575e5a8289855c38133d70e4466d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c7de75-ac6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1676382914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382914, "uuid": "f7981041-1606-4427-9a21-010d08e80acc", "comment": "Malware payload (Stop)", "value": "7bfb062a9c5cefa38b84ee87011bc4f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382914, "uuid": "ccd42f23-6ebb-4cf3-b6ce-52997d3a4729", "comment": "Malware payload (Stop)", "value": "5df73e74b4b3cece459f28d8226fd08d829c6a54d1be36d2560d8799eafb8981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382914, "uuid": "15360f23-6226-4eb8-998c-d31f87b80faf", "comment": "Malware payload (Stop)", "value": "ce9513a63ee4d4a2ebc30e64b25a3d46051c7686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382914, "uuid": "48c509ec-79f0-45c0-9633-33b836983e6a", "comment": "Malware payload (Stop)", "value": "9c5f02b461b7cddf7cf901407a235b639b1239a97bc015478e0e78ad9335680cf2e1b0e3cc46f3692ab165c733246194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382914, "uuid": "ce04dfbc-0484-45f5-969a-dcffaae95097", "value": "T1DCE4122237A0E875D87311318E6B96F4667EB841DA3CEA4B73E8463F4FB12D185B6341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382914, "uuid": "d8dc6e5a-4d2a-4f5b-b333-185877c9ae7c", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382914, "uuid": "3ee54945-4e79-4ef6-8b4b-f488d0e5b776", "value": "12288:eFWIhsDK2erz2qoOKF+VqYiMiEFXB1lIhTFXWVc24OwJusuX+L0UFAsE6:eFpGKzC3O++Vq6RpDlQTFX124ZJVY+LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382914, "uuid": "404bb929-f01c-4727-a424-585db76c45c9", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382914, "uuid": "2c6fbd76-3652-47b2-a574-d191fd3e91fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382914, "uuid": "ca97368f-0ce2-4854-b579-2d36066edb4a", "value": "5df73e74b4b3cece459f28d8226fd08d829c6a54d1be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9626cfc9-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676407559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407559, "uuid": "94ef911d-9a6c-44a5-b689-c62502d0d89e", "comment": "Malware payload (Gafgyt)", "value": "690ac3f2cabc222fb6e62bfe553c986f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407559, "uuid": "00b42926-108b-407e-ae59-8e60e2a55798", "comment": "Malware payload (Gafgyt)", "value": "5e1ee1effaab52248aa52d0033dbdca8d3fdf0c53484103a63a47326184b7c31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407559, "uuid": "eac65a1c-6f0e-4c37-9278-607838e6ebd4", "comment": "Malware payload (Gafgyt)", "value": "e6677b86eb22d5765e3c51cbb1a117991887721b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407559, "uuid": "b3d08635-2d06-474e-96b0-cd2ed1110943", "comment": "Malware payload (Gafgyt)", "value": "bf6819ed3ec86ae8dd919593a791c37991b76e65a5ece1a89209aef1860f7ffb5bbc8b63d8cec24e1b283d5b5c2c99f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407559, "uuid": "50b592f0-885f-48ec-8ddf-e20108b973fd", "value": "T198D3D8177B518FB3D81FDD37069A460220CDE55A16E97B6BB2B4C91CE78A84F09E3D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407559, "uuid": "bb021f59-b658-4e8d-bc20-c0db5e298b0a", "value": "3072:4MnyWKgY381yV5hPM3WVzhF3xemqY1fuBmvm:4M3Y3+yV5hPg0zhF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407559, "uuid": "dcb9cf0d-2cab-4806-af55-59a4065fb3e6", "value": 137910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407559, "uuid": "d8d84685-8df5-43ed-868c-16ca6fa0e2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407559, "uuid": "c2cd226a-011a-449b-8f13-98877d720243", "value": "690ac3f2cabc222fb6e62bfe553c986f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baadd75d-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676408479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408479, "uuid": "864d64bb-daaa-485c-a554-b841fb473beb", "comment": "Malware payload (Amadey)", "value": "0d05ec540202004aaed715eca0ec6bc3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408479, "uuid": "4b507abc-cb37-4ae5-8462-373c51ff317a", "comment": "Malware payload (Amadey)", "value": "5e2cf59006fc91445683799f1452afefd424560fc9db7746d0341c52c8fb9600", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408479, "uuid": "7cae02ea-f3fc-4642-a561-a8cb1531df35", "comment": "Malware payload (Amadey)", "value": "4fea30ab91c566e9b83e56b35f269a2f9a9fdd88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408479, "uuid": "9612f792-17c8-4466-9b67-da0aa3455189", "comment": "Malware payload (Amadey)", "value": "f6a3127f917e4f0070853f01b99bd3dfce6ef2d5e9bb3aa21ea9dd10a81b9f489ad709224a9a451c6bc8d950e21c5dfc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408479, "uuid": "0502de7b-3a26-4e38-a0b9-ad2d0abff704", "value": "T14CF41217FBF99122E8B56BB01DF643C30A357E205A34825B13CF6C9918B3AB4613576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408479, "uuid": "18ef525c-e411-403a-acfa-8a2dcda25371", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408479, "uuid": "d07372d7-61e2-4d87-a883-f133fa7efcbd", "value": "12288:cMr3y909aTcVJSBY45MPgd5IqbOCzhgkVMD5Kct524WbZ/GnYfiUrJr5JeJdpuR:TyxIVvEMk5okKDwctE4OZ/GnDUFec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408479, "uuid": "198331d0-19cc-49e8-93eb-c7eedca34b87", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408479, "uuid": "41b4d5ea-1c47-4dbb-9026-4648250b64e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408479, "uuid": "c86f01be-e3f1-4cb5-afc4-3243178c031a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01992937-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676364360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364360, "uuid": "1ef2803f-6cfb-4a1a-baed-9ed2b045e903", "comment": "Malware payload (Amadey)", "value": "d4dbd0e6f9e4e740bda1d15e26203e99", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364360, "uuid": "e43a5e85-45f2-486a-a610-bcc54e286264", "comment": "Malware payload (Amadey)", "value": "5e7eec420ff9058f51eb0e22729be51ce6b6b1c8844acef794674081b52b420b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364360, "uuid": "6dd1b016-2c3d-493e-99fd-0c2edb4db8d0", "comment": "Malware payload (Amadey)", "value": "086c1cce998ed3ead2fc2b667be032eec13df29d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364360, "uuid": "0ece8cae-912b-46df-b9dc-d8a3624c2adc", "comment": "Malware payload (Amadey)", "value": "39e8644453386eab2a268f038961a5061e319683cd6091f45ce023de8dcce979d194d6b7b3ea227cc55e6ab3eaeb4ac8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364360, "uuid": "a6c823a4-8bf3-41fb-85a1-99208768c66a", "value": "T11FF41217EBECC021E8B4537128F603D31936BD91DB78865A235A9E5A0CB35B06976337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364360, "uuid": "f2852e59-9a04-4dd0-a9a3-3e5d5a6c6e1b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364360, "uuid": "eb29b84a-980a-4355-80b7-73b535ff98b9", "value": "12288:QMrly90IAoAsV0++dNIOJ3S63ZlYzd7fvDjRJ9z4KKtmdFjTpcGVORGipD:ly7AoJVsEL6plYB7fvDjr1hz3jTprVOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364360, "uuid": "338d0ebe-2cbe-4526-b434-573264d69df1", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364360, "uuid": "73e76eb2-9310-4dde-86d0-414e38c6fc73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364360, "uuid": "34122648-5d5a-4a10-880e-4f8ed1d60286", "value": "d4dbd0e6f9e4e740bda1d15e26203e99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0a799b-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382099, "uuid": "1783a00d-c6d2-415d-9c05-95a04101f7f8", "comment": "Malware payload (RedLineStealer)", "value": "2be42b71b2ce4606d3dfd67a2321b0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382099, "uuid": "e615bd42-df66-4bb0-8b06-41d69e4537f7", "comment": "Malware payload (RedLineStealer)", "value": "5e8dd0413ca112e7716480c079c5b2b34fe73119e8b2bb36bd50ebf192026a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382099, "uuid": "7097b4b3-3e23-4cbf-a301-4a8734675ecb", "comment": "Malware payload (RedLineStealer)", "value": "9ea6e674b791f1e0410dd6048db5ea6ad982846c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382099, "uuid": "1764ab73-7b19-4208-ba5d-1e032e5e6824", "comment": "Malware payload (RedLineStealer)", "value": "7cd048d6fc8e75fb7371249165f981af7a69368c7cc9897d90fdfd7d135991b5a32e24610a155d63a35b75c2bf47ce36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382099, "uuid": "1dcb8a92-3922-4a4d-abfb-3e117a5cde7c", "value": "T12DB41207B7DD4176E9715BB049F703D31A36BE106A38874B124BAC6A18732B4F23672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382099, "uuid": "e7f8a81c-d9f9-4b79-879a-47e6a13298ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382099, "uuid": "5c5e0074-24ec-4299-b2a0-c2ad30204df5", "value": "12288:pMrFy90JEJLsl1Sm2c0l+v3j8ZOHb9hFTOoc0Fx:Ey1a/2bowZsxc0Fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382099, "uuid": "82b7fa46-182e-45ae-9ead-a5b445bc9756", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382099, "uuid": "ccb2f711-cb3f-4650-ade6-f1a05bc5e1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382099, "uuid": "4b724635-a07f-4cef-bb46-bd989921b7da", "value": "2be42b71b2ce4606d3dfd67a2321b0a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792afaf7-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419106, "uuid": "5005d71a-19a2-4728-ab44-0dc1a78526d6", "comment": "Malware payload", "value": "96751b3bc0696012bbce64ece8958727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419106, "uuid": "b5016d11-d55e-4e81-bdf8-32cddddb1b65", "comment": "Malware payload", "value": "5e9bfa26c30057cca4a5ecb176c9e7d83572ca5858f1ce9a806b048858275aeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419106, "uuid": "7cadc2a3-2f02-4755-9ba2-bc1c6bffb255", "comment": "Malware payload", "value": "7f03be0f172cb549368c3187fd8359554eb713de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419106, "uuid": "4f2346e4-6ffe-4de9-aeaf-f194fb3f1557", "comment": "Malware payload", "value": "2081c41e5ff47227bfbc288a4e5ba828359f36d3912d63634faf7ed11770fe6d353890e5d7e15b9ade9630f1b3a076bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419106, "uuid": "7f35f419-f279-4c8b-88c7-ae427facdf12", "value": "T109730A86BC809E10C6C50677FE2F218E330757A9F2DE7256CD155F707B8B81B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419106, "uuid": "338a680f-c723-48e5-aa03-23142a7fa8f5", "value": "1536:Cqn7SrSnhLq0ZYe2Yp2uKsXbmrGmL4J70qNd0Q79BczXIPiDcybm8:fSSc0Z92Yp+Mb0IYqNKQUcybm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419106, "uuid": "51620052-e61c-4c0b-8d13-e83194c9ee5a", "value": 80536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419106, "uuid": "4e5d9e53-d230-4a8e-84e7-22ba1ba0ba1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419106, "uuid": "6542d5e4-7f1e-4f62-ba0a-c719c2a0cd3b", "value": "96751b3bc0696012bbce64ece8958727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6374c5-ac6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381073, "uuid": "24891761-57ee-4b3a-b1d6-942a0049a1df", "comment": "Malware payload (RedLineStealer)", "value": "26cd0ff7a3b8e92ce4b1f755870649bd", "object_relation": "md5", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381073, "uuid": "08ec78a8-df86-47e2-8c3c-bc92a9871e9c", "comment": "Malware payload (RedLineStealer)", "value": "5eab59869728c98ff7d30af4033958c5da68d2403dfdbbeecb0c2cc03f69712f", "object_relation": "sha256", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381073, "uuid": "a95cc712-1895-4167-9d99-be99a67a2e65", "comment": "Malware payload (RedLineStealer)", "value": "06b7999d636c22847a3f122f325f085ffb577b42", "object_relation": "sha1", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381073, "uuid": "c881fc42-15cf-4c40-bd05-0288d9da347f", "comment": "Malware payload (RedLineStealer)", "value": "c6e1736c20699ce8020fdcce4ba840b5cfeddc04a2fc4908ab1da97a0c9dedd56d5e9cc027e0fc1af1bfff12b19bee1e", "object_relation": "sha3-384", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381073, "uuid": "e29f3a98-4a45-4794-980a-c64d4d26ed60", "value": "T163072329F46632B1E84DCAF005F00DA403E56DB1236B9BC423B9365F967BE6DDA74930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381073, "uuid": "0d60437f-c5e5-4481-ae87-cea3e5377590", "value": "393216:678rooP9xCnJ8BEolVBj+IyduT38zTku2aWfpuyjc9:BrfP9YnejbyY38zTkLw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381073, "uuid": "d7a3909c-3418-445f-b855-18d003ff4969", "value": 17476855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381073, "uuid": "288b7652-de62-46d1-8bc3-d464610b6f06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381073, "uuid": "54489896-4751-4165-ab1b-5a5a2b2596e7", "value": "meta_build.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b5868f-ac00-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676335319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335319, "uuid": "d3225e5f-ac59-4847-b370-0a8157eb4fc2", "comment": "Malware payload (Smoke Loader)", "value": "97ab751ee01bbe32fab117766b191b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335319, "uuid": "eeea9ec7-e296-4b78-b851-a1a3a3a90bca", "comment": "Malware payload (Smoke Loader)", "value": "5eacf089ec5e409ab47261ca2f6ff03ef904345a1ccc0d9e39bab0338c5f3181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335319, "uuid": "01924bc8-d911-4c41-8916-434c4fbc0709", "comment": "Malware payload (Smoke Loader)", "value": "bf4b43c42d914eafa72da42f07d1ec5a157b3f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335319, "uuid": "878cd944-9440-447f-b373-eff7e647dbd1", "comment": "Malware payload (Smoke Loader)", "value": "aa247f0e55ffbe0dceda1cbe9b98e3fd73066a25a8830dc0301a657bfb5d118eb6f8bafbff90b6c22fbed948f95233fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335319, "uuid": "97c2be38-c5d2-41bb-8d5b-c36512d45ef5", "value": "T10314BF22B7A1E871E42749318825C2B57A6EF8214B799ADB33945B3F1D703D18E37392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335319, "uuid": "4ff3a9ff-d5df-4f6c-b35e-23b9c7696292", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335319, "uuid": "93a34ce8-3804-4eca-bc72-3874f36f0b61", "value": "3072:ypnLuHXa5zUmI9nePYgrTt/Zk6K+Fpyopy2JYxK2Zev+IwDb8Q:ykaUfQAgrT4/+21ACK2QwP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335319, "uuid": "61f874bf-43d9-45a3-a148-c6d4ddbd9e72", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335319, "uuid": "b3f1cf0c-ecde-4aa1-bc50-4978d583dd63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335319, "uuid": "bb177b8f-3cdb-4fc3-9942-cda7a1d86a26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0aba630-ac81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676390933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390933, "uuid": "2ca0f8ba-c21f-4b95-99ef-ebc0ca952407", "comment": "Malware payload (RedLineStealer)", "value": "f114655c2617a2798c52069cfce0e3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390933, "uuid": "6cd2f6d1-4ed5-403e-ac66-6d6446facb51", "comment": "Malware payload (RedLineStealer)", "value": "5f0bcc5cb1329aba9de97ef00e930eb50d2e4dc0dc46b68353cfa57ec94c5730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390933, "uuid": "f83e900f-6e1c-4559-864b-7468d5a3968d", "comment": "Malware payload (RedLineStealer)", "value": "7998d41897b2506c7cda88ae16f3ba4b20d1cb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390933, "uuid": "1c0b1752-72d4-45cf-a10f-db233df02643", "comment": "Malware payload (RedLineStealer)", "value": "c561e14a7d2dc474ce72a379e083c43385fd18d5e40b8e1896e61155ab980174b9009dc0f443ce8f6a30969f315a5364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390933, "uuid": "e8c0fc24-4998-408f-bf6d-c35596747d81", "value": "T1A954F1117EE1F3B3D466C5716922DBB0A6FE78718765C18723182A6F1D303C19A7A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390933, "uuid": "9b8c6e6d-02d7-4f28-8e93-b4551b00c4f9", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390933, "uuid": "50f2afce-3a0b-41b4-a347-f6534a56aab9", "value": "6144:T9NLI5JzCh99wR0E68IotYNY7WTn9SvFhxvKJJ:T9NOJzQ6R07jsv9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390933, "uuid": "28928988-e39d-46dd-8790-8d8423afe1e5", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390933, "uuid": "cb74cff0-980b-414c-8e0b-8082de33381e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390933, "uuid": "4c18b9f8-49fd-4860-93a9-b4153b13e089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c51579-acc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676418208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418208, "uuid": "8c6d0a5f-7ff1-415e-9c15-3ac7a4dc0c89", "comment": "Malware payload (RedLineStealer)", "value": "644503c2473aaad7441139da1dea4a05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418208, "uuid": "fce36994-2fa4-4d7d-8a67-f9964eee68ea", "comment": "Malware payload (RedLineStealer)", "value": "5f1dde76f95578ac3040c4ac0ffafb0eadc68234eeccbb647a32e917d9e4ebb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418208, "uuid": "dc439771-7c18-4beb-ba50-0e526f1fa706", "comment": "Malware payload (RedLineStealer)", "value": "e584930dc24399de5ed2597ee53ca49ecdcabc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418208, "uuid": "292e5bd2-e6c1-41a6-8698-2d5be30caf99", "comment": "Malware payload (RedLineStealer)", "value": "9b1259c2959f4756a13c735345bb85f5b09eaa48e3fd36d142dc0d7b4d9db01dcfcf1987b219ffe61ed30b52f456064d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418208, "uuid": "9358aece-8d0b-4200-b189-567d739be05f", "value": "T1B5A40207E6EC8136D8B557B018F703D31736BDA16A3843DB274A7D9D18726A0AA32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418208, "uuid": "eea308a5-411f-4d9c-a865-a25193ee35b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418208, "uuid": "d075c2c0-0a60-4ac9-acd0-01ec83288d45", "value": "12288:aMrFy90OUuWObOgfdHFeixdb5b9ENxdA:byKuWgO4lZbYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418208, "uuid": "500e1794-337e-4d49-ac3b-29873a3022ca", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418208, "uuid": "102f8bb0-cd8b-4e8e-9ece-caadf014a2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418208, "uuid": "81d5df07-a39b-4f01-a56b-c97b63614778", "value": "644503c2473aaad7441139da1dea4a05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56800e63-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676408740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408740, "uuid": "7a14e57e-2647-41a0-a33e-14a05eee4c33", "comment": "Malware payload (Mirai)", "value": "eda84bfc220a4fdc9803c247bf4495d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408740, "uuid": "2fff9961-797b-4d24-ade2-c417fb4b11f4", "comment": "Malware payload (Mirai)", "value": "5fad39715986d25d9008dc5c04b31b7929c0d7d517428f75966faff02fa5e77d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408740, "uuid": "211ae0f0-c6c8-4b04-8799-38d5c66cb6f5", "comment": "Malware payload (Mirai)", "value": "d3e4f54324ebb524552c9afbdbb1a3744fbfb8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408740, "uuid": "9e263a0b-da02-4b77-acaa-e26ca0a12ca2", "comment": "Malware payload (Mirai)", "value": "58d525b12c6e1fc5af70a1abff96f59cabcfbf0db6fb6dadf8735a035967b967a475be4774f61424c104596af728ad9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408740, "uuid": "57974cd6-8b3f-48c4-9cc5-1f0fbae46487", "value": "T1FFB31893F901DE66F40AEA3605D74725B230FBA60E431A7273173966EE362D53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408740, "uuid": "bf476b82-c4e7-4a10-a552-4175ec607477", "value": "3072:xJ5C4RiHEN9EebFUVyv9pJ3AWvBmFZ09DRAoQfgm:xJ5PQHEN6zyvDJ3AWBmFZ09DRAoQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408740, "uuid": "2e6b9195-da30-4197-973d-93e7949bfdbe", "value": 109122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408740, "uuid": "aefafc02-c96a-4dd1-b9e6-a6bc992df829", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408740, "uuid": "a200db25-097f-4023-8053-681e0a46ecdb", "value": "eda84bfc220a4fdc9803c247bf4495d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a68439e-acb6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413391, "uuid": "5eb18a05-7bb9-43ab-b089-4486ce48c479", "comment": "Malware payload", "value": "cc42c0a15a202e769dfb5fa1e889cd61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413391, "uuid": "d751098e-b059-40c4-9b7e-5ef24ea3d2cb", "comment": "Malware payload", "value": "5fca292469c2c218e2a2b03634284e7d0a7f7912d0c9a1cb7738cdad2f065c02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413391, "uuid": "0f3a986b-69cd-4a84-a6dc-a493c841641d", "comment": "Malware payload", "value": "4c4f5d46f4b7c292f148b1542183baa95353711c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413391, "uuid": "3d8163b7-b404-4424-9e94-066afd3d31e4", "comment": "Malware payload", "value": "c9634d1cb7767ab2054ba3762273251a5d479e7e09c3da6aafd9c950675c7309358b2bbdf655d917b1f22c1dac0e277d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413391, "uuid": "cdc99d45-e495-414f-9f78-63101f003ef5", "value": "T1319329E2FD41DF66F00A9A3A05C70B306630FF660B931E7172577A669A722D47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413391, "uuid": "a845ba5c-0a55-4eb2-8270-3e38b89bdb28", "value": "1536:Nk83pZHebQPmB8ACX8Getchyp6sKPwSUzOwA/KbScw7booEr0tyIHUIN:Nk85Z+aeCwEUowT1bNw7bNo0tD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413391, "uuid": "457a5907-afac-4914-8ed5-4f2b60e18f39", "value": 89360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413391, "uuid": "5464a367-6ce2-44a5-8aa6-4383dba5ee00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413391, "uuid": "973142a1-7154-4a70-854d-9c3fad648106", "value": "cc42c0a15a202e769dfb5fa1e889cd61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b0f872-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676407397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407397, "uuid": "f0189f65-3bc4-43ed-8f89-16e95b30f24d", "comment": "Malware payload (RedLineStealer)", "value": "9ee89d7bf9723030c887388e254173f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407397, "uuid": "2abc2f0a-2b06-4ea5-93d1-df488ed86467", "comment": "Malware payload (RedLineStealer)", "value": "60081851064ffef2f4af66c9a9ab0728f99bfcae4195ed8f35303e7f96f45dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407397, "uuid": "ea20dd2b-9c74-4923-8aec-860867a74237", "comment": "Malware payload (RedLineStealer)", "value": "cb71db3e6000f291eb83d3864fab548611f3d016", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407397, "uuid": "c97586bf-bcff-4c08-9654-6546429a02e4", "comment": "Malware payload (RedLineStealer)", "value": "401d75b86825ebe75c6801afbbbd65c7fa75c1a4e04af8a0298613273fcaa33e9974a56f1d2b3437d6b4089ec329956f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407397, "uuid": "f9569bc8-e787-4163-8ae3-0afede4b54db", "value": "T1D3A40107F6FC8072E4B453B019F607D31A327D612B78879B638E6D5A0D722A9A234737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407397, "uuid": "511bca42-3cfe-4fe0-9ea4-78caea279417", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407397, "uuid": "32f457bf-c3a4-49fc-95f8-d2224f43e993", "value": "6144:KZy+bnr+lp0yN90QESRPoBHFQ3+U/sG5hPjZL34MhMvUurK0aZB3PH/JwuTkRkMp:TMrFy90jmuUEGnPjZH9Q1aZVX2KYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407397, "uuid": "e7efbaed-4a51-407d-b983-d8e957cbe3ef", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407397, "uuid": "87da5531-a302-4d30-a03d-71688db971aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407397, "uuid": "1d20868a-aae9-4656-a5e1-388982a0eae4", "value": "9ee89d7bf9723030c887388e254173f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ade0c3-ac43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676364333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364333, "uuid": "521957e9-0aa6-4205-891f-afd213d897b2", "comment": "Malware payload (Amadey)", "value": "ed914bc2d22f28f1277afa6820ddad45", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364333, "uuid": "d54d8d6e-7b07-4c2e-97e6-a7d09944feb5", "comment": "Malware payload (Amadey)", "value": "6034973afc093e655f05f8ec5e7e07a4e5ec7e356de3fcd4b0fb983b0960538b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364333, "uuid": "5e772738-7454-46fa-a07d-1b678322aca0", "comment": "Malware payload (Amadey)", "value": "b8608b28c14bca9db0d62eee52897dad87bde533", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364333, "uuid": "c046f216-dbd4-43a1-b3fd-e0e120775555", "comment": "Malware payload (Amadey)", "value": "731d09a9a7f1c721aa16538df7a6af70fb04103f4bce41269a91622ef0748694670341865bf35db1bc623fd0b4869b69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364333, "uuid": "60bec125-df75-4f59-b792-c8da84629b8c", "value": "T179F41217ABFD8022E4B197B058F742D31A367D916B39839E174F9C690C236A1B63533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364333, "uuid": "a1a6a4b7-4819-4621-8209-4dd6bfa5cbe5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364333, "uuid": "9b2b17e6-f1fa-4c2c-a609-5ade0f0f8465", "value": "12288:oMrzy90IlpmyVqCsJvMGG+A6j1t8BoTTgzXIZrUFi4iqHWMF97XLzn9Y:by9lXVqFt86TBgYZYiW7f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364333, "uuid": "8f517579-946d-4a8c-8534-e3ed78a1f153", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364333, "uuid": "83afb2c7-f124-40fa-93fd-6fa2d21d3491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364333, "uuid": "70b6bd66-8afd-4693-bbfa-9781d2e9c1d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800f744b-ac9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676401509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401509, "uuid": "acd81e60-0c6d-48f1-ac3d-d9312c7fe484", "comment": "Malware payload (QuasarRAT)", "value": "b73186130c6c8352436f88a1a86bd16a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401509, "uuid": "a7c7fb84-7ad8-4a4e-8ea1-8fe1d24d22e8", "comment": "Malware payload (QuasarRAT)", "value": "60cc9c3bdd9a4317b29e7b28c1ecdda262630c52174fbf133b08a6cc1c982747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401509, "uuid": "af2e7c6c-d0fa-438b-a487-a0871ce46aa2", "comment": "Malware payload (QuasarRAT)", "value": "30cbdaa2abadf077180654814b4bdb48f27d5e85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401509, "uuid": "c929e5f0-7966-4b5c-beb8-d9bc2b9505b4", "comment": "Malware payload (QuasarRAT)", "value": "80bfb80329e3dcdd3d95a8504a711a44e3787614377f93dfa32cb7c1b710d914d55961c89449a20add49da84ae79691a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401509, "uuid": "6f26e219-58d8-4dc5-becf-90176cc24943", "value": "T1740523250E0CE56FCABB0939A4C791C6C7E58B62059BF6AB21C411F7FF547A20C1527B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401509, "uuid": "a0628d21-130d-4f09-8985-67cd290f4e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401509, "uuid": "5bb98be4-2425-4101-9f33-333b1d5f9dd5", "value": "12288:Fk36wcWFZXyj7mMpLbNtwWx4s3TXoJfjXL8KMPyJFN2gdutSfRv0w6mo:DLqZXyPFNECOfjAlPWFN1duESwdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401509, "uuid": "075321db-30a4-4273-8115-e8435191f6d0", "value": 837632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401509, "uuid": "8758991b-c099-4398-b15e-960ef9f2c629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401509, "uuid": "517202c2-f83c-415b-ad42-09917f2e15dd", "value": "b73186130c6c8352436f88a1a86bd16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c80e59-ac97-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676400418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400418, "uuid": "fe325537-4353-4809-b7d4-e1e45990bef1", "comment": "Malware payload", "value": "7b8d7292bda56fec6e8bcb8a02be153f", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400418, "uuid": "6cddf7c2-6b41-4fcd-8c77-e891d15a98a3", "comment": "Malware payload", "value": "60deac6ecb905441670f140e0cbdfbea2883e871b5458c84765db11ac86ffe17", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400418, "uuid": "c3180cfd-bbdf-4c24-9797-7e5997ad4e83", "comment": "Malware payload", "value": "99b849805b555bc5b5b34e9b7c5229e022a44594", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400418, "uuid": "b5ecf04f-1165-4daf-81c2-6b74c7d3de9e", "comment": "Malware payload", "value": "8dbf048612f979af065dca44d8d936a8e7e8867913b287be6f9e657615a7e49d37203c0ccd670a85ceb1a6df0ba60d39", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400418, "uuid": "2268036c-dc56-41d2-a73d-652b901cf67e", "value": "T18DE4941169E40B76D3BA2B75ADF18D13E5A27B73B9208F2F4247221D0464B06DDB1E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400418, "uuid": "80de7f0c-d10b-45f1-a283-f9fd0310ec30", "value": "6144:ShxYm1L0Wqvjb+KE1GNC6R0ZLBiRhdvhN08TU5u7WG7s+7NDfHK/ZnB4eQ/ITFOA:ShLRkjb1zOZLBibq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400418, "uuid": "4c5e808e-de0c-4f7f-88cc-87a69d80b27a", "value": 689222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400418, "uuid": "918d84be-e726-4b51-bb03-e3846b17c39d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400418, "uuid": "b5a1dcc4-dd53-413c-8836-6c3aafdeec43", "value": "Contract_2601-Feb-06-23.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ffb298-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676399881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399881, "uuid": "4433eb72-808d-47d0-87d6-80732bc87c1a", "comment": "Malware payload (Quakbot)", "value": "94d021801759c107f5f8dd8fef42d686", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399881, "uuid": "abd9023f-5dcc-416b-9a1a-2942b2e4000f", "comment": "Malware payload (Quakbot)", "value": "60eeaf8a513588721d79654147873245acf8e74ede677707e370acf1782148c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399881, "uuid": "6adaa364-0106-4fcc-9204-870ca448ce5f", "comment": "Malware payload (Quakbot)", "value": "136b2a0b670d575fb78711efb6a811594a019983", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399881, "uuid": "e2267e82-a21c-4653-9ebf-6296353cb21d", "comment": "Malware payload (Quakbot)", "value": "7f702c38a42b3893db8b6a826f2624778817aa6c96d330b1e0795e41935449febf9a1e1fe82b105f4644c262787c4ea2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399881, "uuid": "ad962595-cf9f-4449-863f-7ee5ded392b1", "value": "T1BA947D2BFE8F10F9ED1B04F68047F77F6D3C53698A20CCA5D8580E59ED656A6400AB1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399881, "uuid": "81c2e3e7-ac3c-4f26-a0b1-ab5b561586ef", "value": "4160b8ad2228905966ea106c1f7681d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399881, "uuid": "a5246bc2-936e-4ac1-9aa3-c9fa6fb3fed4", "value": "12288:rJZ701RXT1BaB4Irm8VGf9hyI8K9HGgjA:VZ701RXT1wB4Irz0f9hNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399881, "uuid": "28f5ee3b-48a4-4950-ae6a-8a1a07fe40c4", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399881, "uuid": "f35d29d2-d0e6-4eb7-a0a6-cc17a6f0c583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399881, "uuid": "a443ac42-77be-48d1-a6e7-381609f8368b", "value": "94d021801759c107f5f8dd8fef42d686.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a9d3a9-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676398968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398968, "uuid": "344f9cf6-80b1-4cc4-adb7-4efc770e5670", "comment": "Malware payload", "value": "d6241fd9ed697d654a43c6af13d6228f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398968, "uuid": "ab3b5bb0-6195-4f72-93fe-c12de499e180", "comment": "Malware payload", "value": "60f612dc50ccb01def231baee0299631bec50ee7b2a83720ca23f48ddc3be2e8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398968, "uuid": "cb16bcee-7e8a-4e29-928a-e6469e162be7", "comment": "Malware payload", "value": "85a2a2a92ba046771e3b8574197cd3c94a7a8e0f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398968, "uuid": "fa47b7a2-71da-4246-965b-f7e3b4f9463f", "comment": "Malware payload", "value": "4270020f72891b476a954ea9f57b7d67c40362da8154abb24d41b14d0150a05e24bee44e177a405fa122099c03c77851", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398968, "uuid": "63c2bf49-bbec-489b-9822-a7a67f94ce97", "value": "T1FC9107722B4D1EEBD427C8F5D9893E221962F73B5AEB0581A32DFCF20D27195A835D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398968, "uuid": "8373f0a9-408a-401a-b94e-4b617493406f", "value": "96:S5HrQ9Xzr/vgF3ihApewoQfDvPzynmz4ZWhVgtMu0wH27fbMNXZvuz:e8jrvgF2pKz31hoMFFiJGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398968, "uuid": "9d4a851e-5385-4388-879c-c5f7bcd020da", "value": 4551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398968, "uuid": "fa87d3f8-e2c4-4cb3-8b10-24b5993407c3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398968, "uuid": "0991d58a-f51e-4ca4-bc5b-12fbc33c3d55", "value": "LPO-02 2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3dc51b-acb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676411647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411647, "uuid": "274086fc-f106-4184-b95d-4db529b8fe4f", "comment": "Malware payload (Amadey)", "value": "39743ad3f7c448d74c2f426113c5c561", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411647, "uuid": "ad3876e7-8e9f-4e07-8115-6f57bdd92966", "comment": "Malware payload (Amadey)", "value": "6105895a641a7c7a75c8ae9dcf84348e7994a11d4fe2fcc0fd3a129785b520e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411647, "uuid": "00ed7580-999f-4370-bd5a-5f2fb4b185a9", "comment": "Malware payload (Amadey)", "value": "3e482f7aa7abf8b6650f4b6baeb48f7bb37ed893", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411647, "uuid": "3341c6db-054c-4961-8898-987555b28a1e", "comment": "Malware payload (Amadey)", "value": "bdc7cf21a5f41462daace44cba4680a3742079d5c792bb99da2986313783e4310e72e595bbaf0a44b74fe77dd1eaaed4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411647, "uuid": "b9517e55-f5b8-4e44-8527-f521096b9d3c", "value": "T14C151207FAE88033D6B113B41AFF02D70635BE629E7C878A624E5D6E5872370653479B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411647, "uuid": "0b3edddc-a685-4424-a548-7482fd21af44", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411647, "uuid": "8ae33ed4-9b5a-4174-9139-0ae2de69239a", "value": "24576:ayo0HVyRaij3HaM8ItMKc2W5IjmSdbxTvhGn:hlHLi/ftaCmKVT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411647, "uuid": "bc2047de-7d95-446d-a7b3-76fc38d1368a", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411647, "uuid": "1d3f11e7-58d8-406c-96d6-15501e2542bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411647, "uuid": "8947602d-fe64-42de-a6b2-0915e454d842", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636ac899-acb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411339, "uuid": "68e4008d-f9a5-4be0-9064-a112cc4fb9f9", "comment": "Malware payload (RedLineStealer)", "value": "614d03e5c43ee3dc38cfd81ab53967fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411339, "uuid": "7332536b-032e-41f8-b122-0d941662f866", "comment": "Malware payload (RedLineStealer)", "value": "615dddcea36f651243edb8656ae72ea07e84ffc83b0524c6341200573fcf3346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411339, "uuid": "ed81dfe1-e784-491d-9cee-907ef61159dc", "comment": "Malware payload (RedLineStealer)", "value": "90550d6edc97133ff11e60074c89aece23a16b7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411339, "uuid": "5566ba63-b4a6-402d-a6d8-639cb971cd67", "comment": "Malware payload (RedLineStealer)", "value": "baa8a3af556f394a7ee46a82c3151856b01765e3845d29e85348dfd926dc77665fae5b1d9f307cf4328d4fe4afbd30b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411339, "uuid": "2ca8197f-61fb-42ff-b0e1-9c55e14cb50d", "value": "T1DBC4020BE6EC8072F9B45B7019FA12C3063EBD619E38469F634F9D5E18B22617630767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411339, "uuid": "e61f54ca-48e3-458d-aa57-c493699257d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411339, "uuid": "1e09c255-ed20-410b-9b38-08c5287c4ac1", "value": "12288:xMruy903OgVgP1hC85i0kjefRvTtYdh2E/dpoxV5:jysfi14Gi0JDER/Lox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411339, "uuid": "9a065538-da5b-45de-86b3-4c866d2eddd8", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411339, "uuid": "f416ecc6-4b90-40e2-9da4-be27f965f78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411339, "uuid": "92c81e65-bbb0-40af-a1c4-f3bec385780f", "value": "614d03e5c43ee3dc38cfd81ab53967fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167a021b-ac3b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676360529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360529, "uuid": "9c7ec815-5153-4cbf-aed9-04ce2bf23233", "comment": "Malware payload", "value": "cf8526a2fbc2d87213ca270ed732b63c", "object_relation": "md5", "Tag": [ { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360529, "uuid": "868de51b-4e22-40a0-bc0a-ea1fac7df852", "comment": "Malware payload", "value": "6191b09d4b59f6c0fb1b4e0c95bb2f2294298cfa914caa5c967c7f36b9b8613c", "object_relation": "sha256", "Tag": [ { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360529, "uuid": "6b424538-86a2-4fe4-ac11-8bebae9c5f3c", "comment": "Malware payload", "value": "dd8e21edbeb1e10c5a988ea2ec889e3b3a8e3055", "object_relation": "sha1", "Tag": [ { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360529, "uuid": "a4def4e4-f270-4373-a678-4a6a5cad40d9", "comment": "Malware payload", "value": "f94b64ce0fca6fb0e07eae4945d805b7222924773b3a8a557b3368b97775f2957eab353eb99bd256fa4b23120d05c149", "object_relation": "sha3-384", "Tag": [ { "name": "pps", "colour": "#AF9D40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360529, "uuid": "30c5cf3a-8272-45da-95a3-91f2a67f0955", "value": "T13C339E5BEB82AA5BCA5151B9C89E87D1B235FD04D632CE4F3480B70E2D712CB1F5629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360529, "uuid": "53752646-ad7f-4e6d-bf0a-4701307915f0", "value": "768:3vAa0acPz7AjkfEsi09kTWXdqAHe8CDx1pUhbeGbHGrC3C2:3vAmECr09kT600eT1eGrC3C2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360529, "uuid": "348cb8f6-e7b6-4a7c-b08a-f710d7072f89", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360529, "uuid": "76fde529-dec8-43ef-8329-02d1faba7270", "value": "application/vnd.ms-powerpoint", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360529, "uuid": "57240203-bb90-493d-91be-7750ba4f6b02", "value": "CVC-JUDICIAIRE-1.pps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aef7b41-ac14-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676343760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343760, "uuid": "478d533d-8078-4e92-84fa-d6ad7662b189", "comment": "Malware payload (RedLineStealer)", "value": "9560cf6ee6e7da33185bf2aed40684ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343760, "uuid": "0e5d3abe-ce58-4457-85a4-12536d1eb9bf", "comment": "Malware payload (RedLineStealer)", "value": "61aa84f3e7f8f5dd167c12da1441e6ebed94e135a8d70077dba311936fcbbf27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343760, "uuid": "ae10724e-f82d-4b8f-aae0-a5c9ba027701", "comment": "Malware payload (RedLineStealer)", "value": "7f727de9c00ecd731cf7b79d311791373480fc50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676343760, "uuid": "be906367-99b5-4d75-a25d-5fa16b8a3cec", "comment": "Malware payload (RedLineStealer)", "value": "1ef44e6d8faf8ba709ef2588aec5257d3845409eb4da85d3e5e855517ba901b6788d16c7ab1dc1ecef05b9a6f26312c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343760, "uuid": "1c2e761d-02d7-49c0-a80b-4e44bc3e1836", "value": "T17D64E122B3E1E471E51246315836C2E4A6AFF8618BB596DF63906B3F0D702D1CE7B391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343760, "uuid": "3b7b6af4-1b4c-4007-b480-9b9c1c5fbdbb", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343760, "uuid": "a84577ac-dda2-4fd0-afdf-44b7fa1e8126", "value": "6144:v+49R0/VTpBjXU2zg/3IOt83o8PuVqVqeVRSgSUCRmyf:v+4ATpBY2zgb6P2qVz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676343760, "uuid": "69a0cc18-5b12-4eff-874c-3cf6ca617477", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676343760, "uuid": "a7972145-e7e8-407c-9457-b24709400244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676343760, "uuid": "c46dc62c-9294-40c1-93e0-248c4500caeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790039fe-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381310, "uuid": "fcbf8a03-974a-419b-8b62-13710c9596c2", "comment": "Malware payload (RedLineStealer)", "value": "cb62b107b18fecdb595251801992d2df", "object_relation": "md5", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381310, "uuid": "376126f2-6159-4cc2-90fb-515dd164f391", "comment": "Malware payload (RedLineStealer)", "value": "62061f2ff5f75c7450260f161c0adfc52622c8aa09bb461d594b151ce1fb47b0", "object_relation": "sha256", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381310, "uuid": "7f137f91-8921-46d5-aaa4-a69baad41ee9", "comment": "Malware payload (RedLineStealer)", "value": "ec5e1f42bb61d1f9110d7f660981b02bd886b94c", "object_relation": "sha1", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381310, "uuid": "d25cfcd8-e311-4964-a47d-a0326d42d84b", "comment": "Malware payload (RedLineStealer)", "value": "3de91b3c6fc263f00822dd502f3be68847eb86381de0841c9de43c9816b4d06bc2c89950d751a21626cab9b38073b170", "object_relation": "sha3-384", "Tag": [ { "name": "201-184-48-82", "colour": "#46D217", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381310, "uuid": "63e1f869-3d3e-4627-b538-c32691948dcd", "value": "T17E8622E4149212B4D0EF476060C6078DA9E07AD866FCAE2DBCE01C525F54EDF358ADEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381310, "uuid": "90b94fed-7911-4070-a34f-f47b9120f68f", "value": "353dcc871fe8e730342da58283dc599a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381310, "uuid": "e9fa9852-5d4e-41ec-8c72-cb48233c73c1", "value": "196608:dMa7IvaNhS+LqdNtOhG4cn/FzZnNgsGI:dMkIvQhNqdNtOhG4AdZyHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381310, "uuid": "e1bc1600-4f59-4bff-b812-7951f1d755b0", "value": 7852544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381310, "uuid": "cab1421f-4b2e-4e4a-8b2f-1ae445022e19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381310, "uuid": "8c45f8f0-e530-4c46-9412-0b735b7f7414", "value": "meta_build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07406d9-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676399899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399899, "uuid": "cc915020-20d8-4266-87da-1b59dba96378", "comment": "Malware payload (Smoke Loader)", "value": "462c4ee3ed98352a8e3f5b8b1b71dfac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399899, "uuid": "d8ffd62a-a35e-4e5e-b0c7-c732349077ad", "comment": "Malware payload (Smoke Loader)", "value": "6215b8732177d0f5efec6b7e798416a29a67833258ff60860b79eb618d3808d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399899, "uuid": "9e669c9a-7445-42b5-8f5d-30539c48ac36", "comment": "Malware payload (Smoke Loader)", "value": "53e7780c3e7fe6e8fe288bde903d0774210308cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399899, "uuid": "c209218c-389e-4314-9d15-bc7cf91c7085", "comment": "Malware payload (Smoke Loader)", "value": "997a9bcabf6b3c13030b91a502da5b4e203fe11c4763953e5f80a3ef9a44cfc77b269f201d29ad99b119850a50a579db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399899, "uuid": "f92941b6-4c0c-43a7-acec-2fd2b017d38c", "value": "T13424E01379E18333D26385341932C6B06A3E7C7DA7A0849B235A176F5E317D28DBB35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399899, "uuid": "f059a730-b874-4380-959e-36873d9dbcc3", "value": "033c129a4522b4dc7e5484557290091f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399899, "uuid": "f2fa86e6-7e68-4aa6-b7cf-58335c0d6e4d", "value": "3072:dgnL9Jf5oFWdJoS0V9Pee6Ikn1k4rez7HqeaOKzLi4JFyVWb14+j1nqc2FtJ7o:CL9JGRS0VE1iCenKHfLvbmqnqh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399899, "uuid": "1afbe0b5-7691-4375-8d74-b8af099e157f", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399899, "uuid": "d22bb838-18ff-4a12-92e1-9b25bd3f1691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399899, "uuid": "645089b8-4548-4612-894d-3e937c3f8f38", "value": "462c4ee3ed98352a8e3f5b8b1b71dfac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ded2791-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676392942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392942, "uuid": "16db68f1-5974-477e-a953-036cea911057", "comment": "Malware payload", "value": "94912f4d57946eab51d9fcb71f51b6c9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392942, "uuid": "42aed2fd-c0c4-4140-80df-a36be8ca4b13", "comment": "Malware payload", "value": "6229185c918e77605eb8e7e846eb34b5de05d9104b410c0e0165b7d9977d12fb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392942, "uuid": "7e9dccec-36ca-4507-8aa1-aba677bd6fc7", "comment": "Malware payload", "value": "01b8e8775733f6fd1c659e8c4e0c80fc25a5b535", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392942, "uuid": "fd0cb808-c416-46bd-8130-fed9b06420e0", "comment": "Malware payload", "value": "ab857a9ab120cd249b052af7a95b287beb271c0fcf258c2d9d4cc488e6ed8c58203b391e5ff6b4731c91885a23323d16", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392942, "uuid": "c0b5ed73-f46e-4f55-8770-598834e68482", "value": "T19065122BD472BE5DC827C73C88EEC2320043AC306576D45AA8157A7D55B3AE46AFD39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392942, "uuid": "3efa478b-9473-44fc-88d5-fdb11d312a1d", "value": "24576:NYYV2rSC2Tt6XZxobPYr2HxwUJWT1XpKvPnAXREx5aIhtY9H/Ar:5Er2Tt6Z2SAmUJe15uAXwDhtYB/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392942, "uuid": "0f65097d-ec8f-4d92-9b71-56d0b3dd470c", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392942, "uuid": "1ca0bea3-3338-45f3-93d5-7b1ddca7f1a8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392942, "uuid": "6e5a4828-e6b4-4ba8-8c2d-748a266172bc", "value": "New Order 2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958b4141-acb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676414000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414000, "uuid": "2a1d46a5-72f0-485b-adac-dc0761e7e47c", "comment": "Malware payload (Gafgyt)", "value": "1cb139354c7de32c0eccc5ae4d09d387", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414000, "uuid": "22043e85-a66f-44aa-8b2c-471133934727", "comment": "Malware payload (Gafgyt)", "value": "62621ded0e4851d27c89e504e05ff10e163be0f2b4b5c1193920b6ae47d247d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414000, "uuid": "674ef4ad-b692-44e9-9e45-a70d1c309b25", "comment": "Malware payload (Gafgyt)", "value": "0901a1867b3f2997d896401986ec99bc3a676347", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676414000, "uuid": "39944ff9-ea5c-41e1-bfc0-d54937296961", "comment": "Malware payload (Gafgyt)", "value": "cb8f39120aec8f44f81eaed7df9b8c30bd2d6c93d6b0964850f56114560fee30deb227c2c3487713775d7fba79a66e81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414000, "uuid": "36e6f2a9-1fca-4b8c-8165-65b1e766fea7", "value": "T194735B46A640D6F7C14306F1069BAB98073AFD3A1ABBEE85F3587CF48B710C47925B19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414000, "uuid": "2b94f6b0-dc10-49f8-bf3a-a89cdf5e8fc3", "value": "1536:8x4WwS7y6stOSV9zyjeYwMcp5WLfuBs1T2T/O/sEjw2ol/SFLZ5:8xF7x+R9zyjeYwMcmLfGSTu/vAw2H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676414000, "uuid": "e0962538-800b-4a1d-8295-04e5894ec0aa", "value": 74487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676414000, "uuid": "4b3c5f9c-bd34-4fcf-951c-d1c72c3ef3fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676414000, "uuid": "ac9eb6b1-fa8b-4e50-a344-9399008766d0", "value": "1cb139354c7de32c0eccc5ae4d09d387", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266dfd7c-ac75-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676385467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385467, "uuid": "045d72b3-c820-4451-b664-de3e4d7e63ed", "comment": "Malware payload", "value": "58051d669cd3d3f6e14843d3ce106a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385467, "uuid": "4646393c-64a4-4343-bb4d-a0ac355056ae", "comment": "Malware payload", "value": "62a16520f7463870e08d8ba0c4cc43298c047fb2a2537471263538f6fd8454c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385467, "uuid": "7400e302-5c65-4798-be48-a8f4188472a9", "comment": "Malware payload", "value": "0a6ddf589bea94f229d8e36a1e846869fc3eec74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385467, "uuid": "b3191480-4e67-4fde-94e2-9e58632d3fcf", "comment": "Malware payload", "value": "d8a6f0ce8a6b47a716a8e72faa569b50e6afe23331fa813e02036ffa773531fa36801ec4f2dd23baaaf49278f27f0747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385467, "uuid": "d5116ae3-a771-42af-9ab0-01f1f50da2c3", "value": "T1F2636C61B1D0C032D0A7A5304CB8CE714BBFBC111A798D87BB98163F5FB16C25A7979A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385467, "uuid": "4db8d7c7-5dfa-4fc0-a1b3-b3ebba9810eb", "value": "99c11d488d3274f9045ca98bae29cc2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385467, "uuid": "31d1c16e-22b3-4480-a5aa-e5cca76c54e9", "value": "1536:BFIUn3hHFeTNX55DMRWhZYLL4rnG7lQoPGb6kbIhX:bIU9FIha/4etv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385467, "uuid": "d1b11f47-50ff-46ac-9602-dc79fa351dec", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385467, "uuid": "a5221fa8-cc5e-41b7-baae-0315454149be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385467, "uuid": "1f8512b9-06f4-4887-8808-57c52661ac1a", "value": "SecuriteInfo.com.Trojan.Loader.1303.2695.16021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfca3b0-ac92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676398255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398255, "uuid": "954e83b3-7c16-42b8-bd86-85da4e410a2b", "comment": "Malware payload (Smoke Loader)", "value": "4c3f5457f5fd1d2e0671a41d45cb94b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398255, "uuid": "ba0c0c3f-9803-40fd-a43b-16a5ed416912", "comment": "Malware payload (Smoke Loader)", "value": "62ac816d53e063c4e2a1c632aeb8fa2b5254ff6ad7f88c8f53877b43180cea6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398255, "uuid": "527d3410-b2c4-4c45-91e7-a1cb960d6c09", "comment": "Malware payload (Smoke Loader)", "value": "18ccce7db5680860d55b9833e433d1f99afb4794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398255, "uuid": "2f1d1c0b-971f-4a26-881e-b1ea451c0933", "comment": "Malware payload (Smoke Loader)", "value": "ad380ecc543fe5938f883e399e4c902af8c45e4a3afc01a166473a1a2b2f7ced7a4e7fd782c53641d6625f2f035f8649", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398255, "uuid": "2b2681e8-c90c-4214-bb12-8993b3634dd3", "value": "T18314DF3135E09072F55B497488A1EAA06A7FB9F357B5814F332817AF2E303D187763A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398255, "uuid": "a8659001-f17d-4e89-a9a3-7be4896a9c5d", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398255, "uuid": "d6840ce0-1bde-449b-9d40-91ac42f5eff8", "value": "3072:deTYL3foy5VIs0SBL/evAPUJbwDfDjY+0rM8DIQy4v2XRa:hLPoGIPiehoo+z8D7y4vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398255, "uuid": "616125cd-59cc-40c8-a09a-442a5471e894", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398255, "uuid": "3e57e72e-75f7-4b98-9e6c-06537166a8ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398255, "uuid": "a9795184-d868-4059-a1ea-a3c1ce920724", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbf8512-ac49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676366848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366848, "uuid": "7d913204-b7a1-4718-887b-b41ab5f7f418", "comment": "Malware payload (Smoke Loader)", "value": "38e83729cbc213f277eea5f8e529ffb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366848, "uuid": "b2d3691c-48ca-437f-abc4-d4a8cc1ae58c", "comment": "Malware payload (Smoke Loader)", "value": "62b09d92565241be83096a78a7dcd5a550c25788e711cef9d52bf95e9bfeb60c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366848, "uuid": "5e40a1c2-b908-4d3e-a6ad-30edc79236df", "comment": "Malware payload (Smoke Loader)", "value": "27239d6c72edef68594b67f688ee9abbee718097", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366848, "uuid": "85fd8b37-d7f8-484a-aeb7-331a63cfe45f", "comment": "Malware payload (Smoke Loader)", "value": "4a8d5258135de2eeee7635817d1520c1a67a7702e909f8f7f267d14494cb1a6eb816eeff2760873da7c06ba81b0dab6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366848, "uuid": "24ca629d-9b99-4b1c-8114-4900f5bc3306", "value": "T19604D00175F18073D463C17814E1E6F0EA7FBC72576580D33B561AAF6E202E18B66FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366848, "uuid": "199be5b5-0e58-4580-9209-c35cab2d3199", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366848, "uuid": "5a913ce2-7a44-4e53-91be-3a9e52ff4d70", "value": "3072:SojvLIMf5feiCL4Wk+JNvipeCeVi/zkV1AUQ/cYff9evHY6Z:hDLIMRer7jvfCeKwbQ/cYn9ev4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676366848, "uuid": "6d5f28f9-35a8-4bb6-9a3b-265076972d7f", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676366848, "uuid": "17805de2-6183-440a-bf5b-e6937d3566f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366848, "uuid": "e12e4d03-ef26-4ece-acf3-5af49b4052fb", "value": "38e83729cbc213f277eea5f8e529ffb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ee88d8-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419120, "uuid": "bf60cf5e-67a8-463e-9caa-50c3041a7b09", "comment": "Malware payload", "value": "0b6cbf18841285ac091f9498e173b607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419120, "uuid": "b7331d83-8a15-4198-8d8f-1fadbd7c4581", "comment": "Malware payload", "value": "63662155a7e641c99fa72a3f277a209b51ef10446d54d3b06920d3561bd0dc22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419120, "uuid": "847cff35-014a-42ac-b634-952d41abce69", "comment": "Malware payload", "value": "2c20b2b20bb87be52b80b66e097b13b2e639e8d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419120, "uuid": "f1a2d4c7-48fa-43fd-aef1-355b03c78844", "comment": "Malware payload", "value": "e3e206126008341bf4e894294fbd00f8508d5a0e3c67c73a17b5d4699793f56b0b29d5623f2404748ff6c90b83429a0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419120, "uuid": "d0c324fb-d6ae-4ad5-bc54-0f7d887210b6", "value": "T1F1C32A04F9018767C2D327B6A68E474D3F3517E453DB33166A38AEB42FC27992D25E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419120, "uuid": "4b7ce0bf-766e-4ef9-b9b9-21486d882bdf", "value": "3072:jogfqPdx1YA2/FhGS5iqvIwLmUwrQRhk4rNXhLe:0Pdx32/Fh15immUwrQRhXrNXhLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419120, "uuid": "b060e4ec-3caa-441a-8837-8e2bc7d3f104", "value": 125549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419120, "uuid": "5d8422f6-3d50-4246-89af-b0deb8f0a9a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419120, "uuid": "8b72619a-4050-496c-bb41-2323827953e1", "value": "0b6cbf18841285ac091f9498e173b607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704cef3d-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676381296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381296, "uuid": "c083284a-04fd-4a37-9e1b-814d4497ed18", "comment": "Malware payload (Smoke Loader)", "value": "d418791f343e4c979994d9d719a4b720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381296, "uuid": "b58bf49f-4c29-4d3f-a07d-7aeaad31f625", "comment": "Malware payload (Smoke Loader)", "value": "63e0fae716f15b64e33db258f7cf2cedecb069dbcc8ac88518585714017d5d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381296, "uuid": "bbf77d47-6e09-4ced-b315-5f11702a86be", "comment": "Malware payload (Smoke Loader)", "value": "d927d18128529eb622bbfabe805a483034980286", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381296, "uuid": "922427ec-71d1-4a15-82c8-2239c633938f", "comment": "Malware payload (Smoke Loader)", "value": "76ec7471e37316b16cbb74edbe6639ff7190e8a45c64a8ef29e1fd08b06338cb7c09d9e89d9bc754c31bd8c7a81c1e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381296, "uuid": "14619097-6419-4d76-aea7-914ce6deb75f", "value": "T17004CF323AE08077E46B85711831D6916A3FBC72A7A1C587331816EE1DB07D29E767E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381296, "uuid": "7954e261-2249-4fc8-b9db-08c4acad5406", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381296, "uuid": "36bbbdac-d791-406e-b507-413b304b17d5", "value": "3072:Zod1xx0xLum25nF7TuIWu8KSN1eiJUbgTBNqcFMywaAp1FBLa:Cd1sxLumcNT1Wu8ZN1nJUbmBNqcYDZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381296, "uuid": "711c2942-c1e9-4857-aa91-169f7bd22812", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381296, "uuid": "917af914-828f-498f-9d40-e72cf9cc6c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381296, "uuid": "3b057c43-731e-429d-b3da-4fd911ae985a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0019c124-ac29-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676352761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352761, "uuid": "082efb2e-9910-46f5-99c0-91d530e206fe", "comment": "Malware payload (Smoke Loader)", "value": "a4f0c7c74f75ba51169a180a5df9cdcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352761, "uuid": "72459aa1-732f-419d-8b4a-4968a0fdc24a", "comment": "Malware payload (Smoke Loader)", "value": "64005cc1983b72d204612980233a241649b3d84202baba068cdcdb39b9e6e48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352761, "uuid": "4e2a1d32-d84e-44b5-a3ff-2cabb7ec51ae", "comment": "Malware payload (Smoke Loader)", "value": "2622c67e3f587a9235d02c729333e36ad9620b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352761, "uuid": "240e37b8-daca-4fcf-8925-b428a8409b6e", "comment": "Malware payload (Smoke Loader)", "value": "6788c323b84d728c1660fbb506ee908785e657526f68b8426a034da9eb176f391df87337711386cde1a08a9769a37744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352761, "uuid": "5d6c5abd-622e-4b7e-96e4-2ee7eb66c548", "value": "T19304D01239E180B3E5578574793DD6E03A3FBCB253B48D97334416AF2D212D2CAA936B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352761, "uuid": "6c907f54-8545-478c-94fd-3966e4ed8605", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352761, "uuid": "c0df9f01-dd74-464a-8d1e-e400af676fb7", "value": "3072:qoYMLiYZx5f/vp5VAfZOqZFRv7httqyT8BSzNJnprd3O7B:JfLiYZzCffLgyT8BCjpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676352761, "uuid": "26b67752-0a1d-4e1d-9e21-d1374434d4a5", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676352761, "uuid": "98d66b7e-d2c8-41b6-9ec0-0ca1b9521c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352761, "uuid": "5ece7234-ce2f-45de-924c-5dddc00a227d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c087575-ac0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676341829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341829, "uuid": "dc28e97b-d92a-487b-b7bb-700f9547a8bc", "comment": "Malware payload", "value": "181ecbd14472469ec221b7916ac495c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341829, "uuid": "1c58e9b0-0ac9-4899-888c-6d3a75550753", "comment": "Malware payload", "value": "6412f204d63c94b0197ab06d359943705433d53c7b4e65c0b73e0422ca70c03b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341829, "uuid": "849ae0ec-d7ec-4367-93ab-067aac73b8f1", "comment": "Malware payload", "value": "eaca2715a68e7f2931abc5fbe22bcbb0d3834ecc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341829, "uuid": "5662ac60-2f95-4ec1-8025-eebcc6f00a1e", "comment": "Malware payload", "value": "0c19abca32061c03570c6ab517bb21669dbdc6ac03297f72f6f017bc5b0682d619632ef882867673ac34c13692f45904", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341829, "uuid": "2c7a9b5b-696a-4e45-b8bc-dfcef40f3671", "value": "T14BE2B5E799C12DB606248ED9FBF18112C2535D38100DCC71F6ACD93F2B4A5AAB426BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341829, "uuid": "a037e598-6fee-49bc-a287-12b234f7fd67", "value": "768:XS4hxf9XaMBIwiU3w3wjA8O0HOe2wiU3w3wAe0OHenwiU3w3wjA8d2HOe2wiU3w5:jVf9MEOhepH1POOhdbHOsKOha7HPds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341829, "uuid": "ef2c85a4-8d86-471a-b7f4-8fd15c74802d", "value": 32601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341829, "uuid": "11a56a1b-b0b7-4755-9439-e424973128fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341829, "uuid": "311f8676-679e-4086-b663-498831176109", "value": "injection.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d088b3a4-acab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676408945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408945, "uuid": "026b9bba-97ee-40cc-8a12-63a51e61e2d2", "comment": "Malware payload (RedLineStealer)", "value": "4feef54a72ed241bd3529f9e889eae84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408945, "uuid": "9272fe3c-8981-44d6-abb8-25d16f63fac2", "comment": "Malware payload (RedLineStealer)", "value": "64425f2f481ec70d16dd8affb1b3e9cc9b66e04c6fbf7c7757d49902f6ad3685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408945, "uuid": "2237b9e8-b31c-4c6a-9d5e-76f18071bf91", "comment": "Malware payload (RedLineStealer)", "value": "af151922063e70a74429facd3362ae3db4cfe2e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408945, "uuid": "e12b8df9-76c0-45eb-8b8e-8e9a2d76270e", "comment": "Malware payload (RedLineStealer)", "value": "41ffbc135825ba05085cb6d397338f4cc24ce128045f5279a93e8ab2a453bbda6569aad1b68b71a092543d16e9297d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408945, "uuid": "c24fe9f1-5ef0-4942-9d13-1efd0116cd9b", "value": "T1ECC40143F7E85122E97957B009F742D30A36BE601A7487A7334EAD5A1CB2670B67133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408945, "uuid": "65e446b8-b4cd-4025-8872-d6e713c38845", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408945, "uuid": "88870f82-fbc4-45b6-a155-4215bcc73f09", "value": "12288:FMr0y90O2bOE0t9/rY5SetdY9Ux4XTgDcJ:9y38OEsTY5z72XvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408945, "uuid": "951fd104-45df-42fc-93d5-e3a645ef1eda", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408945, "uuid": "cbaaa3ed-9bb8-4ebe-b4dc-35c3b5c9d75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408945, "uuid": "4bbef6c6-be93-4ecd-a820-b93475de7b6d", "value": "4feef54a72ed241bd3529f9e889eae84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541cc407-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676386403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386403, "uuid": "fed938ee-a561-4cec-9275-45ebd4289a0d", "comment": "Malware payload (AgentTesla)", "value": "0eda9f3db64c507ae3dfca2d07d2d479", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386403, "uuid": "0deaa3b0-5312-441c-966f-5d373bf23062", "comment": "Malware payload (AgentTesla)", "value": "64d60461811d52c28b607030e62c33c4b04e2835c199d5121c5bc062b4bd3152", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386403, "uuid": "43cc4456-971a-4172-95c9-85965e9f3006", "comment": "Malware payload (AgentTesla)", "value": "c79d54ac3b3a5a55afe5329d9757ffd2ae4b870d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386403, "uuid": "2a4330e0-c4e8-4a27-879d-70694ccd1746", "comment": "Malware payload (AgentTesla)", "value": "7050b5b7867a92ce5d8598b8643eefaf955f8ef037a1939d496d9a3050e085ca6613ad2f4f7b7ebb61ecf914e4b77e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386403, "uuid": "037abb5f-65d3-49c4-bd22-c96a146e9bba", "value": "T152E4B32AD9BA17E7C039F16282A54828F8ED8553331FCD5AADD317D60F80501AFCA5DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386403, "uuid": "cbb0267e-0c9d-4c9e-a641-1bcc5999ac4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386403, "uuid": "425ab518-f117-4482-a654-d51042391ae3", "value": "12288:4faJdRhQmOyemi1bFsOX6NTnrtOXA+/0CPZfBtqNRvfAzaQE5n:4faJdAjsOX6NTnrtOXA+/0C+aun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386403, "uuid": "a9d1780e-e4b0-4fb6-b7eb-916771035831", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386403, "uuid": "52de7da0-183a-48e4-b2f5-9bca15a90e95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386403, "uuid": "564d6740-fd06-45c9-9753-a97c5520a494", "value": "Purchase Order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e7cdbd-ac72-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676384315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384315, "uuid": "d1df6029-641b-4a83-be31-a01f20cac9e7", "comment": "Malware payload (GuLoader)", "value": "8a166e2260f84df305c1ec650c9f34da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384315, "uuid": "9f37f16c-4ee4-4a98-b512-e34a31c86d5a", "comment": "Malware payload (GuLoader)", "value": "652882e3911376b2de4213cc09b70ffd0be4c65cb287103e0e2f3e870df05e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384315, "uuid": "01395b19-c023-4f59-9952-dffece51b2af", "comment": "Malware payload (GuLoader)", "value": "e3175b892505283b4e5dac552d3e81949c0f795f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384315, "uuid": "dfc8940d-3316-437d-bfc3-270f3411d2b3", "comment": "Malware payload (GuLoader)", "value": "320a7239099e69d342f7f2493b337c64675784ca777a5b3b96cc24ac88694fd31df9a95e68220e8bfb6a353b43623d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384315, "uuid": "513cfc8f-b9b5-4fdf-9796-b6645866ca76", "value": "T1716401E091D648FBE59613B10CB3FE26326B6D6CA9311D172FA6BA211E73243153B44F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384315, "uuid": "09d77c7d-6046-40fc-86d7-e2ce511d2259", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384315, "uuid": "6acb4896-2275-4ab7-8bba-4d98036f5021", "value": "6144:gyIv4TblE+sbv+joAgTrFc8AFzcdPRdO5jbUaEgKLC2Koo:g49EEoAgT0FzcdTOBbGT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384315, "uuid": "7d5d21a4-bb9b-494f-b847-6b2cc52fa0fb", "value": 314608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384315, "uuid": "2ab35f69-32a6-4837-9b36-8f6c4520461c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384315, "uuid": "d03c16b7-ca26-464a-8e4f-13ac7e4f41d3", "value": "QS22225SHAMUB01_\u7535\u653e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072d3cf6-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676364369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364369, "uuid": "7ea46a49-6e8a-4f15-82a2-db7eb2dd2f29", "comment": "Malware payload (Amadey)", "value": "be86aa62a12552bcc5dc325ed95141c8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364369, "uuid": "ff09adc7-32b1-480f-8585-195eb5ff86d6", "comment": "Malware payload (Amadey)", "value": "65e42c13d1de74738a92304858b3e8e41fa79205f0fbc4edd0858f939b97f15a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364369, "uuid": "cfaeb040-2f20-4c13-ac21-af9ec71a1286", "comment": "Malware payload (Amadey)", "value": "0bce6e14cc1101039e2cdaf6db77b863b72fac0f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364369, "uuid": "3df46df5-91f9-4203-ba4c-b4b033f0d0bb", "comment": "Malware payload (Amadey)", "value": "f685d2a020c38e3e4279dde7d9aa5e9cf92e3e47bdf33c7a10743f4d540881589b9cdd1afaa517530ececbc7ccbfef51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364369, "uuid": "1d1b1632-0a79-4ccd-8eca-e2657c00bb78", "value": "T1BEF41203EAE89132E9B4677118F742D30A367D915A35C78B171A6D8E2D336A0B73137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364369, "uuid": "a6fc6a04-b66f-4784-8988-ae670c05a6c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364369, "uuid": "5870a5eb-7fbd-43e9-b30b-0fa8700ba716", "value": "12288:GMrOy90vmmsG1f+FXZXiI0e6APmh0IlqJvDwkJMe6A93IR5C153Lp4oNNoS3m4ND:kyUsGIFJSrHh0IlqJvDwY36q2C1Z3AcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364369, "uuid": "0f4a1148-b6b4-438e-a2bd-bfa488a377b3", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364369, "uuid": "b2521b50-b375-4139-8430-c054298c0c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364369, "uuid": "8aa2bb0f-80ed-477c-83e1-b487e19b0987", "value": "be86aa62a12552bcc5dc325ed95141c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4422fd-acb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411892, "uuid": "33699f73-9836-4a94-9aec-e6f6a4b86a2f", "comment": "Malware payload (RedLineStealer)", "value": "f6f59c7a04ebffefb8c26ac7e793830b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411892, "uuid": "d1d117eb-289a-4686-b45b-fb7b3d64b88c", "comment": "Malware payload (RedLineStealer)", "value": "65e511cf23bd6cfa2aaacbef01565f56a278c33b9396322c4022b88100c48425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411892, "uuid": "c162042b-43c0-40ed-912f-7757e99cbdbd", "comment": "Malware payload (RedLineStealer)", "value": "a3c5e62097ce27b7dbd81bfb130c7a6cb2238c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411892, "uuid": "d68debf8-e11b-4ca3-924c-fcb7416a6bf6", "comment": "Malware payload (RedLineStealer)", "value": "f994cdebadc196ed2458b940974115a7d172299209a8a2019b6c27d4df14a91caa48a354caef5f8ec7c4d34b5a89c6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411892, "uuid": "758b2bf9-ad44-4fd4-8f66-145cbedd64eb", "value": "T1BCA40257D3E99062E9B5637049F302D31A377E706A3883D7274EAD1A08B2670A73537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411892, "uuid": "3687abbe-89eb-486e-9de2-751d25bd30b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411892, "uuid": "cd091ef1-d4bd-476d-ba2e-77fc0766da12", "value": "6144:K5y+bnr+bp0yN90QEIVoUPyjqMC0o8HVmi9S2WBmkFSp0Vnx8hat9bybsIbar3xG:fMrvy902oUKZC0vS2ex+EmseajxmZ1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411892, "uuid": "907aa147-69e9-4b87-822c-4fd7d5eec5f9", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411892, "uuid": "7617153c-f117-4fe1-bf4d-0b3fe92a72d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411892, "uuid": "9bfa7b10-65f0-4e32-91b1-8033c42c9e03", "value": "f6f59c7a04ebffefb8c26ac7e793830b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a6192c-ac62-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676377253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377253, "uuid": "4763b4f1-9724-4a56-954b-7141ff60d744", "comment": "Malware payload (GCleaner)", "value": "803c20c673436aab31e37f01265a5c99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377253, "uuid": "37a27bed-b754-4d67-b7ef-f8584ba9784e", "comment": "Malware payload (GCleaner)", "value": "66400726158a31f2ae4aaa0a73c684d1df0f73d5ce3d9122e6e5a87021a12293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377253, "uuid": "45fc1a1a-afbd-44e6-a2ff-0a29339651d3", "comment": "Malware payload (GCleaner)", "value": "e9b44ea8b0ea32868d48f1f3c8e4048c4c29be34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377253, "uuid": "3a58fe9c-d34e-4552-ae18-1acd1360d3be", "comment": "Malware payload (GCleaner)", "value": "6d12744dc6a8545b972cd5aa9386b00d5de619f722d82462b11bf778cbb8276221fc9ad5a10a31b56fbf4c0214de4534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377253, "uuid": "8d67e049-6ba9-4fbe-af00-a1c78b56df56", "value": "T15CF5127C714984ADD284FDB08C3A98F79CDA6EE3E8A4906230CD7F3F55791858B1A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377253, "uuid": "de50e8ab-87fa-400f-b25f-e62d90056de8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377253, "uuid": "a9d8608c-e8c4-4d74-827a-a411a0c38eff", "value": "98304:JHWKi7MmMjfyJoOSe/fRnSWPjBjeQKacv2MR:dWjMmyaJoO5/pPBjeQrcvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377253, "uuid": "e870b3bc-49d4-43f4-b907-9e62c9cf192a", "value": 3358982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377253, "uuid": "8f43a19f-86f8-4474-8aac-f5f3e2a696b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377253, "uuid": "6fd2a14a-a5f9-47e9-ac01-88f4ae65d343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b320651-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392937, "uuid": "35c93a83-0d67-4b5a-ba6d-09c2204c40f8", "comment": "Malware payload (RedLineStealer)", "value": "4ab04ee36dcf96fcf74562c9c60c74f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392937, "uuid": "a4e35d99-90bf-4f1a-91b6-f64746d06266", "comment": "Malware payload (RedLineStealer)", "value": "66d355c4fbc73bb386176696cd964f915403899c7da498c3d4cb681498549c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392937, "uuid": "76003f8a-60e7-4a64-a527-2a29da979f24", "comment": "Malware payload (RedLineStealer)", "value": "f6de3a87e387802971453f79b7cef653fb96623e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392937, "uuid": "69be4277-0a97-43f7-8464-ef297bba299e", "comment": "Malware payload (RedLineStealer)", "value": "f2b6f720c70c21d31738fc1ccb0346640013b26dc708ed10250e45d9689d56174a21990ff124fbc24d84416543c6b09f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392937, "uuid": "49ffc285-37ab-4523-922f-45f8f13a6166", "value": "T1F3F4121BA6FC8122D9B1577019F603C30A377DA07A38C69F278BDD6E08725B4A675327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392937, "uuid": "45464c83-bc96-4ae8-808c-2de9655bfacf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392937, "uuid": "3e90eccc-a6e8-4349-80ad-6ca8c10d2fa2", "value": "12288:iMrly90yQyVMp7Bh4jL5rhiPemMD52Fe5pjPR6p/geiV88foM4UnavO+:Py1jVMbh4jL5rYPeTDQFeHjR6pLiVXfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392937, "uuid": "7b7b3498-4316-4e93-aea7-397536243f39", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392937, "uuid": "d6b29508-212c-4b80-93ac-68b64351dc7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392937, "uuid": "dc64b499-115a-4da3-9faf-d10b7d6c47ea", "value": "4ab04ee36dcf96fcf74562c9c60c74f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75936de9-ac84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392042, "uuid": "ce95b995-a53f-4021-a72b-0d2072e1236a", "comment": "Malware payload (RedLineStealer)", "value": "4d471807a8d1323f5ced91704598d255", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392042, "uuid": "36881aa3-dc88-429e-96c0-ac81c1fbd464", "comment": "Malware payload (RedLineStealer)", "value": "6700397538f7728ac74978524eabc72aae7181ee6d0e93c2a48f36db57688bb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392042, "uuid": "1bef2504-242f-45bd-b435-5abda8df33f2", "comment": "Malware payload (RedLineStealer)", "value": "03de8a43f65374c5ad6baef03d736dae3587a5b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392042, "uuid": "7ade5295-4a94-4463-b747-4f8d240737b2", "comment": "Malware payload (RedLineStealer)", "value": "322e6edee2efdded182ea9b689054ee5cf9eba983679055ea778238bba5f0bf61b67233c9af2b6332086e95a3929630c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392042, "uuid": "033b2cf1-7e58-48c2-b2f8-fb62aaf23a5d", "value": "T199F41307F6ED9432E4B557B01AF901C306337D60AA388B9B274EBD5E0C729A5A536373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392042, "uuid": "e05c642c-5423-48ed-8788-949f0ea91c8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392042, "uuid": "168f83aa-9101-468b-8bb7-d492473b3f94", "value": "12288:qMrjy90Q09kKUn7Yjsuq2bWyPU6kuBWz33l5UHZMD5jfp5Q9hquQ04GGoMSUnaKw:lyBAjrV86kmWzHUHGDhfpi9hqu9GoFph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392042, "uuid": "52895585-c6cd-48ed-9103-512dac12a2a6", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392042, "uuid": "fa286ef8-84fa-46ed-845c-d5908d091a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392042, "uuid": "60435b72-0a1e-43a6-9ceb-65a3c42eac94", "value": "4d471807a8d1323f5ced91704598d255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8491aced-ac5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676376176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376176, "uuid": "ce19abe0-54c3-4bbe-ba35-c7b7f955dad5", "comment": "Malware payload (AgentTesla)", "value": "843014486437eee21f303ae4f13c467e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376176, "uuid": "7814ecd2-621a-4c7a-a729-e26ee92db753", "comment": "Malware payload (AgentTesla)", "value": "6716cd8582e2333a34f4c212f93c484d393ab6a2e97a6cc52dbd4055855a5a41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376176, "uuid": "ff9b92b8-58f7-4556-be4b-6d35613f46b7", "comment": "Malware payload (AgentTesla)", "value": "373537803c1cb10c91f8436fd3e4b4ebb4039394", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376176, "uuid": "0600fbac-2cc0-40cb-ac4e-09f1dceab0c7", "comment": "Malware payload (AgentTesla)", "value": "a3f751f23d69c99696a6327b53dc6d0d40a894fd17606db08b8929fb24ecdecb213f9f6dffa9951a6fcd3dd876a47c1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376176, "uuid": "de07e3f6-f8d5-45f9-b3d3-2be8a80939bf", "value": "T1C284234931F6F053D9AB49721E33A5B7FFB9F91219282A4327601FA93C50645EE2D38C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376176, "uuid": "cfea92f3-13e2-43f9-9ed8-8766f3ccb441", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376176, "uuid": "7e061440-d4d5-46f5-9ded-4cad79d39d0b", "value": "6144:Q4t6LsTlQAx9gf9PcbSyryUlBEiVsYQihwjzsqcM6L+A:QkTldclPcbSyrbleiVspihCHcNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376176, "uuid": "7c107bc5-094f-4d2f-ac6a-8528d82b924d", "value": 373280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376176, "uuid": "e10a27e5-7fa1-444c-a7bb-ef5cfa08dad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376176, "uuid": "508319b1-284e-4764-bc4c-050b7255d895", "value": "Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d783409f-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676399078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399078, "uuid": "9b31a78d-5963-4886-b038-51f75043aad0", "comment": "Malware payload (Mekotio)", "value": "d5ad2aed1360f13721756a52a9a47d12", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399078, "uuid": "92d27b82-d57e-437c-9fa4-855ed9f2535c", "comment": "Malware payload (Mekotio)", "value": "6719c4bd451f0c988e20c4e6d4773c015fd98f2882ac1342ef4d48f31bde6cfe", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399078, "uuid": "0b4fadab-efac-40ca-8b1b-1f677070bb7d", "comment": "Malware payload (Mekotio)", "value": "c3e11b221dc4591a4e8a5634d4a66b77ff8171c9", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399078, "uuid": "92a66d80-cb46-4a27-a766-0345b3bc68c8", "comment": "Malware payload (Mekotio)", "value": "2e3a107d0b489a7ba9a699effe3700130280be802ff45f737fb24aff96a3a07c2b8552d589e7a4c78a5147baf96007d3", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399078, "uuid": "e8c1565c-6116-4d69-bc12-55caedccd230", "value": "T11876232372964122D0FEC5744A2BBFD571F22B25876244FB75C82ECE39B29D05673A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399078, "uuid": "1f0677ba-23c7-4e35-8ac0-3438ae28b516", "value": "196608:s8/r1/apIF/njBNqpVjShyC5NKj/C1B3:s8/mIFvVNqp1SYkK/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399078, "uuid": "80bbf789-aabc-4dd8-80b8-edd04571a7eb", "value": 7519744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399078, "uuid": "7ff2981c-c6f8-401d-869e-613b40bf83f3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399078, "uuid": "3b1151d2-0140-49e8-8b58-1ac595d0d256", "value": "FACT63eb9.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0224002-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392624, "uuid": "ba18ced4-dd80-4240-bf6f-f80c30beb383", "comment": "Malware payload (SnakeKeylogger)", "value": "e5d26d9b104a528606148f056a5fab75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392624, "uuid": "36f5a7a6-816f-4353-8029-008d101cde2c", "comment": "Malware payload (SnakeKeylogger)", "value": "67c8b4dea29fca212c9267743b5b51839555bb2e43c583d03a31ad583283dd3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392624, "uuid": "0729216f-89fe-4a39-b174-b5a53951ab5e", "comment": "Malware payload (SnakeKeylogger)", "value": "1b9401cd66a4944b8c383104926c7652daa9bda2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392624, "uuid": "357361d1-a5b7-4719-b534-7f3a2374cce5", "comment": "Malware payload (SnakeKeylogger)", "value": "b19e82e21a05a18cd958eb64116f6987a748ae923ac5baec14c7f4067a97c324e3b5598382c4eb161f0bea5427b52669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392624, "uuid": "91322ecc-1e32-4344-a70a-fb83f96a5052", "value": "T11B54121120A0C037D1F70B70DD76357B1FE7D5061425A65F0B90AE583AF6780DBAA7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392624, "uuid": "151d42a5-11ed-4681-baa5-f9a59947a682", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392624, "uuid": "1637e38c-49a1-401d-aad9-296bd58ea891", "value": "6144:/Ya6oFN5cf+ephTLKIIACtI29Z2dDwAXEIBkn3BuJsayVuYWGYMNc:/YuFHcDTLKIktxZ2dEAUICRualDiMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392624, "uuid": "8f11935e-1c54-43ed-af5f-40a4d678f3b7", "value": 284109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392624, "uuid": "1d03546e-b273-4fde-bd6c-1016efae258f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392624, "uuid": "499804ff-31af-4ac3-9a7a-51015d1d576d", "value": "Work Case.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a2caa8-ac9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676403186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403186, "uuid": "208be286-cd35-4db3-95b2-821e9ff284e1", "comment": "Malware payload (AgentTesla)", "value": "fab9a5a5e169eeed40cb6844538d6441", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403186, "uuid": "92cb797f-3610-4824-95c3-1c1222f95fd7", "comment": "Malware payload (AgentTesla)", "value": "67cf13b4905627c0452076a2c363943fb27aea11f511e0dba3d56e9014a36da4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403186, "uuid": "2dae20a9-5bdb-45de-97bd-f74fee45c048", "comment": "Malware payload (AgentTesla)", "value": "903086b51c8534e2eb2bfdd17d81f8e3e6560bc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403186, "uuid": "efdc086f-4df5-4bf6-b3fc-b7432368f6ba", "comment": "Malware payload (AgentTesla)", "value": "eeadc108e5247cbac28052e8176174ceadfe03b8b1c1c8d0800dcc8393cb23500bc08ffd6a90e50e8679a9feafbaf02a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403186, "uuid": "8e36e7ae-8490-4bcb-8eb4-771726f767bc", "value": "T1D5134A3A5F5D82EDDF8482F85883164E866DE38C4C1193AC7BACF4911B7013FA5ACB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403186, "uuid": "cb691986-69f7-436a-9915-69b2cf276fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403186, "uuid": "2c8c64b3-ef79-48a9-98be-42a32c45ad15", "value": "768:8jRFdT4560jgbzWgJeiCS/CfOeaN+uz2v3na0J4oJkYhoz:ChTMjgzWgJta1aN+uCvGoJkYmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403186, "uuid": "1d078d2a-f0cd-4ad4-b337-9bb1026cdc85", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403186, "uuid": "01c7afc2-b716-4494-8785-10e441efa1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403186, "uuid": "10699e62-3cc1-49c0-b4e7-d687db71974f", "value": "fab9a5a5e169eeed40cb6844538d6441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa633d9e-acb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676412317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412317, "uuid": "17a7d608-0f74-4e7f-a01c-96f7790cfe73", "comment": "Malware payload (Amadey)", "value": "b08c268025d98923bd3acad288635379", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412317, "uuid": "d2f8c2d1-ada9-406f-96c0-e6d0dda9a235", "comment": "Malware payload (Amadey)", "value": "67fa93c40653a5b8ac5627f346cf863cbb05d616233904ca226f1bb59c368b3c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412317, "uuid": "f08d37b0-8524-4ae4-b38a-49de93d55b05", "comment": "Malware payload (Amadey)", "value": "bcc3cd57b03dd255d1737d2f2b402849efd42e31", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412317, "uuid": "0023392b-c7bc-4771-b508-a6d6619a9b3f", "comment": "Malware payload (Amadey)", "value": "099b7d3f821856aad73f0683dc6fc0f855286d51ff7fcd1d51e1bb48773fc04dc5363ac1db2c3680cefa023f08685cca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412317, "uuid": "d9de2be3-6109-429a-b3f8-0a9de88b03db", "value": "T161152347DAE9C0B2DDB51B701EF512C31A36BEE16F38879B624F58091C722A0A17573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412317, "uuid": "4133a4d5-7fad-4570-bae4-1074a469ec89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412317, "uuid": "b28eee98-49bf-4972-aba8-ee41515e84b0", "value": "24576:jyfE7kQHnmB5fEGZUUsSsAbWRIUe3eCDhw79xTb:2YkQcEGZdhCRIhOohir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412317, "uuid": "951b8c92-5659-46ff-bb07-a45d05ce2e4d", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412317, "uuid": "b84b5310-96e8-4a03-ade5-48f46c00f45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412317, "uuid": "ea0bc5b7-fabc-40b3-b4e7-fce220157418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e218c068-acbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676416706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416706, "uuid": "78c3753f-7b75-4025-9534-386e51032672", "comment": "Malware payload (RedLineStealer)", "value": "b49e552e45d8bccfbc191a0ee32e601d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416706, "uuid": "c2480d63-48b5-4736-8992-a19607687ea8", "comment": "Malware payload (RedLineStealer)", "value": "682b1c22f9b5a140c106243d8eb1b18267b3c3f76b8627ef3993bd02edf6b904", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416706, "uuid": "1dadb82c-575f-48ff-962e-834cde4d7abe", "comment": "Malware payload (RedLineStealer)", "value": "8e2a28109ca219b5ddc9665d819acef02a26ce78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416706, "uuid": "9d63b323-f67f-4664-be5e-8b7d5ef62db5", "comment": "Malware payload (RedLineStealer)", "value": "88235e5ea0cab17881975b224a3fcb4cb13697736c7093c5bf6355bd7fac64e4c3bfd1ca7e46d795811f6ddf8d2c68d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416706, "uuid": "6cf11ae6-1663-49ed-ad22-dda6a38a2c3d", "value": "T1D7051247A3ECC026E9B537741DFB07C309363DA09B38825737996C592C637A4A23579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416706, "uuid": "7af1932d-394a-48c9-83ce-1a3cad6656b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416706, "uuid": "7f8b8a15-4193-4464-9299-10a95979283b", "value": "24576:UyqUxs5kdIi7dQlelzvfgbGKmWjjG2t0fe:jqUi5k6inlzGXU2ef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416706, "uuid": "ca60ecdf-d515-4514-a5ee-c2428ea59eb9", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416706, "uuid": "fb2b27cc-a3e1-4049-90e3-7b7a0ac24e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416706, "uuid": "a967c123-62ca-47b7-94ff-9e49381fd15a", "value": "b49e552e45d8bccfbc191a0ee32e601d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8a4d56-ac0b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676340242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340242, "uuid": "33382104-13f6-4e55-96fa-b0c0041d0333", "comment": "Malware payload (Smoke Loader)", "value": "da6156abd70f5c53f8f071e3b2246c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340242, "uuid": "f04bc5ef-b017-4ab4-9e95-b400c51da7e1", "comment": "Malware payload (Smoke Loader)", "value": "6883eddb9fd385442309199134a2239eb4761d685c443cd5aa7ca045ffdda7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340242, "uuid": "ddd9576f-f819-4f95-914d-462a3f8e7ddc", "comment": "Malware payload (Smoke Loader)", "value": "dbf2e5865783644a20350168da66af78fecc2209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676340242, "uuid": "479b270f-d679-4653-979f-6570bebdf827", "comment": "Malware payload (Smoke Loader)", "value": "a3b191416fbd0c18827b3badac3ab851b4280926d185b31af41687b4a882489f7e3ec781d2519e6d7f9fdab167ed23c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340242, "uuid": "752c470d-90e4-4789-99cf-a3b36581fcb3", "value": "T13514C062B3A0D471E46346314D65C2F56A7EF821DF64A6DB33B86B3F0DB02D18A76381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340242, "uuid": "e64f07b9-6a28-4788-904f-9a98899fe7bc", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340242, "uuid": "5335a9bd-cc46-43f5-b86b-b936186b4f46", "value": "3072:JJRuba5zNmGFINEd5nejBsuV5K+Qo4aCULlxPiJUChalE:J6mNxSK5nemuPvHTbPTChal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676340242, "uuid": "0456d3c9-3d06-4770-9b87-8b243549b738", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676340242, "uuid": "6b0df106-53c7-46f0-a62c-bec23529ae82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676340242, "uuid": "fe887c03-21fe-4b96-9cfb-946763dcef0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9580c396-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401974, "uuid": "5c9c45df-55c6-4ae3-a37e-975b9bd56832", "comment": "Malware payload (RedLineStealer)", "value": "e37c290409257a5f94ed7329ec4a8277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401974, "uuid": "eb373e18-d3be-4e61-bbb9-16b3b59919c9", "comment": "Malware payload (RedLineStealer)", "value": "688a29652cac1608b34b9e7767b5417b4b7599c8779464437ea9b0d4bb53f5a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401974, "uuid": "3d878edf-c5be-48c9-a15d-474c0a996fb6", "comment": "Malware payload (RedLineStealer)", "value": "da016e07e3644088a60d355cb2d7476d75a16b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401974, "uuid": "1ba95afc-0d25-4cb5-96ff-8775bc006992", "comment": "Malware payload (RedLineStealer)", "value": "5f29f0e83d043ec305157c96a0fe2ee4e799cee53f31db60efbd4b89de0deb3e5359efe1795d138b10d878aba5029be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401974, "uuid": "ed98e37f-c79c-42c7-9532-137d0680b2c9", "value": "T158C4124BB7EC4032F5B517B019FA02D30A3A7E505634836B179A7E5E19B3A70B638327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401974, "uuid": "bb814dbe-516d-484c-ab40-860c7a80540a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401974, "uuid": "b65cc99a-e904-46db-a465-d05b8e772a6d", "value": "12288:5Mrly90bKEam3QlQt6kRkcn5HDBKckw6d7T9AX:wyqtxQ6t6kRH5Hl5kw07T9AX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401974, "uuid": "a84f3856-163b-45ac-b77b-e60038a13a07", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401974, "uuid": "37147b21-83b2-4529-8aac-0fb8997440e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401974, "uuid": "5ddda975-327f-44e0-9453-0a1052a05775", "value": "e37c290409257a5f94ed7329ec4a8277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d065dd-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399819, "uuid": "1d1d459f-eed6-4911-b292-6c2ffc6e3a95", "comment": "Malware payload (RedLineStealer)", "value": "35c0a217499acee3ea50ea847887d300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399819, "uuid": "b8733cd7-76ea-4b36-8b13-e75f454b8150", "comment": "Malware payload (RedLineStealer)", "value": "68c119fca6578f5aaeff3021b81238979343f09c96e5f5277928a5c74cd009ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399819, "uuid": "59d68bfe-2307-48c3-9e22-1b0196aa9890", "comment": "Malware payload (RedLineStealer)", "value": "f2d5b0dbdb944086c1777354052e253c8343b5a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399819, "uuid": "ffcbe810-ff8c-4638-bbf6-92d4d633bb5b", "comment": "Malware payload (RedLineStealer)", "value": "cd2fb5a0a4936c7fba8d097c5edf69ea60b6bb56cb83373517ee09a2da90a119de4dff88e71ea664deafec04014f09af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399819, "uuid": "395edfca-ef64-4d9f-b5e6-fc3f66e563b2", "value": "T181F41247EAEC4452E9F123702DF702C30B36BE606B34839A374B6D2A1D727B16635796", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399819, "uuid": "ec505a60-7cc8-4d12-9116-993869a79bba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399819, "uuid": "4014802f-9922-42f9-95a2-2d4fef206b70", "value": "12288:PMrvy90hO71T4eEKgfA5Er887iAIPeDlXj8Z0I7LVE5ZwcGIVklN:0ywO7h4ZTf9887iAII8Z0465ZBij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399819, "uuid": "3da5a3fc-b799-4466-b801-82569ec3228e", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399819, "uuid": "bee35e75-4662-4f4f-b7ea-dffc1f190eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399819, "uuid": "72b1d010-ebf3-4c03-a62d-35cc301b1ee9", "value": "35c0a217499acee3ea50ea847887d300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dc9707-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676406719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406719, "uuid": "69eb08e7-5189-485b-9a0a-5608814e12b5", "comment": "Malware payload (RedLineStealer)", "value": "dedd20ca75b2401e42136ead316ff0c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406719, "uuid": "2fcdf9cf-8959-4823-b071-9baaf5d951ec", "comment": "Malware payload (RedLineStealer)", "value": "68c4f44bac9da0ed720dbcf73adefcc4cc3073e33d1b46693ec84125a7ac5ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406719, "uuid": "dbb53b91-3915-4eca-bef6-7afb71d2ae92", "comment": "Malware payload (RedLineStealer)", "value": "985f6b278bd4f89a3231f0f67f1bb222f5674081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406719, "uuid": "5ac467a8-264d-43d3-9623-b9af9f11b2a4", "comment": "Malware payload (RedLineStealer)", "value": "f0aed005c944e9593839e88e6a5d314b9d20a5b5f18141fdbd4988121f26ecd7162f553ebc17ae953b632edb827c1696", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406719, "uuid": "4edc2f67-9cdf-4651-a186-993cdea1daa2", "value": "T10F54F11275E0C072E55746789815FAA0AD7FF87672B3CCCB23181ABF2E202D146763A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406719, "uuid": "92e9dbb7-844c-43e8-8482-6a18ad3d7210", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406719, "uuid": "eaf94baf-08c8-44ae-97b8-eb44f7fbcb97", "value": "6144:5tLMGedoDrZOwJbzaP/c/Hu5QfAxB6Z6H5:5tYGSorxaPk/Hu6fYB6Z6H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406719, "uuid": "8d48c78d-91f9-40f8-98da-fe74129ed48a", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406719, "uuid": "fa80f169-f5d1-440d-ae96-1e16fa327f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406719, "uuid": "b7af8ec3-f25e-4549-af7a-02b5fa3da89e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4c4bad-ac37-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676358880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358880, "uuid": "7ee471ec-8b56-4392-852e-69613a67c2fe", "comment": "Malware payload (RedLineStealer)", "value": "ecbb677f7ad176ccc2ad4ecd63c1a678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358880, "uuid": "07e6590a-4e65-453c-a9b6-e2481de72cb5", "comment": "Malware payload (RedLineStealer)", "value": "68e0fec95405cee651d17e7a503a2a5925f0f979b07de6273af472ff301fadf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358880, "uuid": "af863c3d-cb45-4574-b8dd-5dede40af3d1", "comment": "Malware payload (RedLineStealer)", "value": "5d026b0355774a72557e7e38f58c3d35d5ab7fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358880, "uuid": "b74ffec0-1b84-4a3d-ae35-b44de06ca87e", "comment": "Malware payload (RedLineStealer)", "value": "bfe7a35395c666e9b75d8414e67ae1a92dded43326dc3c8ff687f06eb65ef8a7349e977b88dafea725df6fca2d766b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358880, "uuid": "4265fa95-351c-4704-a9c9-533a7ef4c41d", "value": "T1AFF4120BFBEC9436E5F197705CF203D31A367D605A3446AB624B9C191CB3660BA3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358880, "uuid": "4dc2088a-63c7-470f-ac26-5cfdcb77d043", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358880, "uuid": "30739a11-af94-4f02-9b47-4ee4194fbcc3", "value": "12288:6Mrmy90BIiLpVG0IZxSYe66hlhFC4U7QPAgFxgVbzGBdMiJUvw8ms:8y4I8VG3WvlhU7yAegELMaUvw1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676358880, "uuid": "c6248441-1c0f-4daf-908e-14f7f9445cf6", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676358880, "uuid": "afac0159-3506-401e-a59c-13e84bed0fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358880, "uuid": "ff8a4a8e-ec24-43ce-8bc1-2fe0e4ed9ccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4b39f6-acac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676409124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409124, "uuid": "8b548581-112b-4e22-add5-80c80dd913bd", "comment": "Malware payload (RedLineStealer)", "value": "bcf1cfaed200545f1d359db152efb7ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409124, "uuid": "02f32177-e0e2-4e8a-9a2c-c342169976e8", "comment": "Malware payload (RedLineStealer)", "value": "6920003241592d0be081802a3f478db23ae2844e8db5e2ffcc3bb9858fb4f4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409124, "uuid": "137495e8-4603-4aa7-aec5-b9a6d6cd574e", "comment": "Malware payload (RedLineStealer)", "value": "e098bba9fb7da773be1fff8a3c51362a368bdfa9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409124, "uuid": "48c5a4cf-966e-4982-88c2-3079fd1ce945", "comment": "Malware payload (RedLineStealer)", "value": "a2876388839653956cd0935b966dd6f632ad5a2864286a573f89d3e970bf98b426c8c1a233849dae5562b2c20150fb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409124, "uuid": "73b6832f-87fa-4622-86e9-65f35597f72f", "value": "T165251242F7F85433D8712B3099F643C30B3ABD725A754703634A9DAA1C726B1A631B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409124, "uuid": "62d5ff86-8853-4046-852d-837540623198", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409124, "uuid": "1a7c47ed-b5c8-4634-909f-b368ccdd09c0", "value": "24576:SyayWDx40Mkr+fwAEWAa4PItKKJVi/kpQa+ycV12fGG:5aZF4A+Y9W0AtNiYQa+f2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409124, "uuid": "89fefdba-969e-486a-96a6-6e8efc69acd7", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409124, "uuid": "fdbe744b-5bd2-4a3c-99e4-e651be3539d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409124, "uuid": "918986ad-b2f1-4312-81bf-4b4758d1f370", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b9b48d-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676393541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393541, "uuid": "e99c82f8-6947-4001-9364-7ad30fb78201", "comment": "Malware payload (RedLineStealer)", "value": "1646f83654c4c7b376ada5add82937a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393541, "uuid": "e0a7d938-b418-4b62-a2ff-d73c972263b9", "comment": "Malware payload (RedLineStealer)", "value": "6922550edceae316a1034c8ecdcba9b048b6d33961cb224e8ee75af09da431c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393541, "uuid": "b632a3d3-c252-4b3b-b220-fcdee673ce6a", "comment": "Malware payload (RedLineStealer)", "value": "52a977246395ac9f23ac6c1c5ea387ada635bfa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393541, "uuid": "7321a994-024e-4038-82d3-10b9e0f5e617", "comment": "Malware payload (RedLineStealer)", "value": "520feb90333ca519d91ee998adbe105df10dbef60577bffeec28b3cd774a239c878d55b502d6bd7438c0a9f9f8d0714b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393541, "uuid": "562a8a8a-cb95-4150-abdf-bad77b3d556d", "value": "T111A40207A7E88072E87967B01CF607D30A367DE05F38435A278E5C5A1C726F4AA3576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393541, "uuid": "3a45b1d3-46b7-42ee-9113-eb5c30379f02", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393541, "uuid": "b3cd18fe-d46a-459b-a465-082cbd0a5891", "value": "12288:1Mryy90OSnyPs5GdYjWPy/mYVMmr2Wmih:jybSnSsAd/4mHZWNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393541, "uuid": "9f534430-4b8a-4bf3-9ea3-ce54dadfda86", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393541, "uuid": "8ef0f275-500e-4be8-8138-dbf69a926908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393541, "uuid": "a678746d-c365-4cb5-8ff1-5d3cdda9c826", "value": "1646f83654c4c7b376ada5add82937a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0e132c-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676363443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363443, "uuid": "70015beb-c58b-4049-a2ba-4de0b01b789e", "comment": "Malware payload (Amadey)", "value": "aa4b907b3e84bda57bec7896d6319578", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363443, "uuid": "27bebda9-70b7-4344-a30e-c9d837156887", "comment": "Malware payload (Amadey)", "value": "6a63eb8d8bb2c995a77836556a2ffc9ed6ec6191a71c513b9b5f68898aa183de", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363443, "uuid": "62c95e48-d1de-4dab-8945-11433142a7dc", "comment": "Malware payload (Amadey)", "value": "471f08f683719642e01f5a00e853cc4baa35b12a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363443, "uuid": "756d450b-1a11-40df-9418-753c499c78ae", "comment": "Malware payload (Amadey)", "value": "19c25ec995e993253269c2a86f13629d1338df41b7155339615261bdeed2c6ed3d61f19a80444d6ce69816e1a4f5fa76", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363443, "uuid": "355a4ffc-9fac-4705-831b-c99d9b5872e8", "value": "T1D1F41203E6FC9036E9B1437469F743D30A36BD916A388396268F9A6D0C73561B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363443, "uuid": "016d6d13-ee46-4a84-86d2-e6a87628c2b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363443, "uuid": "199ec2f8-44a7-4839-9a5d-36bccd190cc4", "value": "12288:eMr0y90OxtBr4SoyKKrCIGMPHUDztuFA4xo31IX0G7NHz+3+1dZL:iylhJNXP+zQxoFIX57111dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363443, "uuid": "f724103e-5700-46fd-b4af-6c5e474f164a", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363443, "uuid": "1cd85032-0099-44f5-b8a0-6364c2232f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363443, "uuid": "5800ce3e-8566-460b-85fc-3ff8edd3da0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89ac9c2-ac69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676380585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380585, "uuid": "221e1a80-6a95-4f28-abb1-830a0e24c795", "comment": "Malware payload (RedLineStealer)", "value": "69d3705ddd8cf4cb5ce08da920d0883b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380585, "uuid": "3ec8e785-b2ce-4e1e-9952-56cef1b9d3ca", "comment": "Malware payload (RedLineStealer)", "value": "6b189c9058051c2e07d7b75581b69f905bb24bbf04eba737b736e6bafd87d133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380585, "uuid": "23f98a21-3891-4032-86ae-fb758a738cbf", "comment": "Malware payload (RedLineStealer)", "value": "82e94411a8df019e3898cc6608a6783b0168d312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380585, "uuid": "1fb50b1e-8e9b-4f42-aba7-4fabce1626f8", "comment": "Malware payload (RedLineStealer)", "value": "8859082daccffc50fceefda62668299709c8378a0bef4df6f84994fb185c6f2b3706f0f6436118bf48e1edab51afee90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380585, "uuid": "69d2f247-578b-4fe6-84b5-b0ac5437b82e", "value": "T106A40117FAE89132E8B5673018F607C306327D50AA3C835B238E6D1A5D72575B2367BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380585, "uuid": "d43ba6be-a07b-47bd-9bfc-45b477c5d109", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380585, "uuid": "039a9e0e-f8f1-4ea4-8aa5-70f72a1ae9f1", "value": "12288:4Mrny90bzHjsCJF5QEgGcHolay6W/D3xkWPRo:fyWJbiGcIa9WTBRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380585, "uuid": "0c92311c-9431-4f11-a146-251e9210907c", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380585, "uuid": "21b6152c-7a3c-466d-af65-d8ac730620b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380585, "uuid": "46c9a51e-18c7-4fae-b984-8e08f89a63c9", "value": "69d3705ddd8cf4cb5ce08da920d0883b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de52c488-acaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676410686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410686, "uuid": "c75bd02c-b986-4373-b270-2a436cb6f1fc", "comment": "Malware payload (RedLineStealer)", "value": "36263f032fd44c39998e985281a79955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410686, "uuid": "8b4191ea-e461-46ea-97fd-affde6563292", "comment": "Malware payload (RedLineStealer)", "value": "6c77ed549c36842a09322b79d4406731af302b40b0761ab9ea3bf6d1be2fc898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410686, "uuid": "4cc4eeae-11a1-461a-b312-bf4fee547d00", "comment": "Malware payload (RedLineStealer)", "value": "457e8d6984e6de125883e379235af2b894b66a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410686, "uuid": "3bc57695-6e5c-46fb-8e2b-547f2628d85b", "comment": "Malware payload (RedLineStealer)", "value": "57fd1b2e2065cdea6d442c28bd13b3e6e6077b7947192e03957e1c886e4ecbd9e45b6d3f64d10e5f1ae314f5e5656d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410686, "uuid": "3f9cc046-8ea0-462f-a6d2-a1934020b095", "value": "T11CC40147F6E85022E9B467B019F703D31A367E611A70479B338F7E960DB2660663173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410686, "uuid": "dddc12a8-7eba-4dc6-a147-9ac2f8b9fd48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410686, "uuid": "10ec3917-ac4d-42c7-ac57-76dacf8c3c90", "value": "12288:NMrZy90xHJgOV1EiXXih5bm35SWtdjyUx4PzgJj/u:4yAFV1rih5S35B7oPUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410686, "uuid": "fa4d6c74-262b-4b8e-8450-eea5c3c96fb4", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410686, "uuid": "b54ecd46-aeac-4cb6-8023-fb44829e7a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410686, "uuid": "45fd8d9a-b12c-4ad7-a965-a927eb808069", "value": "36263f032fd44c39998e985281a79955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3fcc0d-ac0e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676341512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341512, "uuid": "a4fdd5f6-be11-44bf-8f81-640c0a7241b4", "comment": "Malware payload", "value": "deaf57f949d85903652af6b12e4625ab", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341512, "uuid": "886884ce-e36b-4f26-a403-9002671af91d", "comment": "Malware payload", "value": "6c9c825c2060d6cae94fa3700c3f814e3acf52f3d87897858a6329358e3e5e56", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341512, "uuid": "05bdc2d9-7bca-4af7-82d2-ba3645f4aea2", "comment": "Malware payload", "value": "eb461dc0d7ee5623d2967292e05edb6746307ac3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341512, "uuid": "6896f20e-fd73-4fef-bcf7-682b35d6b5ae", "comment": "Malware payload", "value": "a18f8571809bb81b0c5bca92275527f2c6a6b5e6b1b6498b260a487ce65f9bee9c8abd59f0cb9266d91395d97d6d1a3a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341512, "uuid": "e9fd0a97-ebb2-4ecd-b45f-d33c42c55b47", "value": "T1902733974C169DDAC032A479157F6349A871CE2A3DA227622484DFB7C1F3574CACEEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341512, "uuid": "f8b6c4de-62fb-4169-9ab4-bb0ac6dfe5ac", "value": "393216:csJA35z7A79L++8z1mbgafiubc0ZvbtT9i/zVN2I+TXpNUKpPbNiRSKcsjJ6:DJA35z7c5kZmbBffcWv/i/zVN2Ik5GWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341512, "uuid": "95fabb9a-603c-4b01-9672-4ce17761c87c", "value": 21503407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341512, "uuid": "a7b73faa-a63a-4c80-827f-cd3275aad5c1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341512, "uuid": "0df36fdc-ee5f-4993-b36b-559166fbec6f", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8773b0-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392346, "uuid": "afa8d841-ae47-4105-8d84-45ea9aad1d1c", "comment": "Malware payload (RedLineStealer)", "value": "c7ea927d587d9d400a8628f1e06469a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392346, "uuid": "10d172b0-3138-4306-8638-1dc85d0613ee", "comment": "Malware payload (RedLineStealer)", "value": "6d13afe32b5029c8adf3aff57d6b557f3019c6a9a9cd80e66d0d0208c9fe0f56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392346, "uuid": "2188e633-1975-46a2-bfff-306b33423f57", "comment": "Malware payload (RedLineStealer)", "value": "4b93b08d11c40158dcd75f8d9e1a17767d0ca610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392346, "uuid": "024d6176-e5ed-401e-809c-9f8f5ee1c016", "comment": "Malware payload (RedLineStealer)", "value": "e5611a73211f726c9d42a75af46d24ed8b2ca0b92abcafee17c37d33d08b1069e8a2ec1cde2e59233617abd415e15367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392346, "uuid": "c82dd93b-8169-4bb8-8507-e1a17b13aff7", "value": "T195F41253F7FC8475D8A1977018FA17D309357EA06E348397A34AA86D0CB26A4A73173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392346, "uuid": "41f6af8b-36fc-468e-8d56-bfa9deaf1fbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392346, "uuid": "06b57441-d281-42db-b120-aaff6430e993", "value": "12288:gMrEy90cnvjwVu0lX/ArwHPpFm4jjCiUj1t2BYrsOIPTiw:0yh8s0lYWjjC9Z9rsOIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392346, "uuid": "9784b4ac-8ede-425c-8263-30d5304dcaaa", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392346, "uuid": "29296ed7-02b6-4b86-895d-1597151f752f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392346, "uuid": "3352acb0-a5a3-4ceb-9cfd-bf2d68ff5140", "value": "c7ea927d587d9d400a8628f1e06469a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7c1b68-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382120, "uuid": "abdb69e1-cad2-49ca-91d4-4b46a8b58497", "comment": "Malware payload (RedLineStealer)", "value": "7b9f83ff8369c972edc9292a9a723050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382120, "uuid": "099cc1da-4943-4f7c-9b2f-00973153a523", "comment": "Malware payload (RedLineStealer)", "value": "6d970cd9b229762b5d05ef501d9cedba21ade704a46440db94c89a79ea39d7af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382120, "uuid": "005b5b5e-cb49-4792-8b66-30a5b04f2904", "comment": "Malware payload (RedLineStealer)", "value": "32e0b6c078210a71d3183c3cae98e5eed39875ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382120, "uuid": "40cca156-922c-4446-a270-5d21474a2d2b", "comment": "Malware payload (RedLineStealer)", "value": "5e34961bb5fca6df7f957bdbfa77df7ca0e9ab2180dedcfe6e7bddbcbf439961be7543249ac05277d3188d7a22d6ed96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382120, "uuid": "a97cd190-889e-4ee5-bd28-acfa38dc1b23", "value": "T105B4021BE6EC9032D8B5537418F603D31A36BEA15678839F335F6D9E0C726A4623472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382120, "uuid": "c150f2a6-cc68-492b-bb49-89428961dd38", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382120, "uuid": "829fb4be-96f4-4af5-acef-fe94b60ae253", "value": "12288:yMrsy90hDTjQ9A6BmQUEZQBAaDpxhuSkK+XF2X:ayuPcPmQbWA+kNF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382120, "uuid": "2713d085-efc1-4506-bb61-34ec3c5bb537", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382120, "uuid": "7461fe8a-c972-4ee4-8717-65f2d5366361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382120, "uuid": "3c43acdb-cf20-47ad-b9c8-9560a4544304", "value": "7b9f83ff8369c972edc9292a9a723050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55df2ae-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363453, "uuid": "68ce6179-93af-4b30-acbd-1a48df23868b", "comment": "Malware payload (RedLineStealer)", "value": "3daef65923e28661fdd3fc073d5990ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363453, "uuid": "9aaf9081-40f0-4cde-87a7-3a7f7acfa2e7", "comment": "Malware payload (RedLineStealer)", "value": "6dd4faf8c126c57f1d04c432ea1a2d7d0bcb392b046ce5da0c758e237f5f2861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363453, "uuid": "7ea8d63b-0ab1-463e-aadf-8acbeea343b3", "comment": "Malware payload (RedLineStealer)", "value": "282ec2fd2e6da31e91ad662893d28f5d363bec4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363453, "uuid": "77015cda-34c1-47d9-9618-a32941e76ba5", "comment": "Malware payload (RedLineStealer)", "value": "7f619dd74835949b2cbb2cfd613ca20d3df49aac0aecb6eb40cfbc89eb79329449e0e76ef50557d8cdb95d7fa5cd5e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363453, "uuid": "e447109c-cc14-4be2-9fc0-a9818a0e08d4", "value": "T1FDF41207E6E84122E8B45B311CF303D31E367E925F78864B23499E5F5DB32A06A7572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363453, "uuid": "91ccd7e0-5f4b-4bbe-80a0-eef48c94e344", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363453, "uuid": "d72b0b68-6cbd-440e-8717-d0817481e8f0", "value": "12288:lMrLy90ubLrTJ+9YbieyTDwHaCa5QqVuvDazJybVMkh+fEPglDGUOmSvD2:OylTsGbvyvwJay8uvDatybVBhSl6yS72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363453, "uuid": "dede6d8c-636b-4f50-aa24-e91afb221ae7", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363453, "uuid": "15a7466a-b373-4039-aa4f-d59cfe3a657c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363453, "uuid": "46dada2f-84b9-4953-b69b-838774f934c8", "value": "3daef65923e28661fdd3fc073d5990ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e6ea89-ac6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381594, "uuid": "cf012ea0-03e6-4a8b-a067-8c23dd2944c3", "comment": "Malware payload (RedLineStealer)", "value": "c06f363a43677a875630436a3a0a3c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381594, "uuid": "f9bbb896-8354-41a4-8dbb-fd5f99bec0ba", "comment": "Malware payload (RedLineStealer)", "value": "6e27e7f6e282c7743d6a65d51c13b55ed441b5d23a304c76a123e4765f06c81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381594, "uuid": "0c40b1d5-dcbf-47b5-bfa4-5d8226b1839f", "comment": "Malware payload (RedLineStealer)", "value": "39e8b7dd76f87e6efc11873d98ecd6e5e6540247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381594, "uuid": "7d092fbb-9e07-483a-93e8-883060c31a48", "comment": "Malware payload (RedLineStealer)", "value": "c754cc8190130941a67aedb41aea073c0761e71e46ddb5f9a6e59eaf30f726dbd44a064dbe516ff66a0e0d14a1ece3a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381594, "uuid": "d06f4444-6c02-4d3f-a98b-f6fdf2763113", "value": "T11DF41207F7FC4431E9A59BB419F613C30D363E61AA3483DB929BA9191C73661A63133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381594, "uuid": "c3959a53-a089-4857-9bb6-bd9b5c9973a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381594, "uuid": "f8d8b0d3-3721-452b-bba4-4631577a269c", "value": "12288:0MrYy90tAPy2AViKNKrBpgiBFBWCrzEfX2e226+FP43efC9Ujj52AYrgO3PGx:UyJwVixpsCrzm5226/3efCavErgO3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381594, "uuid": "77cfd720-0319-45c9-b58e-192e80cacbf9", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381594, "uuid": "f89f4399-6a94-4792-a7d7-eb0bd1638ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381594, "uuid": "af4ce50b-fbef-4cda-ba16-6f3743cf34ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea0c0f5-ac58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676373079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373079, "uuid": "7ae622b1-6ede-4978-b5a5-d2862d4e1577", "comment": "Malware payload (Smoke Loader)", "value": "ab2c6b2cee949fb8dbed37b50e6da8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373079, "uuid": "f5dd2f5a-dd79-409e-a56b-02617d765241", "comment": "Malware payload (Smoke Loader)", "value": "6e2f7726ce14f9bd1d6d803e1ebea5e63df1c270c67d4e4812bd6ae6cad16ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373079, "uuid": "3ac7bb17-4e49-47d6-836a-0ef36f267c07", "comment": "Malware payload (Smoke Loader)", "value": "eb77b7f60eb906206485f75a44075472cfc73e30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373079, "uuid": "9be1cf27-3812-4385-b375-385e1d24ef0e", "comment": "Malware payload (Smoke Loader)", "value": "9755d3743fc0a169741345640250af4669fe8900cdeb3701ef1abfe5b099864cc76c40626206351324fcd63355e96770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373079, "uuid": "5f2269a9-ea92-4ccd-91ce-2b0635276b44", "value": "T1AB04D0523AF1C4B3E5A781746820F6E06A7FBC7267A185D73304166E2E303E1DA67367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373079, "uuid": "4b8606a5-b1d7-4aed-93da-dd2f9d88ce16", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373079, "uuid": "372cbebb-3a51-4124-a54e-cfa076dac19f", "value": "3072:2o53LZLT5nnKQlvXl7o+BniPr9xTbFTC5yltIOS+3Q2cfOa:1VLZLNnKQlflosij9xTZTRXzSMQhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373079, "uuid": "de586900-b9d8-410b-bef5-822d2d04bfc4", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373079, "uuid": "217fc68c-815a-4bc8-82d4-5e2c9899b112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373079, "uuid": "22c9cd12-04f4-4d22-b1bc-c50cb582cf8a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8abb9d-ac39-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676359924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359924, "uuid": "0a94fd16-cc0d-44f3-b792-1f568f89d341", "comment": "Malware payload (GCleaner)", "value": "b42fe5d08e88bfbf04dc24e98486b305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359924, "uuid": "82894290-11f4-40f0-851c-9558fc5cda7f", "comment": "Malware payload (GCleaner)", "value": "6e56aaa7d9b4575f0f30f8f0f6bc94f89ac7a06b3b93c825f82328c83956dbd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359924, "uuid": "1da34b10-436f-41ab-8d6d-23315ad4c2be", "comment": "Malware payload (GCleaner)", "value": "6a662bcd55f395fefc6302dc470a5a4a442f10a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359924, "uuid": "b30de32f-74b0-46ab-9796-7d6d0f3aadc7", "comment": "Malware payload (GCleaner)", "value": "ce6bdc9147754480a7b96a41cdb8af2ca66cdf8379805f24da4b702358fb406ac99a56573215f6155de4d0d635dd959c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359924, "uuid": "928523a6-5d8b-4c5d-a6b9-ed09f61cfc51", "value": "T1AFF5127C3245C5ADC6C0BEB4893AD8E75CD66DE7E8E4A122B0C97F3F51792899A0C017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359924, "uuid": "420f9444-cce8-4f19-bca8-73d68abc7e45", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359924, "uuid": "8e31b7af-bfea-41f8-b82d-c69f328a9910", "value": "98304:JHOW9/fdWLDO1O97GtAtH9zYjoAmpMOwHv2MR:dOW9dSD4OFGGtdsjoAqM1HvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359924, "uuid": "fc346ea6-e0fa-4bfe-a746-226fd0392806", "value": 3358682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359924, "uuid": "9631c437-3942-43ae-b87d-2ffdbf47287b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359924, "uuid": "e0f671a3-fff0-4983-973b-915d14a12e43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee85efbf-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676369482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369482, "uuid": "6512e944-fe76-40e4-859c-8319adea11bf", "comment": "Malware payload (RedLineStealer)", "value": "d1ccf3bb001736442405e232e62ebf0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369482, "uuid": "796e8404-31f5-4ee8-a80a-0bc09c7fb3f4", "comment": "Malware payload (RedLineStealer)", "value": "6e792f3c7037f7afa7685be6506fb7bce8290724285272b2e2ae2936cb21fad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369482, "uuid": "ea136607-b2bb-44b4-b6cc-6b792f034b69", "comment": "Malware payload (RedLineStealer)", "value": "70a0b77f3baf09d53840eb48bb5f634cc167c523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369482, "uuid": "fd09b736-656a-4bc1-9896-e5b2f2f22770", "comment": "Malware payload (RedLineStealer)", "value": "9a11a8955e8ddcfc20e496d06157d25106e491e72a7552bd28949e603735f073a61158727caa24c26e7b3d57dc0abd12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369482, "uuid": "25e26b34-8277-4690-9d36-8c7d0523ab60", "value": "T16655DF00B0C1C436E47325324AF8D7B99E7EB960075569FB77D80FAE8F306D1AA3156A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369482, "uuid": "efa92f0e-3b00-46f7-8a51-dc3e8bd854fe", "value": "a0df761def5e2d5671a380b13ea87cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369482, "uuid": "e9c16ff7-5839-4fd1-a0a5-5397b68da25c", "value": "6144:slw2brg2jCOIdGOu5SBNYo0AONmD+GNzLrRTVTgzGa+6NZnQ3XsGi88WS:sBbrvjCOIRQl8ngdeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369482, "uuid": "6b7dcec6-95c6-4411-b9e0-75b8b3e53029", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369482, "uuid": "619162ee-9e10-40d8-a681-5f425ca161bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369482, "uuid": "0af8d4ab-0142-464d-aa3f-7e0821e25447", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a877bc-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676350651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350651, "uuid": "94a94e28-c74c-4ce9-8110-31a19bacc549", "comment": "Malware payload", "value": "6f12e442ed9790f772e9668e76c4c70a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350651, "uuid": "0bef6182-dcd6-4772-8afe-199736edc030", "comment": "Malware payload", "value": "6eb27e83c45d3b418375d23da6194a7058e816c37fc0af682d2b7c815f083879", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350651, "uuid": "377b3b73-ffa9-4eed-86b5-595a41289674", "comment": "Malware payload", "value": "7d06a7583165f7cb7aa8a3801e2b1868e4bb7d19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350651, "uuid": "0947fbb0-5ca4-484f-8082-35b0d709cfc4", "comment": "Malware payload", "value": "687444aa848441183756d923bda690657888a0504136d3f2b2c142e2a9451596da6ecc9b72d916983635e03d7b35ece2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350651, "uuid": "29704a65-e1ec-441b-898c-964665917cae", "value": "T1A3063B68A7A0E578D3EED1F4288C991A1837FC1673C21DCE70D8BB6017F6BA8F852551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350651, "uuid": "ea94537f-cc2b-47a6-9af1-a516a7b938f0", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350651, "uuid": "66677d7c-b7dc-4c5c-b069-03229fd2a5a5", "value": "24576:eEtl9mRda12sX7B9NRdpkhtIShJVVTyJNPtk:9Es1R3DCjVya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350651, "uuid": "acc9a97b-a9ca-43f1-a596-55663b3e5036", "value": 3716124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350651, "uuid": "4a5f7903-a51b-4389-b267-524aeff5cf9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350651, "uuid": "d08c7f88-3556-476d-996d-693c5ba16d24", "value": "2023-02-11_6f12e442ed9790f772e9668e76c4c70a_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69941ca-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391749, "uuid": "5ef5f611-4bca-4bf8-b234-ca970def4cab", "comment": "Malware payload (RedLineStealer)", "value": "9435ad02c8dffb579c050d48aa288f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391749, "uuid": "8e8a2692-214d-4f5c-bb54-f0737993d195", "comment": "Malware payload (RedLineStealer)", "value": "6ebcb40edbd94d362667afe369fd2ee921806e5aab63e6e24d2186d4c171541f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391749, "uuid": "2219b591-00e5-4f15-8583-f030a6ee9d16", "comment": "Malware payload (RedLineStealer)", "value": "4dd98a14b11030b57bd8c59b7c8a06b2f633da72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391749, "uuid": "0739f6e6-9b8f-423c-bdfa-e0a4e71de884", "comment": "Malware payload (RedLineStealer)", "value": "45786b27114822c03fb01c8ccf8c49cb43abd8aa4488ba79d9fb06384b740b6f7c97f0c8bfef9baf8c28ec204678bd3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391749, "uuid": "c3ab897b-920a-47e9-aa48-46a63613e6a4", "value": "T19DF41217EAEC8022E4716B701CF307D30A367D617F3C53AA529A6D5D08B2AB0B635B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391749, "uuid": "b76669de-61b1-445f-a6f2-d8bc73532e4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391749, "uuid": "fcd484c7-8fc0-4412-8f1b-51a8a333555a", "value": "12288:6MrDy90BfZ8uwjgmHM2Wf0O+W9HcovUnazVi9q+t8ymfV28uoa:pyyfZ8uwjVM2WhV98oRzViH8fVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391749, "uuid": "656e521e-cc41-441f-9e9b-bf23932ed4b9", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391749, "uuid": "d6cac1a9-85ae-47f5-8c56-1c98e4acce43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391749, "uuid": "d72ce323-9bcb-4c1b-871c-f40e781ac806", "value": "9435ad02c8dffb579c050d48aa288f48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e6c8ca-ac4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676367150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367150, "uuid": "7864f660-abc6-4d8e-91fc-e5e2fe339579", "comment": "Malware payload (Smoke Loader)", "value": "5d1b05a15e2e3cb0f22999d24d5cbe87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367150, "uuid": "0fc6a8a5-4109-45fb-8ead-b469e02c1cc6", "comment": "Malware payload (Smoke Loader)", "value": "6efe7dd98f4f6e1fb61113dd9d577c89b8745fe082b1f0b05c8acea540be1280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367150, "uuid": "25d01781-eedf-456b-805f-f01dc790093f", "comment": "Malware payload (Smoke Loader)", "value": "b172ca1edb980d35fe7779142cd5d718b076271f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367150, "uuid": "bc320408-2c1a-48d5-bdbe-bffaa6c92997", "comment": "Malware payload (Smoke Loader)", "value": "2453feed7b3569dbfb187605c4d0ce177bbf1b254c7a82875aa13402617b3c7290470ef95d70560ddf1a368e2e9dab01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367150, "uuid": "d81451f2-e2fc-470d-8322-f91ae9159f9f", "value": "T15F04D00235E9C0F7D3A781300430D6A1AE2EBC7E6765C17B32585AAF6D302D1DA6A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367150, "uuid": "c3051ee9-ee9f-49d1-9836-d020aa36288d", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367150, "uuid": "c235c11b-f63c-4fa0-a582-514575c7baef", "value": "3072:moSeLUzt+5fXVbk/EqrRo8LVmxctb1f+DRfyi+1sdIHP93mhYr7eGYZ:FHLKt0X/qdog8ctb1fmRqiOvv93mhY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676367150, "uuid": "08f80786-32f4-4806-b139-39f273f3715c", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676367150, "uuid": "5ebe6ddd-0329-4723-96bd-1b941d7e06d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367150, "uuid": "a962b437-a659-446f-b544-e068fa98ff80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1ad6fc-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676372481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372481, "uuid": "fcaaeaf7-89d0-4bc8-b4c0-72fbd61b59a5", "comment": "Malware payload (RedLineStealer)", "value": "a6267cac27e28ec7377f59a363fb9e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372481, "uuid": "c39a6fcf-02de-4de6-b006-20651a52c750", "comment": "Malware payload (RedLineStealer)", "value": "6f0f1aa395c4af8bbbf0fc05cc0c79519f85e24de22d09b012515a566e9d3c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372481, "uuid": "52b6264f-43f6-47e9-aeaf-cdfd1ca95359", "comment": "Malware payload (RedLineStealer)", "value": "17bba80f4c66800327ed8165bd5fdd974904ce3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372481, "uuid": "c1b871a2-79bb-47f1-a12b-66be4570af46", "comment": "Malware payload (RedLineStealer)", "value": "aa2f19e967c23ca30d3c4c9666e019bf82c414a598142defadab532b3b4c1f092040249d456b426064bce005f64fcfeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372481, "uuid": "2c0f5e1c-63e1-4085-bc0f-ee224c005d98", "value": "T1F3F41217B7ED8032D9B4577018FA02D306367EA15B30C3A6235B5D6E0DB21B0EA7976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372481, "uuid": "40a60ee7-82bb-4b45-8fb4-5e3ca8f52799", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372481, "uuid": "315434c3-5030-4149-9201-4e6128f58868", "value": "12288:oMr2y90qCXXkR9UU4mst7VJbBQvDQ4JyJwinRL8JO4K1h8b3y:+yJCXg9UUXst7VJbBQvDQEyJwiniJJKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372481, "uuid": "b491d7b0-c2cb-40a9-9135-d423ba374462", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372481, "uuid": "1ce213b0-a586-4824-8b47-89745bb6cd23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372481, "uuid": "481d1b73-b3ba-4893-b722-04172395a835", "value": "a6267cac27e28ec7377f59a363fb9e27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a68ff0-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391750, "uuid": "76c687d8-bad3-4e4a-9b66-e1833990a9d2", "comment": "Malware payload (RedLineStealer)", "value": "d8748bd07e7f282b21f60af22dbfe21e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391750, "uuid": "6d3ea7ed-d047-4b8b-bc1f-3354edec146c", "comment": "Malware payload (RedLineStealer)", "value": "6f1b87fa9b8038c2a9be20951850d9228d161864c62ddd613f02ea6b3125e041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391750, "uuid": "db190241-5181-42c4-a62c-6db7588184a9", "comment": "Malware payload (RedLineStealer)", "value": "bb9a02188daf9b7a1452f7416a424593fd7a0eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391750, "uuid": "e3127ec6-2b35-4a5c-968d-196d771a451b", "comment": "Malware payload (RedLineStealer)", "value": "5e66a624e6786150751a62d41de0d6503a1058ec477d64583383425e8a16d3f36f24d78db2b574b080d395b308672bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391750, "uuid": "7eaaabf5-f62a-4532-90f3-9e16396402e1", "value": "T11A54011279D2C077D19AB8701E23D5DC677FBC72EE60908B7358262E6E313D19AA8347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391750, "uuid": "d56c16e6-c692-403e-a51e-a94cb49e0a43", "value": "033c129a4522b4dc7e5484557290091f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391750, "uuid": "c6b0650c-6c36-406e-a97b-3ac999109982", "value": "6144:9LpREiB1X2YehRnGUpjZp3SROBrLZCDRoLu+pm3:9HlBNeOE2OBr4NoLzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391750, "uuid": "570dfedf-9502-44d6-85ad-a3b8df603b06", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391750, "uuid": "f6eda9f8-f3e8-4e80-b355-d221d0424576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391750, "uuid": "d4e70cb5-5f67-4551-813f-d9af03a1f551", "value": "d8748bd07e7f282b21f60af22dbfe21e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db9f5b0-ac09-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676339281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339281, "uuid": "e679d7d5-6f16-46f7-98fc-50f9cdb83818", "comment": "Malware payload (RedLineStealer)", "value": "824cfd1289d7012b31c5a9ddbc63e0f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339281, "uuid": "f00aebd0-f159-4af6-adaf-27aa6686f10d", "comment": "Malware payload (RedLineStealer)", "value": "6f75732941dfdaf7c3e9ed011210e433b2d22b39dbf20b8187b6c7c23fd34b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339281, "uuid": "d381da01-bc12-4514-82bd-4aa9804996f9", "comment": "Malware payload (RedLineStealer)", "value": "c6bd5acdb8d0a1b73a59830216733c5aeaee2b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339281, "uuid": "0134f30b-2d34-434d-a982-c6e851b2b2a6", "comment": "Malware payload (RedLineStealer)", "value": "6fb75924f76fbfbe31b2eae8b668f047d4f0ba67b567f524be81eb60a8e31e5c52099082a85967beb2da659f2e0c117d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339281, "uuid": "644f3d8e-c5bf-41ba-a72d-b54b80a243ba", "value": "T169F41217E7F8C032E8B097B059F607C31A367D605AB8475B224EAD5909736B1B632737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339281, "uuid": "a586be43-9c50-4514-8e39-3b0977fe1ac6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339281, "uuid": "7ff8d837-7c41-4e5a-a913-a34ad6fb00d9", "value": "12288:uMray90T1ZAYXZ6+aBR7R9njnaQdfnlXDEwuhpuo8A6GDPGLCXURQ:ky8BaBRlx5dflXDEwueANb6xRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676339281, "uuid": "c7d94ffb-56ab-468f-bc18-06d207324fe6", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676339281, "uuid": "43e733a4-a7b9-4270-b937-bc18b7a768c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339281, "uuid": "8fe99990-583f-4cfc-8b65-58b357a9c5d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001255c4-ac99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676400864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400864, "uuid": "2f901b76-86be-44d2-9228-7b439233c89b", "comment": "Malware payload (Vidar)", "value": "a0319593f9a9c7e90f32e2ee405b415a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400864, "uuid": "1c538b14-44ee-4f40-85c7-7562cf3a419b", "comment": "Malware payload (Vidar)", "value": "6f8c5269ce2ba1e2baa595221a138240040aadf80c8819380563a72a3b7e024b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400864, "uuid": "fec9e8ec-019d-42ef-9c6c-27b3727c0468", "comment": "Malware payload (Vidar)", "value": "7958d5d77c16d8fd0dca901fc62a8c48f430ea71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676400864, "uuid": "622fe329-af12-440e-aa2d-b64e47edb28a", "comment": "Malware payload (Vidar)", "value": "80611ebb0c6a614e6259942b0b990c24bb7c90e1ca5a47c4de91d2159f0f2b8c4a96b15ad3aa8f5e41b1c6d7af178405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400864, "uuid": "e501439a-e58e-453d-8c76-ce328a25fbbc", "value": "T14DE448C533809057EC674A704F93939A9769FCE1EE30319B2360F7AE0B3A9D26E65705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400864, "uuid": "8069fbc2-92dd-477d-93b9-1727e238a3a5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400864, "uuid": "12f4ef71-2ef2-478a-be42-408d642daec2", "value": "3072:yahKyd2n31lM5c6s12TQ1uHv3X3uD5pYj3HU:yahOjd6OKuD5o3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676400864, "uuid": "581e5207-d913-4e92-9d40-154d46fa23ee", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676400864, "uuid": "bb2c7706-3bdf-40f1-90d0-04cfffb7bc9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676400864, "uuid": "8a4dfd4d-318d-44e5-b114-f0cf372e485b", "value": "Setup_x64b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabfd23a-ac69-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676380615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380615, "uuid": "7ad47805-35e3-43fc-b912-2ca0a4777bf9", "comment": "Malware payload (GCleaner)", "value": "c8ea63bc6ff5c9d83ac209a6110b9ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380615, "uuid": "1c471eb7-dab3-4ba5-9620-7386c3ace9a0", "comment": "Malware payload (GCleaner)", "value": "6f901c4166d4d6485db0d4421f4e9d23a895ccccaff4eb08262d650f5caf44e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380615, "uuid": "7757f1bc-6c51-42ee-956e-47f21d50739d", "comment": "Malware payload (GCleaner)", "value": "9e655a5595ab7d31f85cedad28f6a140f1201f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380615, "uuid": "5dab0aa0-3c5d-4173-aa1e-b15f9acca19c", "comment": "Malware payload (GCleaner)", "value": "4d07136a23b5a3aa0f4025e5e8c2a6d0bdedb0833f858391cb4423ae48d7498d1d0ce21e7381742736157c7b6ddb126b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380615, "uuid": "bb53c269-5645-4969-aaac-0fdf1cb5907e", "value": "T154E5127CB154C96DD180BEB4882AD4E75CD76EE3E9E4946370ECBF3E527D288860A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380615, "uuid": "04870414-e85a-4f9e-a02e-a464c6b12e8b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380615, "uuid": "30969fce-5693-40b2-a319-6762d422a759", "value": "98304:JH11EQ+84vE7hPK64QEtB2hJvTrEh70MqI/vUv2MR:d1WN8hm2hKH/MvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380615, "uuid": "2feae6c4-1a41-4659-8b74-cc942ec77d9a", "value": 3189391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380615, "uuid": "174faa6f-a9b6-4e11-b9a6-fe934ce50669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380615, "uuid": "1c87a794-bedc-432a-9771-e4e71f2e2e5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd7c5cc-ac6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1676380835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380835, "uuid": "636fa11f-1dc7-43b2-b4e6-06b60cdefc60", "comment": "Malware payload (Guildma)", "value": "75782f13b7c2d692a630959bcdab409a", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380835, "uuid": "25bdf34c-3456-4469-bbe6-12520eb213b5", "comment": "Malware payload (Guildma)", "value": "7000fabccdc2967be9c2b831e9ade0aa9cc2009ac164881203fb80691ec48fda", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380835, "uuid": "e956a288-1874-40c5-8732-0ebf7506cbc0", "comment": "Malware payload (Guildma)", "value": "3eac31e90e775c303190da4604047473514032fe", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380835, "uuid": "451a3d14-ca8f-4142-9f02-238bd8073681", "comment": "Malware payload (Guildma)", "value": "8bdaa6d3406c9d7d916ac6ef7597f9a6374dd4bb3d9344ff2f2a387fa6eb9f24fef04e079ad0601caad41ebea84f1c21", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380835, "uuid": "16837109-06f0-411e-b4b1-a94d240ac372", "value": "T124E0C26AE985FF53936D6E4A0F4A23395C443AEB5C11752BBEC74B124A08B00BA0E690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380835, "uuid": "20664ff6-d3ad-4a53-a9e8-c6464562017d", "value": "6:SGIfGlkUkncOoiVf2dIjdYLYPuOmImsXeAhoBIUQmKhn4IWgBABWEf5nlF:QgkUwNDVf2KjdYLYWOmIm7AhoqUQmLF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380835, "uuid": "f9d4993a-67d1-4f04-988a-59c94225bcd2", "value": 301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380835, "uuid": "3cc1e9d3-4f8f-4e16-92b0-dfeeb7ede25c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380835, "uuid": "98cdaa4f-fb40-42af-bf9e-4d25f9e1f1cf", "value": "75782f13b7c2d692a630959bcdab409a.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec195de-ac70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676383333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383333, "uuid": "94831766-784f-4b16-b45f-7584dec0d390", "comment": "Malware payload (RedLineStealer)", "value": "e3d437e93ed65689e4066de5947337de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383333, "uuid": "a6ab7832-4611-43eb-874c-651213375b5a", "comment": "Malware payload (RedLineStealer)", "value": "705ceb57d7352085b86c2b965a841e4ca67625e1867caf6d3a5967362c0d7f44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383333, "uuid": "3d0955b0-e77b-480d-a512-2d855bfe0c1e", "comment": "Malware payload (RedLineStealer)", "value": "f2a1e0fd7e0d9c467bf254f74aa4bf4c2436c225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383333, "uuid": "b93dc42a-ff70-41da-88ca-b8446d0111b3", "comment": "Malware payload (RedLineStealer)", "value": "974fd5e71f0af390a5f5807d91725c17305a92bc844727670bce28194a29cbfdd1e74e0320184926d0d150b717f4a0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383333, "uuid": "39282e0d-500d-4ad7-ae8c-bb5d6f509b43", "value": "T1DEF41207BBEC8073EDB547B009F603DB09357D519E34862A665EDD5A04722F0E63637A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383333, "uuid": "97e921a8-fcaf-4ff9-a8a6-ca75ab31294e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383333, "uuid": "3a2c4cc6-e1f6-493b-bfb9-48ba12c33311", "value": "12288:+Mrzy901cSJuV7yDPPO/w7fHWxppXj8VRJb9lBg77eIid2CDUPuLq0SYM/V:9yYdwV7QHT7f8QVVQ77LikC4GLqn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676383333, "uuid": "e3fcf196-3bb7-49d1-af02-f426d424080b", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676383333, "uuid": "1fc3d4be-55c9-4e0b-9151-bbe99edf0548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383333, "uuid": "fde7e8c7-15f5-4267-9052-60c14961db08", "value": "e3d437e93ed65689e4066de5947337de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e7d09c-acbf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676417566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417566, "uuid": "0751d854-730f-4f29-b8c3-5a782beb4fd0", "comment": "Malware payload", "value": "bceaea6f8f207506723e320ac8dfc6e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417566, "uuid": "7c0d05a9-66fa-4463-96f2-bed5aea293e2", "comment": "Malware payload", "value": "712633761ec3ca1db50cb8c994697504c8abbef9f801fa480b999059382006f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417566, "uuid": "14c1c193-ed7d-4679-b113-841766f32b86", "comment": "Malware payload", "value": "1027c61f785f20dc376b4ae20e841fb7fd733a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417566, "uuid": "d314da39-a21e-4986-bfba-8bc803b1082a", "comment": "Malware payload", "value": "328a3a0c50c234959a4c122627d1b4e3b5c45a20d7d5b9678168413b3fd7e9953bdb54678da2d343c559114347dc3cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417566, "uuid": "57662129-2739-4f56-bf66-e1d5f9b3727a", "value": "T12BB32B23F691CBBFC08792B426CF9D919833F1F91766322B33A46DB42B194C62D59E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417566, "uuid": "84cbd74a-e510-4fc6-aa57-199e48422f9d", "value": "3072:TyIF3yjczarP3Dpa1NDZZFhzWiu+RmXZuJXQEFJZgQe:utrP3FgFhzWi1mXZuJXPFJZgQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417566, "uuid": "76033a46-3f13-40c6-abbd-ac094f359fef", "value": 114136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417566, "uuid": "6f633f5b-9296-4ea8-a0ef-8ba3ec3b6c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417566, "uuid": "2a7e7cae-2619-4032-bc67-bb628f48a4f0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b45192-acad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676409491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409491, "uuid": "1fb67020-9092-4a5f-b0a1-12d9171d4029", "comment": "Malware payload (Amadey)", "value": "8861b090d2d732fb7ab82d5affee9f09", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409491, "uuid": "8c546657-2d45-4c78-b17c-8af4118571f8", "comment": "Malware payload (Amadey)", "value": "714e6830d29aa2818f7851c0787a920ebdb3f568ce64bdce0438171a173b373b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409491, "uuid": "685e3719-4ef8-4a36-85f4-c2ad0b88f8c6", "comment": "Malware payload (Amadey)", "value": "fe5ac69eafdfeb95420664279c0cb94dca0805cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409491, "uuid": "86789a35-1247-487b-8a1e-5d7046a62be5", "comment": "Malware payload (Amadey)", "value": "5217aad754491ace24bccb7a78c062c512051cfa3bac52a973a3bca3c4a8cb78f6c28b15e757527969e5703601a08e9b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409491, "uuid": "a44e419f-2550-4aa4-9b71-4ec2c70f2a02", "value": "T11B151247F7F89422E8B657B00CF742E71A3A7DA01A3482D3279E7C871932371A17576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409491, "uuid": "ebce9ec3-f01e-41c1-99a3-c91d6c9ba1f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409491, "uuid": "e93984cf-f011-4780-a258-0497163212f0", "value": "24576:RyJahPViFDz1A3rYX4Jx0nk/JhkmLDkGM6hZRBvUfvW4VF:EJahP883rYX4LImXi6/W3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409491, "uuid": "51f35226-a2e1-45a9-92f9-59f6c2743bb3", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409491, "uuid": "0f216330-0d1f-42ca-8f86-2c553823577d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409491, "uuid": "93da3d72-2d37-46ba-a49e-4d4aab41c9ea", "value": "8861b090d2d732fb7ab82d5affee9f09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb8da7d-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676392804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392804, "uuid": "cc463b76-d3f1-47f4-9f05-082b71ec6cf9", "comment": "Malware payload", "value": "d8f27f70ce3aa33171face66d0e8c9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392804, "uuid": "2797c846-da25-4e0e-b1b7-1a7ec1b7ad5b", "comment": "Malware payload", "value": "7153d55df03ff738c5c750a640e4a2e8043f4d966366939351cf9c902d25cb4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392804, "uuid": "6384f725-02b7-4b42-a1b0-76961db5d9a3", "comment": "Malware payload", "value": "e63f67751a33a68605d9aaab3e6b40eac7631d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392804, "uuid": "ccc00194-e4f9-4db3-bfe1-3cf62642b22c", "comment": "Malware payload", "value": "ffeedbba8e3d13d2bf2ed40a639d264ae6b531be44c6a47b4843e8d504ea68758c9f146fcfa7e2643b1fe5598b0470b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392804, "uuid": "22701b2e-7d36-4302-9f6b-7f27708d7953", "value": "T163440261B4B6C173D5869570B874C2B1AD9F7C30236558CBB358076C1F223E2AB7A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392804, "uuid": "eb58b98f-b682-4b4f-9d76-b09c0577ba14", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392804, "uuid": "365a387c-0df9-4071-bb35-239d50bd2042", "value": "6144:1mLaGCCR4cIxnmIjTwoJ7+SmMwe82FIaHBalgqjH5nQ:1mhlIxnmI/5+SmMs27WguQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392804, "uuid": "7bcc4121-affd-4c6c-9fe9-1ad19ce54167", "value": 258702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392804, "uuid": "b718af32-3ac7-4231-8b85-69e7a3e50df4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392804, "uuid": "fe7ce3a7-d069-462e-b409-4b2307c721f2", "value": "d8f27f70ce3aa33171face66d0e8c9a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8e553f-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676399008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399008, "uuid": "87759c3a-6225-47d7-b564-3fa147d3fff2", "comment": "Malware payload", "value": "f18836fb06be0ada9b7c0388c5d9af47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399008, "uuid": "3016d41f-77f7-42ae-b93f-5fc4419f1c31", "comment": "Malware payload", "value": "716d56fa4c21e2c36a18dd5bc1408f2037f61600bfb11c2bca9add59000c19fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399008, "uuid": "340055ea-e3b6-4af2-916c-6366d2a25683", "comment": "Malware payload", "value": "92648641d7fedf68c2f90156da6dc92457e7a1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399008, "uuid": "a8fe1eb2-ecd2-471a-a606-419c47d88682", "comment": "Malware payload", "value": "e3475c6379603098a93c25da086a5340609e421930ebdb03c8ceea964287d138e45a6415b302802857de540ac8ed9160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399008, "uuid": "7acf2dc7-604e-4fcb-b373-0315b53873c3", "value": "T1B8B57C343EEB9019F173EFB64BE4B5DADA6FB6733B06A41D1050034A4723A81DE9153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399008, "uuid": "4f0216d6-d73f-4572-8439-b977612cbbf2", "value": "24576:2mcKILljqpErRz189VVeCVuTo73h7HdJwkwbHtCycIjqjL:ksCurqcabNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399008, "uuid": "8feb5f9b-8c3e-404d-9378-58c557bd4025", "value": 2477568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399008, "uuid": "fd7bea9b-f3ed-46be-8339-25504ab14981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399008, "uuid": "4e967807-9128-436f-8897-6b6d3052c7a2", "value": "IRD-N.\u00ba 8800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27048e33-ac74-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676385038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385038, "uuid": "4ea2a868-bf7a-4774-898f-f0d6c5aa88e1", "comment": "Malware payload (GCleaner)", "value": "8f40dd44b9ec2fe88f8035fc1d5da5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385038, "uuid": "a7ca3fbf-188b-420c-9533-143a32cddb98", "comment": "Malware payload (GCleaner)", "value": "71873b175fbc7631794d4168b22d171162169f2b96ad895317db4a9b6d6f625d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385038, "uuid": "779729b0-8006-4f91-a1f4-970298881e03", "comment": "Malware payload (GCleaner)", "value": "58ba61f32e2f70e3d2d8eeecc96b9475e9737f59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385038, "uuid": "a10d8f54-3ab4-49e8-989e-f8a241585994", "comment": "Malware payload (GCleaner)", "value": "77a92c18c88a443f8980fb5727893f19d3705c7afff3302333fd82695a24f9e84cf6f7532941f56a747efeb89a57cf61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385038, "uuid": "5032f872-7556-4336-81c6-c56f18575b06", "value": "T120E512BD7155D4ADC280FDB48C2AA8E74CD76EE3E9E4A01331C97F3F95792848A0A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385038, "uuid": "4ee5919e-6e68-4657-b14e-67c2afef5d78", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385038, "uuid": "0fca2bb8-1498-4d52-8723-c59067ff5eaa", "value": "49152:rdHUsGgYzi5qn+M1CoJnluw1pIgfSB9b2rJIb8P9uYB2hiQCbJNNYmLLCgv2MR:JHUsK3l/nj+9C88A1i7JNNYYv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385038, "uuid": "1699f6a6-e001-4b19-bd6f-2e4e4c9432c1", "value": 3168108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385038, "uuid": "58c5c871-8834-4bf8-bb95-936e272f0bef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385038, "uuid": "7e204bc4-4d5e-45a5-9fb7-9f2933a7c00b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1354a68-aca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676405000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405000, "uuid": "993cab37-1d98-4bf2-961b-97866281f65f", "comment": "Malware payload (RedLineStealer)", "value": "2584d219bc9a55aee32c9740c90fc7a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405000, "uuid": "182047f5-8319-4aeb-819c-4a777f2579e5", "comment": "Malware payload (RedLineStealer)", "value": "71bf21faa374d57537ff7444a906edceb19ded4dd18749979db7b07672b7b9b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405000, "uuid": "98d6c283-c8a3-4b21-8ad5-2bbc97036959", "comment": "Malware payload (RedLineStealer)", "value": "57c1629e30e9461c64b952ecfa43fe0c74f4b9ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405000, "uuid": "e46ea7db-ef8e-4643-84db-3bdcfd401348", "comment": "Malware payload (RedLineStealer)", "value": "64d0b96e4e25f7dcc987c807266a1a8b1fa71d1b4e115affe1a3808d29aed7cde494c4877d00be3e76a89c6f227a0426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405000, "uuid": "b4c1259e-b91c-4698-8ee8-8f88eaa48370", "value": "T1FBC40207BBE88432E4B147B04DF703D31A357E615939C6AA278E9D5A0CB26F4B630767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405000, "uuid": "579f7276-0d4f-4e3f-b32c-448c477bd79b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405000, "uuid": "6de14fc8-f261-4182-8541-288628155aaf", "value": "12288:QMr9y90hEYVhZmVcoHdgRKfsR0TNlXoJIGDwXa:9yWBVh9oHdgRKfhPXoJI+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405000, "uuid": "8f78c1c1-bb42-479a-a721-9d6445ad54e7", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405000, "uuid": "9ddadc4f-4c96-488b-826d-df0cbefa5880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405000, "uuid": "21340a3e-15ee-486d-a212-24fbf78273d3", "value": "2584d219bc9a55aee32c9740c90fc7a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6030ea-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676408485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408485, "uuid": "dfbd63ed-a68e-4505-a0ff-effafeab4b74", "comment": "Malware payload (ManusCrypt)", "value": "f3d464859f4e51c5597eec7931ed9195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408485, "uuid": "b01c08bb-bff2-4712-a5fb-e21bf8c1164b", "comment": "Malware payload (ManusCrypt)", "value": "721c6344039504a039421662f0c681147aa140f3ee5598ce17491ec60cd21dab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408485, "uuid": "37cfc076-f873-43d0-a816-9809d00519aa", "comment": "Malware payload (ManusCrypt)", "value": "26c39bcdd17bd5fdfed9b55da143672c780966d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408485, "uuid": "776f8e3c-bf35-42f8-81f1-d62461ddf5ff", "comment": "Malware payload (ManusCrypt)", "value": "18cdfa8963f5547ec835bcbf2050f8cf3dd6de495da518fff99ea4390e1c2f56cf1aaa5c7333dee1c92bc47ce4468a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408485, "uuid": "cc61d25b-2c35-44b5-8b86-a66bd9b8ff66", "value": "T1E6841243F3E18839E073CEB05C90E962893B79254DBC650837EC9D9E9F3B5829256783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408485, "uuid": "82fd1330-0608-408e-8a68-5a94033b65cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408485, "uuid": "5f7a083c-a139-40ab-9e2c-25eba23749a1", "value": "6144:x/QiQXC4km+ksmpk3U9j0I8Q88QvOGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZogE:pQi34P6m6UR0IaFvlL//plmW9bTXeVh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408485, "uuid": "80f8995c-41c6-4fc8-8eb5-cf51cb351744", "value": 390110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408485, "uuid": "26da27ef-5ebc-4a6d-9e5b-bc2cf70efd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408485, "uuid": "0e08dc75-5496-4cdb-8d0c-e420037fe271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3ea6a0-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676392835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392835, "uuid": "186ffcaa-ea8a-4eca-995b-a389db0be7c4", "comment": "Malware payload", "value": "ab1705cd81052a18f2071c3345b345ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392835, "uuid": "48501d8f-215c-4de8-b9eb-75166f6f8cfc", "comment": "Malware payload", "value": "723460e55ec90676ca3d3fd91b8b1fe2d15fc8b5196a4299b331473c34477ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392835, "uuid": "f9499108-f472-4cde-a034-dcedd4155c22", "comment": "Malware payload", "value": "39e01ad489d372dd07622aabb1732fe0039fbe3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392835, "uuid": "b333b254-da9c-4cd0-8325-a8f67886ff8f", "comment": "Malware payload", "value": "b118f69375ed243b9a47ece6542728f10302b9cf4d184854fffaecfe28a0f8eab68aa6028795f474c1bcb3a5c793fa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392835, "uuid": "809a4561-64e5-42c4-8467-1c6e6e66f963", "value": "T19976332471B8C4B5F13A61B3C8F9B6BAE16582F44F727873A3486917AB7D1D0252B70C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392835, "uuid": "f3c3d2cf-3432-49d4-bcc8-155c7a683c8a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392835, "uuid": "544ac7ba-aaf0-4fe4-b7c9-a9a241ca465b", "value": "196608:91O7M+hgXiVdZYL3nIyYyuPfw89uZWahxtHx7oetTcD8BpM:3O7kG87ndbuguSWahxtZo0Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392835, "uuid": "4856e2dd-53f2-428c-98c5-1be5af511386", "value": 7597163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392835, "uuid": "8c56a455-0f5f-4544-913e-30ad3d343020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392835, "uuid": "fb7d2e8a-18a8-44b3-9960-8d1414314ffe", "value": "ab1705cd81052a18f2071c3345b345ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ef80a1-ac54-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676371269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371269, "uuid": "e18218ce-9ca8-40d2-9b93-243006d6c3c5", "comment": "Malware payload (RedLineStealer)", "value": "7814f18017526f075b9ceddc5c7c45da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371269, "uuid": "3fb72919-27e4-4eed-b203-006aa54c5c43", "comment": "Malware payload (RedLineStealer)", "value": "728f5f728d9d7a65e3a7d632f7bab4c7fe0834583476695b75ff014a376975a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371269, "uuid": "f5ed5734-6c0f-4e54-bf25-33c566810481", "comment": "Malware payload (RedLineStealer)", "value": "781fc18a2144a90f28ede63b257c139b2368c6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676371269, "uuid": "9a564482-1673-4d60-a008-447203c7d828", "comment": "Malware payload (RedLineStealer)", "value": "33404bb027bb6f0edefaece0a67a2293563284d16d003a5b86a588f4ede318226f2bdf93cb9fb02c25cc7837e4b33e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371269, "uuid": "a8b1f8ca-3af1-432c-a6e7-5ffc9fd571da", "value": "T171F41207B6E84523D8B4937118F343D30A327E91AA34C79B538B9D9E1CB7564EA7432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371269, "uuid": "f90d0677-8ce2-4990-aaf4-3eee5495443d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371269, "uuid": "1972700f-6756-47ad-99fb-5cec3ef1f7a3", "value": "12288:4MrTy90Oe7BI9JeqDx+IMr+PuAh1FvDcZJYy9x6sJxbz1NSqSGNE:by16BGWrauAh1FvDcDp91BNLSGNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676371269, "uuid": "88612eda-936e-4af9-a87b-3afef797e184", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676371269, "uuid": "b34d7ce2-cc7f-453c-b37f-475b11c12b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676371269, "uuid": "f82498a5-3fa4-4f3d-b54f-f0be404f8d89", "value": "7814f18017526f075b9ceddc5c7c45da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4146ada-ac91-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676397838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397838, "uuid": "c2b8a7e5-5614-4750-90a1-c3a3f3176da8", "comment": "Malware payload (njrat)", "value": "24eb38424df3661a28771e2149f625ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397838, "uuid": "45a377f0-ab9f-4905-82ac-11b68e0c3765", "comment": "Malware payload (njrat)", "value": "7291762d6b4a2222d054eb69fc32be59d4f43b248c90848730ffb14e03665ba0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397838, "uuid": "7878337a-037f-4edb-8981-ca2ec8fa3900", "comment": "Malware payload (njrat)", "value": "216d891c8b4047cce508ad53f67977ca43d70a42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397838, "uuid": "31f16f81-cedf-4c09-a54e-2a261cb61481", "comment": "Malware payload (njrat)", "value": "6d158718112f05502dd7114048114378179b8047f634f159af5055e1a08bdebb311a4598a1bc480a76c364e0052f4cae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397838, "uuid": "840af4db-8337-46ac-9096-18e4fab991f8", "value": "T12493ED1225EF149DF3B78AB22FE5F5FFCA69E923150A70BA318117468736D02AD02375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397838, "uuid": "fcf3e0e5-4d8d-4902-b8fe-cf5946ebce42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397838, "uuid": "0ead38b3-534e-4e6e-8066-80b9de7bf3fd", "value": "1536:2nJyPg2f/LfpIu4TUyjroZ9ABcMv2pGofaCDeP3scTfVL4:2ncg23VgHBR9y3AfVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397838, "uuid": "b19729a2-b2d3-4b8b-a7e3-b4597258cd68", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397838, "uuid": "4f5e5123-6a13-4503-9eab-316f3e528bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397838, "uuid": "94f58dc8-6099-4458-ba64-8cee8fe0fe3c", "value": "24eb38424df3661a28771e2149f625ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5072dae8-ac78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676386826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386826, "uuid": "4e82f8b4-be7a-4675-ac21-abb36139f69b", "comment": "Malware payload (Smoke Loader)", "value": "6b6cb1393aa3735b3894d18d8e86f6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386826, "uuid": "8a6cfabb-5772-4df3-bfb1-b1334f754d9c", "comment": "Malware payload (Smoke Loader)", "value": "72ab4580850370302273a1ef698032dfddd5ce8e1f72a3567e36e97d1b02d1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386826, "uuid": "c3ec1e36-cdf8-436c-84f4-5215ec79441c", "comment": "Malware payload (Smoke Loader)", "value": "63e2a7953230a6f94606415c608896140bc19ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386826, "uuid": "f17b82ef-3231-4bbb-a9d2-930fa487a4f0", "comment": "Malware payload (Smoke Loader)", "value": "4fef9e7094c7ece3a8d3c0f68b08243deb692ec873c5ac1b3e24395210339afef218bb5acb8ae5d0a3f7cc81913acc89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386826, "uuid": "2d402530-9350-44e9-ab5c-06fa61e16f62", "value": "T19604D00139E1C073D4678D751821C7A42A7FF871AB52C09B73589BBF2E322D2DAE9356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386826, "uuid": "5c76c746-c209-4a1a-be1f-a28001648f2b", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386826, "uuid": "85b178a7-ddce-454f-bc93-cd53089d6b11", "value": "3072:XPujN5LUR5x75oyZ2hmLegexpMt3SmtSt/hB0PRyO5UqknFDo+n2UJ6rsq2eC:X2x5LUR5xCccmqgqMtbY/hBEL5Uqk5wQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386826, "uuid": "3ce2d983-6ab1-4f98-a106-40ecb976896a", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386826, "uuid": "893ca7a1-3db1-4c4f-b162-24e2387aed8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386826, "uuid": "1de39436-2358-47e6-8c5b-840880bf310c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e131797-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676393264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393264, "uuid": "5cef3a1d-da7b-4584-9a28-ac378b0e0086", "comment": "Malware payload (GuLoader)", "value": "8a5992674c9252fc71450161c34f9ec3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393264, "uuid": "9eae7c7b-1747-4d08-8db8-e669e63b49f5", "comment": "Malware payload (GuLoader)", "value": "72d818ad1343209058daa8bd2bf28da61d3be0975976b00badd37cebeef2ab63", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393264, "uuid": "b5f0e680-e13a-48c1-a045-14ddf8a4cbd6", "comment": "Malware payload (GuLoader)", "value": "48f1abfd0e17c036b5359dbea37f589f4db9e8e4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393264, "uuid": "c4a3eefa-cd3f-46c6-9bbb-c14beb6ab60a", "comment": "Malware payload (GuLoader)", "value": "c60e7ff5406b21cb54df958ed8994b3735a1afab9e374453c2340f7efdf6e6f0ddb2eb9f4e1a9f8236b3858fe2809cab", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393264, "uuid": "22331f01-8f57-476e-a3f1-5998eba69a2b", "value": "T17333F451A82626D448CB1ADDF8D33A780E2D4DF5740E5F3A299F22C93FC231886F9675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393264, "uuid": "bb780a20-b0da-4e0b-ab1d-ab5160b65fe0", "value": "768:bXoVbD0bra2p8ufeNPrFx3B9XwiFdCqRS+SjjF+THyy2EC/1+O5LK:bMMa+84elpxXXDLAN8yy3CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393264, "uuid": "53f27fba-9c8e-4196-846a-8eed6b213800", "value": 53178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393264, "uuid": "22ddc7af-374f-444c-8875-1262888ca764", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393264, "uuid": "e2a07b01-13bb-4fd5-a791-2f052952b9ad", "value": "Payment Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40f5bf7-acbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676417568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417568, "uuid": "45b24376-7499-4287-8ffb-39fe290b2f0a", "comment": "Malware payload (Smoke Loader)", "value": "807ed2c65245a4fd0425d0473bc66991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417568, "uuid": "77f16535-d77e-4c2e-8dd9-e359d23594bf", "comment": "Malware payload (Smoke Loader)", "value": "73023c7983cb881182a5b6374a0aa00c6717f80ab86dbb5eb7444618a57091ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417568, "uuid": "0bfa3f26-4334-4f32-a07e-c86035af0e5c", "comment": "Malware payload (Smoke Loader)", "value": "60a8379ec1ad17ca7cc399fd81fe1ed4c50b6676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417568, "uuid": "6239b8e9-0255-4c26-ab57-5646d321764f", "comment": "Malware payload (Smoke Loader)", "value": "5eb70f3cfea3cad947291b43f89d0b3274bb1c7b50bdac6e3804263b5b010b5ef1c1a01dd80b8175e7d25bc931f296b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417568, "uuid": "a4eb5dbf-8893-4702-8e47-2fb83bbd4f19", "value": "T15614DF2276F1D0B2F46F85345420EAA06A3EBC7167A1858B337A167FAE306D1477E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417568, "uuid": "8112fd25-8726-4c26-9424-af2f69d08225", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417568, "uuid": "5da6adc9-fa1e-414c-bfda-8296866518bb", "value": "3072:uACNpIpfGVmLl+yurZXXm8Uy5F5vvhcDwyM08SQG2Hf0F1DHvSF6X:LfGVmLl+yuVXXm8UO5v27M08LQLSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417568, "uuid": "b506190c-cd12-4bf9-b465-92dbbe20f71e", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417568, "uuid": "4302e25a-cd8b-4324-9a78-0a1971e236ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417568, "uuid": "9c483701-fb6d-4635-982f-01bf1ee0b450", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af89fac6-ac0f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676341888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341888, "uuid": "efc1a9a7-cc0a-4e7c-ab65-cc44445588d8", "comment": "Malware payload", "value": "7a60b74409212f4c39d40eca34873f3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341888, "uuid": "7a4415d7-eadf-414f-99f9-9570193a4229", "comment": "Malware payload", "value": "7324d33d2a93441d0fe49fe03d42a758d6ce5ee9ea1329168ded3cd04dd5e7c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341888, "uuid": "cd6da727-4ff9-4adf-8cd5-2636b291eb64", "comment": "Malware payload", "value": "d0cb3c12aa342fb101af612f0179f104798f70b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341888, "uuid": "50b129d2-eae9-42ce-82bd-9e2a61e27643", "comment": "Malware payload", "value": "787a4e398bee93b8c91e38d8f17f1870a802cf52d7f53b3770741b15aad7dc4f5079de0c9266d7a15fec6b63402ff8bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341888, "uuid": "45067b2b-896b-473d-a061-912d52d4f0a2", "value": "T1BEB10D1FE6549C2346B3773E885F810AFB2281B3026984017DDC51CE2F76576A4E2FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341888, "uuid": "fbc3a767-9e3c-4220-8022-52d46967fba2", "value": "96:33t7R3iu+qyMyI0SB0d8vA8yXXkba8XWUaD:397R3ilqyMyItB0d8cXkba8XWUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341888, "uuid": "f21302c0-2c30-4c01-bd6a-99bbadff8c5b", "value": 5147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341888, "uuid": "c444b599-e82f-40eb-97b4-c5b8de620b4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341888, "uuid": "508a6c58-d8bc-49b7-84b8-ab38a0ff25d2", "value": "index.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45ef68d-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676393087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393087, "uuid": "29f09f50-4457-4d16-bab1-065798112f50", "comment": "Malware payload", "value": "60fd0765120838062b1388df89a3e2ea", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393087, "uuid": "5f11ea6f-8a75-403a-b78b-3776100edea0", "comment": "Malware payload", "value": "732ca83f379dd429505350fab8d4af4186cdb543acaf58e037961bbe667c0e15", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393087, "uuid": "0b1243e8-bd50-442e-83cc-11473d72426b", "comment": "Malware payload", "value": "a772969cf99df255ea87dfac69c4d636b080204a", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393087, "uuid": "ecc3a65a-c6f6-4e38-b258-13c9b0d08b50", "comment": "Malware payload", "value": "45e0339632d1a12e03d8d7b7f3ae775d41019ec083a153b203f4a19e93d85c17522ecd7d7f828584d9500fddedef430f", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393087, "uuid": "4970dadf-5a3a-4363-ab9a-6aecdd3af611", "value": "T191F242A2B2D5D906C94807354CEBC3EB6736BC519FA2874B3289F71F2E71A80C953617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393087, "uuid": "a8402d35-c645-449f-a644-c8553737efd0", "value": "768:/qlxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAKF6seELLrOWrPlz/JSD2:ylxEtjPOtioVjDGUU1qfDlaGGx+cL2QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393087, "uuid": "ac41174d-08e8-49b9-93da-73316f52c0d1", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393087, "uuid": "a83c85d0-1bd5-4437-939f-27562d88f7fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393087, "uuid": "0c29c1a6-d553-4518-8d24-f9d5506e1073", "value": "Parts_Export.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e97613a-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401882, "uuid": "69f19732-1feb-4c73-9260-73a918382e5b", "comment": "Malware payload (RedLineStealer)", "value": "849ea1e178fcf11ae6e07abc591bfaf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401882, "uuid": "41f34f1a-d9c8-4e70-964e-2c5edf1c0c18", "comment": "Malware payload (RedLineStealer)", "value": "733a22a88cd20d924eb527f310048a6fe8edc8674ff3187557c320bbb895235d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401882, "uuid": "1ab59b75-e619-4a25-9672-b30122b8e788", "comment": "Malware payload (RedLineStealer)", "value": "38fa242077c04e1cce637604ead5aebffb0caa96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401882, "uuid": "e420a2e5-4b90-4561-ba8b-547dac27b241", "comment": "Malware payload (RedLineStealer)", "value": "c521d20674b667412a0652f239abb6baa534adfb9d428d8a74b29fb00814aa86ecce1e9b2f86ff5f2168c5dc4f94206c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401882, "uuid": "bb355b46-7c47-4410-8258-c6f86a60d6f0", "value": "T110A40207A6EC8473E87567701AF707C319327DA06B75879B278F9D5A08726B4A23037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401882, "uuid": "fbdf1325-6316-4de0-892c-311344749804", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401882, "uuid": "2c4cf4d8-6c57-4aaf-9e5e-5c35111d5966", "value": "12288:0MrJy90iB/AjBM67hKxVnVd8raAR4flc0g7Z:dycjBMAhuVVSuKRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401882, "uuid": "c4e49702-50cd-4f88-a812-a66f71ca9a72", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401882, "uuid": "d67df4e6-bc85-46ee-9fe7-bb760f2fbb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401882, "uuid": "fd2efd6b-ef58-452d-9cd5-ece3381417c2", "value": "849ea1e178fcf11ae6e07abc591bfaf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40921d4-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676393060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393060, "uuid": "14bf480b-a6c2-4cd6-a5da-13cac6093fc7", "comment": "Malware payload (Formbook)", "value": "804325479dbee0cfbbf2945ca60fa8f2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393060, "uuid": "a8d1ec30-eac7-4f56-bd2c-efa88cc686a9", "comment": "Malware payload (Formbook)", "value": "73ac8e220a586c3a08e92c808c0062ca29028d923317cab990ef412cb745c7fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393060, "uuid": "83fef4b2-f700-4b07-abbf-81c34117166f", "comment": "Malware payload (Formbook)", "value": "e99a22e4a8565720daec0f229c89ce1227b649bd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393060, "uuid": "61a1c290-1a0f-4fb7-9b12-0fac1c44ec47", "comment": "Malware payload (Formbook)", "value": "5a6568802967b1c767671262b9eb8fed98923b5856e890840de10a0777ef77e30eab876ce02cca4686f8d60f3512992c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393060, "uuid": "1b978b32-76d1-495c-9fe4-d4d5d1a30aa8", "value": "T19F65123BE059FDB6C826033465E3C6220013AC11799EC90EB85DB55D57B7BA03AE6BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393060, "uuid": "4596d686-8124-4399-9b5c-45ad0466ad81", "value": "24576:8YV2rXa2Tt6XZxRWZYr2Ha2Tt6XZxMMhUydgW+TsWB3ScWDju:fEK2Tt6ZqAAa2Tt6ZKvydgW+TbBif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393060, "uuid": "7a3b5650-0a05-44cb-89a4-d1041514559f", "value": 1503744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393060, "uuid": "7e8adea9-6048-4d0e-8066-4f303bd90797", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393060, "uuid": "6203f7db-1665-495f-b696-ea7b13070709", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b30d9fe-ac51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676370174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370174, "uuid": "485c5160-f3ba-4e3b-9597-071a671bf985", "comment": "Malware payload (Amadey)", "value": "3c3cbbb7de3f717a2a48e3cfd2c78006", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370174, "uuid": "67027114-ba49-471d-82ca-4301a030b192", "comment": "Malware payload (Amadey)", "value": "73e0b2b371fb911f5d7ec7a685e745684ad7974c5578ff1cb8daa1186a67ab18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370174, "uuid": "9d7cd818-bb5a-440f-830f-576210434dff", "comment": "Malware payload (Amadey)", "value": "15ade7a09139f3db9417ecf901041e1c05862d2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370174, "uuid": "645692a9-90cd-4a35-aae9-d248bfdf5d45", "comment": "Malware payload (Amadey)", "value": "75e298d74b00a33b8f2052759a3548c057566112761654f56d7c1d26134e456bcd321e0117a01ea82f26bbfa175d18ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370174, "uuid": "237c64cc-463c-4a35-ac32-d782e2958b77", "value": "T1C1F41217F7FC4032D8616371ACF203931A327D615E38839B678FAC991C76560A635BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370174, "uuid": "ea72afd4-a2af-459e-92de-800717d4645d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370174, "uuid": "e956a2c7-b9d6-41b3-a944-4d7e8a424e94", "value": "12288:SMrgy90q+lm55ydmr/Y7zOJ0b79arhFx49fxLNTHGCvylc/MetpRNmEZF:Syem5UUr/Ie0/9arK9fxVsNeHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370174, "uuid": "614e4043-9607-49a9-9b26-8136f915fa4c", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370174, "uuid": "89f9a009-b28e-4eaa-b459-fa6daca39cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370174, "uuid": "6b594c1a-85f0-4a0f-8f0a-08d608b795ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cf33b9-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676393542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393542, "uuid": "b86ce07c-8f33-4ce9-a581-7d5c1b9860d5", "comment": "Malware payload (RedLineStealer)", "value": "d43f7b574611631d645463cabd2a8664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393542, "uuid": "fb62d497-3563-4379-91ff-fcdca978b73d", "comment": "Malware payload (RedLineStealer)", "value": "73e8a8bd99536f3ecf3ff19916c57295e1f55de8a69e6628f0b978edece2b93b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393542, "uuid": "11973ec1-ac68-4e41-a50e-6909d8d31d05", "comment": "Malware payload (RedLineStealer)", "value": "4b79936be2443e5c39906e59ce37893ed6b555ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393542, "uuid": "304545a4-97c9-4a16-b048-7da79f6a153c", "comment": "Malware payload (RedLineStealer)", "value": "d49f4f2c39bc5dc9c554ab1b2c0e1a92b60c806beca89bbec18cf4925900760a7b6470f15f89d74f6c65bd01939c339b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393542, "uuid": "19c21f98-7def-42ea-8d6f-615b0b13d7c1", "value": "T11BC402479BE89033E87117B05CF743C31A3ABEA05A38835B268E6D1A5873670B17176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393542, "uuid": "62296053-3b2e-4685-809e-a1469d40b9a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393542, "uuid": "fea426bd-e9e0-4065-aaa5-64dce152c89a", "value": "12288:sMrXy90FGBWNHWWmT1xg4Owtfh3HEUgmbfQD:jy3WZUT1xFtfh3HEtWfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393542, "uuid": "3a8ce755-8306-49d2-a6a0-a013cded9c88", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393542, "uuid": "e2446527-2d81-45f4-b1ac-eec7d9ce29af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393542, "uuid": "a881b30d-f7c2-44d6-95a8-3dbbe81dfe6d", "value": "d43f7b574611631d645463cabd2a8664.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545e80d3-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676401865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401865, "uuid": "879f2e1e-39ba-4447-8248-fb17c650f4d2", "comment": "Malware payload (Amadey)", "value": "0694b213b2f9841d265672056c58cc1e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401865, "uuid": "5e5cd2d3-e2c9-47c8-abea-b9aaf54f2e5d", "comment": "Malware payload (Amadey)", "value": "746201c10af5572325fdd275abb17d213aef5c7856fdd74fc35dbb34db70c968", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401865, "uuid": "9a0b379f-9060-41b9-b190-d212c3a73fb4", "comment": "Malware payload (Amadey)", "value": "dde1ee0c8c90117413139ae9ea2f5a335218259a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401865, "uuid": "6a403ea2-4c99-4d4d-b03f-a74074cfb04a", "comment": "Malware payload (Amadey)", "value": "905a8a97b569571d43221d1e3d5015dbe40f5967343fa31fb477337028aaa1e72269219283d678560d9512a62d4d0f39", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401865, "uuid": "44ced35b-2f30-4f80-97ea-3a6f56c95d17", "value": "T1FAF41217E6F88061D9F1537029F603D31E36BDA06B398397239F6C5908B36E4A63476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401865, "uuid": "b792952a-4850-4658-8948-115b67e7a0e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401865, "uuid": "2a3df5c9-37b2-431b-bc41-f0a7843f967e", "value": "12288:OMrxy90LSQ6pp3pthOmXQgPeAYZeIeCky2z2Fz4cTous+2XWR/s1t2QL9j0Tgxy+:Hyu6pp3pt+/VZeIzuTcKXWR/sD2QR8g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401865, "uuid": "c70124b9-0f04-4113-8d79-ded853b8df58", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401865, "uuid": "75341282-355c-43d0-917a-5ac523836927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401865, "uuid": "3db296d7-f736-4eb0-b80c-fd0a53196a46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c617f29-acbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676416481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416481, "uuid": "d6055702-41bb-4ffe-bb88-97acc976f0c1", "comment": "Malware payload (Amadey)", "value": "743843542aad74b22944c51656d566e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416481, "uuid": "018c2c54-58fb-4d77-88c3-37393190b612", "comment": "Malware payload (Amadey)", "value": "747011884ef9c555090bddd8057bc569e3989438f9b74679f0232df34cbdd759", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416481, "uuid": "bda4ca1c-0f95-40a4-93cd-cd7ef7575bb2", "comment": "Malware payload (Amadey)", "value": "c3b28c3fb0c59ae2cd867aa86f08996deda6b36c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416481, "uuid": "81374d89-bbfd-40ce-bd22-48137194a9de", "comment": "Malware payload (Amadey)", "value": "f146f2daaecba124f1611ff08c31363cb4bda2f310ce56eb9bf8725cd42551d52fe478813362f4e29d2aa5409defb87b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416481, "uuid": "18b417b0-41ab-4392-b0a4-ae76b1209ab2", "value": "T1E525224BE7FCC522D5B1677029F612D706367E412A748367324FACAE5D732A0A23136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416481, "uuid": "58ddd291-d59f-40b9-9d62-2cde81e8dee4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416481, "uuid": "406f12f8-1b56-4e89-957b-8a99f032bc28", "value": "24576:NyN8ECu49E4VKaKHWGAHyjqfISQGKA6eqdTA:oN8qoE0KDsYSQxA6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416481, "uuid": "9803a825-9a0d-4248-9322-30c06d5ae2ca", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416481, "uuid": "dddde931-b1a4-4a6d-bfb2-68ec6bcf69d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416481, "uuid": "0d6c0990-f4c2-403a-9a6f-d6b0ee32a4cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f612ed-ac80-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676390410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390410, "uuid": "2205d563-2eab-4376-b70d-41b287dd0d4f", "comment": "Malware payload", "value": "25522add45b1863dfcf153f0ced0b2b9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390410, "uuid": "d9b275cc-e4f8-42b5-b04b-1127026973a5", "comment": "Malware payload", "value": "74b91f8bb02329e226c40752ea02b9958b16a0d49815d9a6f0c75f5381284145", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390410, "uuid": "06764c67-f0e6-4179-98cc-42303d732434", "comment": "Malware payload", "value": "04802d86053706dc70af68d7d95a549611eb9b02", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676390410, "uuid": "40370df0-4d04-4717-bb46-da836a4a945a", "comment": "Malware payload", "value": "5e9508c5e96e70d90d6b4c327bf36fe700104975459a0e3b00a2bc9d9ef3a6453885dc32aa259ec174c7f31575ff3da2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390410, "uuid": "441d78f4-45ef-4c92-9ce1-44a4bcd3c126", "value": "T16355C4091BF72C12A513743D5FAF4D096A7AA0072808DD19BD6CD7805F8A838D6F5FBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390410, "uuid": "23ad5ab9-0029-4847-ab25-06a696f08659", "value": "12288:i7uIESCJBmUm+mranJr0gzWHYhJNVESWdI4IWsOhuGiW4MuFH/5z:wrwBPTE4hJNVESWdI47sOpiz1H/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676390410, "uuid": "1ff9f940-33fa-4468-9bd3-026ad138a4e7", "value": 1285702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676390410, "uuid": "fda0ec4c-dd1b-4984-883a-932a88df533a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676390410, "uuid": "d9ad76dc-2034-422f-ab4f-92afbc970e6f", "value": "pdf.worker.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7036c02-abff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676335056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335056, "uuid": "d2a1f2a1-5c60-4e5e-8868-29b5e70211f9", "comment": "Malware payload (Smoke Loader)", "value": "dfe272e28bb08edc35b75ec486c85d4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335056, "uuid": "cc0302b1-36b5-49ae-ae84-8617bdf67451", "comment": "Malware payload (Smoke Loader)", "value": "750530f9eed2ba0aa0c26003d2e4b8f038f897bee6cf64682db8ef1727828e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335056, "uuid": "8454df45-817f-40be-892f-f439913a60be", "comment": "Malware payload (Smoke Loader)", "value": "48f1d95c4635e9f8a26f8fa665977696a8517aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676335056, "uuid": "93008b56-e7df-4ceb-b134-524e6506cf68", "comment": "Malware payload (Smoke Loader)", "value": "108fe381c8dc834c605d5f49d438aeb26744f9c155e0049814a5a3a4ac100a7b1d62ae15ca89866074eb52159de3df92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335056, "uuid": "d23d595b-fcd2-41f8-b028-3d26b1103a00", "value": "T1A114CF22B3E0E871E96706318C29C2B56B7EF8215B79AADB2384573F0D702D09D77791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335056, "uuid": "7fecfbbd-6c9b-41aa-86b1-1d4e114a64f1", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335056, "uuid": "e8aa5e57-f053-4636-acb5-08bf65d2d3d2", "value": "3072:Ep35u7a5zumQdXz/tQoNhYQ5qzLFA3zDGPHvKSe24V6UwX:ESGuTxXNhYgq1hPHOeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676335056, "uuid": "ebc2a07a-ee8f-4505-a1db-d5cd66b4df27", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676335056, "uuid": "887b500a-a883-47eb-b10d-8935eb8319e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676335056, "uuid": "1d41217b-2c5f-408e-bbd1-9e54feb162d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3b0c54-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676399570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399570, "uuid": "2b1c15b2-a5d0-4b3a-9ec9-82c650dc823d", "comment": "Malware payload (Smoke Loader)", "value": "5eaa4f79f9a43f9ed31385e601730559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399570, "uuid": "56a7022b-e5ab-4510-a451-75b1ca7c8671", "comment": "Malware payload (Smoke Loader)", "value": "75191463a7cd9d3f6f9ee75e7572033111cc22bc22b1ce03296d7f737affc0b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399570, "uuid": "20ea948e-e195-485b-a32a-ad42a7b5c722", "comment": "Malware payload (Smoke Loader)", "value": "0ecc835409a55b6c6dc067d04deb0d62f98b7307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399570, "uuid": "9720978d-1387-4349-9e7f-ee064ff1dc96", "comment": "Malware payload (Smoke Loader)", "value": "59914a0d39bb924ad316ee425414c62b35794b7471352998745950697b18c9fec65f93ec0482e756ed55abe04404736c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399570, "uuid": "f9920c76-5a05-4781-a012-4935c48ebcb5", "value": "T17014DF3235E0C0B2C56B4674D471EA60A97FBC32EB65805B37883AAF1E307D1576E356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399570, "uuid": "042e575f-66d8-4704-9bad-6adcdd1c700d", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399570, "uuid": "fe74913c-45ae-40e7-b78a-02d0a154cf6c", "value": "3072:j0HKLoSLVh5V/WVFETLZg1CEUUgFCEjQghoVwGtLWVtumI7B:1LlLVZqgLZ8CMkWPLU0mI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399570, "uuid": "dc1311da-be1f-498b-b51a-22ecad24f30e", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399570, "uuid": "bb88b5f3-376b-4fc6-9368-52a0e45431e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399570, "uuid": "4d56442b-e86e-4168-bea6-f0b1692a6e9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494ff783-ac58-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1676373070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373070, "uuid": "bc230a5b-c048-4736-a975-eda4b4fdae26", "comment": "Malware payload (PrivateLoader)", "value": "4b1556cec68dc2d5f5273d94b6e0631a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373070, "uuid": "837efbec-8cb2-4a61-a0ee-921b22e72886", "comment": "Malware payload (PrivateLoader)", "value": "75201c320189c7037a13d278e129cbb267ee7631c0c87748689330b934cc77aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373070, "uuid": "14cfd0f6-cb17-4fda-8d93-0f205325d2c7", "comment": "Malware payload (PrivateLoader)", "value": "bcee6b78124687be2ff5ac77481392fa7bef5dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676373070, "uuid": "f18f7820-e044-48ff-b3d4-3d1aa996b2c4", "comment": "Malware payload (PrivateLoader)", "value": "08ce3f23e64ad63d2fa4b57c9491fc4fc145485c9c17455f082720e27986715267aac39924fea04adabb3c5f7b1fbbd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373070, "uuid": "a3c234ec-c0d8-4614-8cf6-e1d9851a1523", "value": "T11066333751386250D8D48D398E23FCA238BB5B9C86837C7E60EE79C075629E1F142B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373070, "uuid": "6799ba46-6ba9-4eb5-8609-0b900efee34e", "value": "e15d8fdaba025278971a192141f26d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373070, "uuid": "605614a5-10b4-4a21-b1de-8ec83e3a4929", "value": "196608:5Fo5QyKigrxQzEOU8MRvSCoGvO1tA+lkMP2g2Y:E5kZrxQnU8MRwGWo+lkrg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676373070, "uuid": "f59e6bdf-8175-46f1-a3d9-93d1289e2426", "value": 6594048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676373070, "uuid": "f0d9a11b-ca77-493f-a816-f35cd56084ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676373070, "uuid": "4afd5d00-396f-41ba-97a3-e8dd4c4f95c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560e0ac3-ac03-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676336584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336584, "uuid": "2d03e166-f2a3-4026-9e50-1aa7148c17ab", "comment": "Malware payload (RedLineStealer)", "value": "253603e6fa72e7ab24c089ec5cc32eb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336584, "uuid": "53fbab91-eed3-45d5-97e0-040c147abdf4", "comment": "Malware payload (RedLineStealer)", "value": "7565b92cd460357590b3015e6a36a36ab03fd6e906d3d9c976cbf164b644f788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336584, "uuid": "9feb3f7d-44d8-4e14-9a81-a71567083e6c", "comment": "Malware payload (RedLineStealer)", "value": "a91ce519ee88482c998c241f024d6789a5a98f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336584, "uuid": "2c19f8c0-4104-4ba9-8b6f-8adf573d1bd8", "comment": "Malware payload (RedLineStealer)", "value": "16473eb433caf1ee663cd8ea4dd5d01f59e2a5fe5cd42bd34791ef709c9f0abf10d4ef339e10daa067296ec183070db0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336584, "uuid": "f469832d-2957-4a95-9ff4-156c81330817", "value": "T1C4F41207FAF86532E8B4577158F203C3277A7E604938866F234EAE155C722B0D63976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336584, "uuid": "3a97eb58-b54c-437b-980f-928a3061cb10", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336584, "uuid": "35d72b30-bd63-400e-9049-2569ce057264", "value": "12288:RMrcy904ypYXs1FCsaN/KE3FFONstxdQeJVh4uQYyDD52CK3kRLDNtPD6Qb/CExf:VyZypY8FjaN/vmyxLVi/9FKeP+Qb/CER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336584, "uuid": "eb385c08-a3b7-4c18-bcc3-cc1f51efd397", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336584, "uuid": "a174c40a-d411-497e-8289-b78ea160ca22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336584, "uuid": "8b4f18f8-ec07-476a-82c2-14cb7c1e0f23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68103ad8-ac3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676361955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361955, "uuid": "df9fa836-6370-45c9-965e-798ba9565a40", "comment": "Malware payload (RedLineStealer)", "value": "5832153822b0ce4bf941e6f484aa10d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361955, "uuid": "05887957-9808-4d10-8862-f8a3befaa1b7", "comment": "Malware payload (RedLineStealer)", "value": "75c7d26e64796eeb25bda8662afa7887d8f198946dafc4d80581b5cf22dfa3bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361955, "uuid": "6aa75526-391e-4357-8482-515e4898a1a8", "comment": "Malware payload (RedLineStealer)", "value": "ff171a87c7059db2e606f3ce71c4f3e80f8cfcd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676361955, "uuid": "9ae10b25-7e33-4d37-980e-136553cd36a1", "comment": "Malware payload (RedLineStealer)", "value": "28f64e225475896a92bd369b279c894539dd9ea7cd58b34f021f5e637f89a507680060fd08c592036d6735e4b33b55e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361955, "uuid": "c3ca16ff-288b-443c-932a-f1df9e512a8d", "value": "T131F41247FBFCC476E5B18B701CF303D319327EA1163486A6278EA84A1C735A6A57436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361955, "uuid": "df9051ed-46f3-40a0-801d-5ef0c0a793af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361955, "uuid": "fb8b9ca2-acce-4b28-a196-3a5190408e6c", "value": "12288:CMrNy90L3hzkVdplpcbkMmas1cA1F844YKheoWTcbzGqJ9tGMR:nyY3hAVdvpcbdBsa04YEeNFqJ9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676361955, "uuid": "a7a935a3-a207-4cb7-943c-679b2222a913", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676361955, "uuid": "0e163b5e-ad57-4f9f-b984-adb18977fc22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676361955, "uuid": "5529a062-7da3-433a-9f7a-d7d903412f6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbab08f-ac9d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676402716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402716, "uuid": "8dd5fdfb-a338-45c4-bbbc-6f3954c31cd5", "comment": "Malware payload", "value": "638bbfc194dd0c985ae36df0e7b717df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402716, "uuid": "5c36d206-9d55-464c-b65a-d27fe51d276f", "comment": "Malware payload", "value": "760afcb55b1494fbfc8d6299ed2a66811766b2b4fe1eafd96252886c9e1f101b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402716, "uuid": "5aaa30b3-a8d4-4b9f-a305-ae13acbeb2ae", "comment": "Malware payload", "value": "8ce2150558a0982391f10ce28e949ac04c2b686b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402716, "uuid": "698c3bc9-482b-432c-83a7-c436f66d4ad5", "comment": "Malware payload", "value": "fdae3c096b5184a8af9ca94503d56db296126d7cd9c3e5cb2369338ee497d00929fb8cfe308ea82e6fa6495ee8f4299f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402716, "uuid": "93926ab2-5e66-479d-b28f-80191d04c474", "value": "T15AF41217EAFC9021D9715B3068F203C30F357DA55A39869B568F6E5A1D33BA4A23133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402716, "uuid": "365ba63f-63c4-497d-8825-83f6a203e47e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402716, "uuid": "2cbcfb66-6573-41c6-aec5-e04c2fde1cd3", "value": "12288:gMroy90nbRyGtX8c1tDy9MGZ0g7nsbdFn4+R4Ut9u7oEEz1t1Ql9zi7597f:YyY3m0OsbU+F9u7oLzD1QbOP7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402716, "uuid": "9cf853c8-b066-458d-8357-345b4b4b791f", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402716, "uuid": "cfdef52c-c486-4963-a0d2-f6797149fb20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402716, "uuid": "3efc4c25-aad3-4e49-b2a5-5a771ad0641c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea58bd7f-ac43-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676364321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364321, "uuid": "37472451-bc28-4b3f-b001-c892889b52f9", "comment": "Malware payload (DCRat)", "value": "02a4f3dcb77ee966ec8a87a6252d9d04", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364321, "uuid": "bdc18be5-bb1b-4d3a-b2b9-ad99142389bb", "comment": "Malware payload (DCRat)", "value": "76431751970bb244f59329ca604608a026d8ec3bc4232238c642a8feee460cb8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364321, "uuid": "e800b1f3-9375-4537-ab37-5c2b28d4a697", "comment": "Malware payload (DCRat)", "value": "91448ca851104be279c619147e2c37d9da80d637", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364321, "uuid": "af322fd5-2130-4bab-bc8d-3e05f2070a30", "comment": "Malware payload (DCRat)", "value": "fee8505ae04ce518ec945ad44c3e3d5687bc383f9d276be1ad50b602a0edf0d2ce37ba91aee04c5735208cfab0e99ee8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364321, "uuid": "de97485c-bfe9-4ef8-9298-3a40c1da8fd8", "value": "T17EE5DF027E44CA51F0181633C2EF45488BB89D526AA6E32F7DBA376D65123B77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364321, "uuid": "72d6d43d-d48e-4de1-b180-371f07f72cdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364321, "uuid": "4d52cf9c-717f-4dc3-a661-56f3381eba4e", "value": "49152:wxTVTFx3B6z7Q08ZkfCnUceiGcErH7hZs9JrDrIo9k33kRHaG+:iBFxQ7j88YUncBrDrR9k3eHaG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364321, "uuid": "f6ced574-5d47-48bf-8197-bc5adce42b78", "value": 3228672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364321, "uuid": "c62f9bfc-9136-47aa-8d79-698c66b2cff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364321, "uuid": "50462306-8831-4b23-8d6a-5245a4190a17", "value": "02a4f3dcb77ee966ec8a87a6252d9d04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c7c2d3-acad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676409492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409492, "uuid": "117ce796-93ec-44ff-9624-4c9b936ae6b3", "comment": "Malware payload (RedLineStealer)", "value": "a603ab0dfd7ac3778448efebbd00aec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409492, "uuid": "bcfba557-bd6e-4d7e-ab6d-373b22a6f5bf", "comment": "Malware payload (RedLineStealer)", "value": "766fc8ce449dd7f4587c09d5bffeb010c4ffe1744519b7780d4c782456634630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409492, "uuid": "092b82e7-99aa-4188-9218-0edfe731d08b", "comment": "Malware payload (RedLineStealer)", "value": "141cb59195fd97df9154a99f6f0f191252e1a7ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409492, "uuid": "6c2b8e59-6e9a-4fbe-88bd-bf9ad07b0cf7", "comment": "Malware payload (RedLineStealer)", "value": "7acbc4e3b4a8579f91eec7f7a713c86d032eee4a797a752e1036f50105089b515521bc11dd4eb670bf8d05e782709612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409492, "uuid": "3da8c337-3c8c-445f-86de-2c9a273b64e4", "value": "T18EF41297F7EC4052E8B853B01AF902D307357D716A7146A7238EAD9B1CB25B0B63172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409492, "uuid": "e2daa1b3-f477-4dc2-8bcd-b883571baa93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409492, "uuid": "80e06c9a-09e0-40ae-91c8-094b1b678dbb", "value": "12288:HMray903n2lqKV0vehrAtFOVfy9YzdIsUSy4kRtZAmMGCcwusGie:RykAV0mh5yi5O4knHM0Zrie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409492, "uuid": "cb1844bd-72f5-47f7-a77e-cdcd1e172844", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409492, "uuid": "3676c8cc-6f1d-41fa-b47d-77ba179d2e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409492, "uuid": "ed27ff88-caed-4661-9391-3a42b9aa339e", "value": "a603ab0dfd7ac3778448efebbd00aec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd1e919-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399569, "uuid": "a351e7fc-53d0-40bb-b8e3-daa7fd623614", "comment": "Malware payload (RedLineStealer)", "value": "7643c87f5de47b918575ee321502ebfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399569, "uuid": "b65207bb-8556-4617-b22b-11468c065587", "comment": "Malware payload (RedLineStealer)", "value": "76cf22fae13d3910f82b18e8ff52bf015e3d0859b321289c0e6d704774dcf5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399569, "uuid": "8857b9f1-d9d7-403e-b667-5141d3f8c87d", "comment": "Malware payload (RedLineStealer)", "value": "121c438f39947b12a8a18efeb23a527006bbdbc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399569, "uuid": "62581349-8439-4e8b-94fe-10b00b211160", "comment": "Malware payload (RedLineStealer)", "value": "8e0d12ff99cb059ca3fc2a10eefc4be47f74ae7d6221ef465e9394f1d4a4f7b980f0531d789c2e0dcc657282f2824e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399569, "uuid": "e5eefedd-fe87-47f1-9b89-c8ba544411ec", "value": "T14FF4124BD6E89437D87107B01CF603C3163ABDA06EB9831B178E6C5919B31B5E135B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399569, "uuid": "e407ec0b-5d24-4bd7-a6fa-0084a8e8e8c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399569, "uuid": "5ee202bb-d8a4-494c-8810-1932c32edec9", "value": "12288:CMrVy90qnFyvD+2am3UYxqX2YxuZifBH8EUkjh14QLmvkYgWjSbMP:nyJnFyvDz3dnjifBH8Ebd18vFFjSbMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399569, "uuid": "07bc1f99-1646-4a8d-bfbb-d348de5b8028", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399569, "uuid": "a90c3fae-66f2-43bc-b217-75aaaf0dba10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399569, "uuid": "deceae51-8aff-4f0a-82ec-d51f9b1cc531", "value": "7643c87f5de47b918575ee321502ebfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b76c3f6d-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676364665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364665, "uuid": "5be225fe-4f34-48ae-9046-eba722d31afe", "comment": "Malware payload (NanoCore)", "value": "c6df030e68de3ba0627b95b2b1023c6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364665, "uuid": "91f161c3-93f8-4016-b19d-d682c9b2cada", "comment": "Malware payload (NanoCore)", "value": "76dcce84fccf4a3899529204aef1ca9aded6956fa1556129144cdf05d334beaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364665, "uuid": "c8f1d3a5-bc7d-4c4d-a3a9-cf7114cc8a17", "comment": "Malware payload (NanoCore)", "value": "bb3a1680c5a94b2c8403f09c147b2eba8ad8df0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364665, "uuid": "d83b5431-232d-48d6-907e-27c283d04fe4", "comment": "Malware payload (NanoCore)", "value": "f8ebc3a4723eccd5eea5c1e230f3953e39659c99748b9de10bb2ce137c26c93ec5c5b5f5800cd5d8a2d4a62edb01b3ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364665, "uuid": "72a1e4fd-4c60-4416-b290-399da5b7c3c4", "value": "T132D422C967954323C3F88FF544A41485233936BAAD62E66B1C4F12DA2E627018791FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364665, "uuid": "0fe70c1e-7997-4c00-b004-69efcf143e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364665, "uuid": "ce6313a2-5c30-4bee-b011-8323ebaf2125", "value": "12288:iFFZ69uhLphox27hUoK9wpgOL5S/nMWXW+3CUhUP1iolN77OQfbI:U69yLph2AUonyYcvnD3CUhcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364665, "uuid": "d64cd10e-9152-4e09-b561-a815246bc941", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364665, "uuid": "15d54336-2e38-463c-8ecd-ecad41263816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364665, "uuid": "157660ad-ac27-4231-b536-3280dfaf0fdb", "value": "c6df030e68de3ba0627b95b2b1023c6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28137646-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676402220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402220, "uuid": "4a74c2ea-6491-4576-9d81-31e9669aee3f", "comment": "Malware payload (GCleaner)", "value": "4370d61b5155b81cab0af28988b08821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402220, "uuid": "4323613d-81a9-4982-93b8-32575bb758ec", "comment": "Malware payload (GCleaner)", "value": "77007dd79a5fd928e9e95c567347edb1628eff6d3a2bfabfbed9d4216428e113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402220, "uuid": "870d4c0d-1729-4a1d-a65a-d7bfdf1bf309", "comment": "Malware payload (GCleaner)", "value": "7706055acc76073cef4c89022575352c78592c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402220, "uuid": "8a7a48c3-813f-4ac7-a240-258f8ef66959", "comment": "Malware payload (GCleaner)", "value": "ddd8c99ff3b84a0378b22c620b514a7e2ee761986fb5fa56d57e8706bf6c330e0a7757343c15e5fd016514db28883b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402220, "uuid": "e27fc5e8-8f5e-456b-a580-6e277e5eb2b3", "value": "T1B4E5127CB105C56DD280FEB88D2AD8E75CDA2DE3E9A4A06270DD7F3F16782885B19107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402220, "uuid": "c9b5ee91-e403-41d0-9b1c-54b8c5bab34d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402220, "uuid": "a0058e09-ff7f-4a19-8578-29ce733dd832", "value": "49152:rdHMd//2pHh+DleLKsamTCVXv45cPgzeh+iOAkDOuE7V8ExW4g6SNU2LCgv2MR:JH8n2fBK/dVf9PgzekFa/J8ExKN5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402220, "uuid": "3b502155-434c-422c-ace9-0fc5359a85f2", "value": 3198203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402220, "uuid": "a557aa6f-aa95-4689-9a69-49eca2b3ee0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402220, "uuid": "2308e2da-3e9c-401e-9217-792b39f44b7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320e2977-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382050, "uuid": "343697c9-7901-4af4-9319-25a1034fdb71", "comment": "Malware payload (RedLineStealer)", "value": "14318e179675b7f360f8b3432d62e5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382050, "uuid": "0d0b7409-91c9-45d2-a147-c492fbcb5e20", "comment": "Malware payload (RedLineStealer)", "value": "7710493faa0e5544b70e828b82e3cfafa5c32429566d6aa0132d2ec69d1c9728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382050, "uuid": "f7673729-1572-450c-8ef2-d59276d75417", "comment": "Malware payload (RedLineStealer)", "value": "acd39f5e70f942ed363ed0c9aa9e243f21b11cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382050, "uuid": "e042acf0-9b67-4fe4-96eb-314ab6acfd93", "comment": "Malware payload (RedLineStealer)", "value": "bf556255bebb935bf5f4491336c59859f7a62cc033e418bc88fe9a8b8eb01e4ab68ce4132468fe9d72621e943d0fe79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382050, "uuid": "9ccb609a-2e6d-4884-9201-034f092594dc", "value": "T1D2F4124BB7EC9432D5A0577058FA03D31B367EB06B749797278F681A0C72660A63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382050, "uuid": "195d61c9-64fa-4122-a25a-a153583bd237", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382050, "uuid": "7bade03b-fddc-42e0-a802-2068d66b29e0", "value": "12288:LMrKy90jN9FHqSM5FoVr7T9I/FZ4iktuo+40CtLC2Enr+Ck:Vyy9FHqSWFoh7T95iK3xdtL8r+Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382050, "uuid": "77799e6f-5f20-4918-8a2d-6fb07e49d9aa", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382050, "uuid": "ab7c0112-dc54-4445-ba2f-41b0905d18e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382050, "uuid": "e420071b-b6fb-4c41-a73b-67f94a8dea08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd41cfb8-ac1c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676347602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347602, "uuid": "8c96ab0e-4115-4e81-9919-141a47f6ea6c", "comment": "Malware payload (RedLineStealer)", "value": "80a407430f3b7268bd3c6f344da3666e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347602, "uuid": "6af5d192-1c88-44a3-9a4a-5a3ae15fe73c", "comment": "Malware payload (RedLineStealer)", "value": "771f709d683b6df1d3911eaa04fca5e0980bdbfed29a50e468b72ac755fe33d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347602, "uuid": "dadbb833-df4d-4fb3-a91b-b53e08083533", "comment": "Malware payload (RedLineStealer)", "value": "b0b77cb79dff841d2ad411c9db1c1dce8ca464c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347602, "uuid": "a7867295-e787-4b00-82e2-0d5b120785d1", "comment": "Malware payload (RedLineStealer)", "value": "aec4c5c3d4ad72eb62b5b9d2f46733aabb600a668cba4c357665b27a828b79ccbd8084c4ff59714ff6b5c174d5fad036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347602, "uuid": "2fff2832-8c3b-4008-aba9-336fd390b32a", "value": "T1BBF41293ABEC4126D8B06B3006F642D31A37BD602F388792734FA9A51C735A4F576367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347602, "uuid": "d7abb66f-4dbd-46b7-a625-bcd695074ed0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347602, "uuid": "80cc67a4-9384-4d65-be9c-35520bf4a34c", "value": "12288:YMrky90Cft+me5plXp/iUPwrxjFc4X/ZZCcazCRtAuk8gy23ojDwG:8yxft+m8fXXITXDCcaWXY8gt4jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676347602, "uuid": "b7a48576-92f7-4b5b-82cb-1a65b4e5b05a", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676347602, "uuid": "a4da1be3-b797-4954-a51e-ce818126b1f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347602, "uuid": "78b88eb1-9e63-4758-931f-89386a6aeb5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5945b5c7-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382116, "uuid": "a0a3f055-043e-483e-8479-08be611b91bc", "comment": "Malware payload (RedLineStealer)", "value": "3b22d8311d049fc5b864912304b58913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382116, "uuid": "57c91072-6247-427a-a938-c7138f81bcb5", "comment": "Malware payload (RedLineStealer)", "value": "77334886d0bc82912e82d79d2dd490aca90df7f91a656eaf72350dce5f085b3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382116, "uuid": "87f784e6-ffba-4e4d-8abd-4d2d63d23ed1", "comment": "Malware payload (RedLineStealer)", "value": "cc6d22f9ba16e205f597391c4c0ab8502f9eb47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382116, "uuid": "5a6aa725-e13e-4042-9050-4ea5927ddcc2", "comment": "Malware payload (RedLineStealer)", "value": "f94d90bec286b90ca1b8ce8492aa2ba684ea69e1dfac1547dcf76a521b7bde766a47cc946950f4441480bd9c8f08ab4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382116, "uuid": "c4de4a32-bdab-4e37-80ab-37571ab5f942", "value": "T174F41203E3EC4126E4B557B109F613C30A73BEA05B38879B534BAC6A1C71AB47635B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382116, "uuid": "1fa6bd4a-48e5-40c5-8467-970c9b01c270", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382116, "uuid": "f5435904-d96c-4f1e-817e-57cf687f1732", "value": "12288:TMr/y90slyfewJrt0Kv5n7YsmLW1mVGMD5i1h546taj8AE7g+Mce:syjEDrt9mlDA1hO6FAR+Mce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382116, "uuid": "1eb750b2-f6a9-49b6-89fe-9334679b0167", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382116, "uuid": "3c92bbb4-1356-42a8-84e3-39085fbcdd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382116, "uuid": "955d803d-7aaa-4055-bccd-18e3b8861428", "value": "3b22d8311d049fc5b864912304b58913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf667ee5-ac14-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676344089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344089, "uuid": "8ede4478-deb7-4850-b452-cfa6739a4427", "comment": "Malware payload", "value": "3ea02e65fe5a3be93b028b76c2e3c3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344089, "uuid": "b6f437f7-ff3a-4229-a468-88833496431e", "comment": "Malware payload", "value": "77555fc73bde72d601c995f884b564d9f12e3577221ffece363c0f8786745dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344089, "uuid": "b3bf909f-9c0d-4329-8831-28e36a6922d8", "comment": "Malware payload", "value": "e9add8a9fb80148850891ef6ee9d9fdc9ce68ff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344089, "uuid": "c885e877-8cfe-4e42-b27b-5b8cd5523785", "comment": "Malware payload", "value": "4c814ae0e5446495b2f9aac12f7d20b74dd46855fdd5a12fa97b83c08b9905b74026e68031df56fcfb9c1380a8af4427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344089, "uuid": "e91a8e40-4329-478b-b626-77a04c86b04b", "value": "T1FA1733E5276849E7C8D9253F8C4FC83C10A9ED111768D9CFC1A8731A6E736859A3BF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344089, "uuid": "e0d1d930-7cf5-4b1a-b0e2-41e9ade4e910", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344089, "uuid": "116dd25f-88cd-4d6b-a811-379cb42e7a1d", "value": "393216:yxAlndYXAnAu0ptGT6K4/m3pFFqyoBgsSqCoEXO4wYSiWY:zldYXAnA9ptGWK4Ky1KjX1lxWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676344089, "uuid": "bbf8af84-2343-4a2c-90d7-60edf9f537a0", "value": 20239788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676344089, "uuid": "7a477725-d31c-4642-b571-0bdb333564e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344089, "uuid": "cdf51d5b-72d6-4db9-90ce-19276c7fccb3", "value": "hookkee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39baaac-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676392978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392978, "uuid": "8b874abf-98cc-459a-81ef-3dd8073a5b40", "comment": "Malware payload (RemcosRAT)", "value": "1c5cb4dd84f8741db473c5913abc7ab8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392978, "uuid": "24cae007-501b-4659-bd72-15a4f4b1262e", "comment": "Malware payload (RemcosRAT)", "value": "77c701efea15f393c9fb5d3c5b2e39a505c7ba856c2264f9ee5f684288dc2c88", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392978, "uuid": "aa0ee62f-7e40-40c4-9159-c1fc4e4cd572", "comment": "Malware payload (RemcosRAT)", "value": "87576690b7ff879759cd781b78ed7c1fd7368b76", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392978, "uuid": "b6dbff50-f088-49cc-937b-d5794bc6ae25", "comment": "Malware payload (RemcosRAT)", "value": "ee0adb630e7ef87b447bfce7243d4065073a695aeb02e767ba9b0ddbf3f6dd909340c60aa383037bb1fd73f70dc53e1d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392978, "uuid": "16adebfb-9f03-4c3e-8e5e-1fd041dd1f4b", "value": "T13A65123BE065FDB9D416033851E7C5220047AC216AAEC50EBC5DF2AD27B37907AE679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392978, "uuid": "7f8673c6-8bc3-4db4-adf1-8c0cb8562359", "value": "24576:WYV2r0V2Tt6XZx11TYr2HLwg2Tt6XZxGjmtk4k1Xm:5Eg2Tt6ZhOAh2Tt6ZGmtkb1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392978, "uuid": "e97a94d7-d7fa-4422-bbef-75195111747d", "value": 1501696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392978, "uuid": "8a46b1fc-6e96-4938-87d2-02960e9ccab8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392978, "uuid": "fc3fe969-911a-4070-b235-a3e69889de6e", "value": "Doc_3343.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2099c8dc-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392329, "uuid": "52437bda-758c-4e7b-b243-fbe8f9285690", "comment": "Malware payload (SnakeKeylogger)", "value": "116c7a3e89736b25937a01988de948c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392329, "uuid": "fa7a4714-3e64-4fd3-8565-0c8857faa537", "comment": "Malware payload (SnakeKeylogger)", "value": "77eba5c8f9099d4c9f2cbd300fb6d24e43c05e951860a88f17c4ffc97736453b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392329, "uuid": "c17d05a2-6b82-4e9b-be75-a9d88e59390c", "comment": "Malware payload (SnakeKeylogger)", "value": "fa771c5ab84d157b2c01c1706bafefc6fec5cebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392329, "uuid": "65b1d919-2e0b-4d76-b9e3-387b7f804abf", "comment": "Malware payload (SnakeKeylogger)", "value": "4f6e6f4391e63557cbc580d532c8f36f86bc76760b646464cb9d33c260ddac0e059f9689eaf93442d3205631ffcd44c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392329, "uuid": "ac4fe33a-054b-42c5-b61f-b601ea336831", "value": "T1ECC45B8DC5BD4212EAFD0F7DB19F29080DA0044A266D4D7B97E7F880E57322AB07E65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392329, "uuid": "43478ad9-aaa7-4598-aed0-eed411a2013e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392329, "uuid": "db623237-f08a-4dac-b67f-9157d093a94c", "value": "12288:JFPecestOlVGKjHwQqOx/f9vpTh2e25oFgxYKQ:+cestKEKUnOx/f9vNP2Zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392329, "uuid": "8c40a78f-eb9f-4d71-b641-ab9039c4d0ae", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392329, "uuid": "5004c643-264c-4714-a4d2-0ad33126f508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392329, "uuid": "1c6ea975-7adf-4260-886a-d33016bf4dd3", "value": "mjHBNjvbfGCqfyg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50296b3f-aca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676405723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405723, "uuid": "eeaae22e-1cf2-407e-ae20-a67caef7ac1c", "comment": "Malware payload (Amadey)", "value": "c127a3f0de459b3ccbd61ef876b46fb3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405723, "uuid": "bba1cd0b-2fd9-45d7-9190-5bb1b5636fed", "comment": "Malware payload (Amadey)", "value": "77f71115a955ef784975940e36d686812d3af7c99e1366c52baf8a0ac69b9adf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405723, "uuid": "0ae316c6-f42f-4cc3-9053-9197c73c49d0", "comment": "Malware payload (Amadey)", "value": "c75cc7978ef33fc639ce7e5d6e02c496b7ce886a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405723, "uuid": "30704430-1db9-409e-a95a-1164a4b68018", "comment": "Malware payload (Amadey)", "value": "99165e3d6dcb0557fc6b914ae54b123a221a767bb87db8b183eac72d567a8b0e4286f984de0ded2b86f862e62967e757", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405723, "uuid": "e8fb8997-1f9f-403e-8d04-72e4c9589829", "value": "T165F41207FAF98127E5B04BB028F647C31A367DA19A38439F274E9C691873AB47131776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405723, "uuid": "f9af8f26-03df-4bf8-a377-e56218db51cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405723, "uuid": "aeb11da3-1e99-4d3e-b80a-c602b24f6ddb", "value": "12288:YMrFy90LwM5dinuqPjbPLl3gaeGzmOhLQFa49NSx9rUnG0O2lXo7+GI:NyMwM5dinug/Z3g+mORK90AGcXo7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405723, "uuid": "c9b94359-8644-46ba-b17f-326418ebf018", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405723, "uuid": "b26e4106-177a-4d8e-87bb-b0dc793f1646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405723, "uuid": "eb2547eb-1853-45be-988f-f31b18e6df57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1dbe0a-ac40-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676362846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362846, "uuid": "ac8a1207-574a-435d-bcc3-cbd2f1d79758", "comment": "Malware payload (RedLineStealer)", "value": "344960bda8ef237f4ec8d7e8b7fb0480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362846, "uuid": "4e1315dc-be90-46d4-bdba-e4b29366498b", "comment": "Malware payload (RedLineStealer)", "value": "7811187453075a1d6d9a2f56d988c132cf2f723c3fa7fa2eae9eec4a8f0a4782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362846, "uuid": "350a0fa2-4986-47f5-b530-9fee017c6c35", "comment": "Malware payload (RedLineStealer)", "value": "13b8340457d2eef55f44ee1f9e1cfe26ce217f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362846, "uuid": "74f19919-2f37-48aa-ab4a-217eb51b55f4", "comment": "Malware payload (RedLineStealer)", "value": "e60bb2d62470a7d261a2264c2b0218cb90e7319d1823c7da6a7f4b0bf1e840c240cb4456104e310d3cb37a9a3bd3a325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362846, "uuid": "0cfedcca-41df-4a55-98fc-a60b81d62f08", "value": "T13EF41203F7E84022F8B497705DF607C30936BD615A35C397274FAC5A68722A4AA787B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362846, "uuid": "7612e385-feb2-4e1c-a7ea-9174e03805db", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362846, "uuid": "3b49af4c-a70d-43d6-af18-e2ac07968c61", "value": "12288:KMr8y908lbh2jtj2cQ48xTQI/lgtZ0vDWRJ6yGhTNzm/tAu+agxj8rfU:ayDh2j538JQWlgtZ0vDWr6yGhTNilyag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676362846, "uuid": "55abadbd-2a7c-4a4d-826f-6ba584dfdd67", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676362846, "uuid": "d3f28cc8-2034-4e6b-8e29-6efb1d1fa209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362846, "uuid": "a92ee0dc-63e2-4748-88b1-b1733a8d446d", "value": "344960bda8ef237f4ec8d7e8b7fb0480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbfeac6-ac7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676388751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388751, "uuid": "929b719a-7983-4358-8369-983d0a2eaadd", "comment": "Malware payload (GCleaner)", "value": "25e89277045569984f3a8f2fbc35909e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388751, "uuid": "f958eb7d-c162-44ce-818b-bc79a2fa2935", "comment": "Malware payload (GCleaner)", "value": "7843e05994244ed87c87b042b20bbde7bd76662b8c527537b71d685a9308751d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388751, "uuid": "14d567af-90c6-484b-a927-13c0c563960f", "comment": "Malware payload (GCleaner)", "value": "a81bf3af112e3217b8390effbc813e0b6f3c1c1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388751, "uuid": "477acc18-c303-4a9f-b8a5-0beaae360bbb", "comment": "Malware payload (GCleaner)", "value": "dde7ab9dabf6573229164f2e12dfc23a3a320e1d6be0b24c9a1b809236550f4ba119f620a7380fff0d5f1c1739adcb06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388751, "uuid": "700611f5-ff84-4633-84c6-10924043790f", "value": "T1D2E5127D7206D46DC6C0BDB4883A88E75CD66DE7EAE4A02270CD7F3F517E1898A09247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388751, "uuid": "c1909cbf-5fd8-459b-ac51-8ff542458979", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388751, "uuid": "46285f3d-2d3b-4a92-a818-ce4bddd42de4", "value": "98304:JHqduwgnhpJSL85mhsmx6gWX1YC8gjv2MR:dqgwehXH5mBx6gWFYC8ovjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676388751, "uuid": "66d770c8-7871-46aa-9538-8a75f4779669", "value": 3193433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676388751, "uuid": "63d770b3-c62a-45f9-9e70-38a40a9ee490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388751, "uuid": "4ede7138-b99c-4879-827b-a991f00c5a19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567dd680-ac3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676360207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360207, "uuid": "e03130f1-dd1d-4497-9576-aa98a51ada91", "comment": "Malware payload (RedLineStealer)", "value": "1b790ebaa57eb79b7f2d19e2300f230a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360207, "uuid": "f80d0d90-acd5-4c18-9348-0828842d6168", "comment": "Malware payload (RedLineStealer)", "value": "784aff78ac52eeefbb326f9d1ae396c59ad65a1c53daec9ba4d033aa59d9acd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360207, "uuid": "24aeb427-2514-44ed-97dd-0c29943d9f36", "comment": "Malware payload (RedLineStealer)", "value": "bb6bc1871ccadad3c04169d285b70f3cc8418ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360207, "uuid": "b23a3155-ec76-4180-b6ab-6b41ca62862e", "comment": "Malware payload (RedLineStealer)", "value": "cfa9e3d98f7613cd362d7ae2e650c8226bcfb60a4e7fc4b29077dedcc499476f0199c611b82e2b6a2117d7d12116ad8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360207, "uuid": "2f82e0b7-7f1f-4cb0-adb3-d957722573d2", "value": "T14FF41247F7FD9022E5B6973118F603C31A36BD906A3493A7134EE81918B3A64E23576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360207, "uuid": "3df2016b-58b6-4fd1-9d54-9b511e7d0aef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360207, "uuid": "a675024d-5ce7-4084-ba6b-232f6016d241", "value": "12288:MMrQy90jySfTRvfKH4hiROtUqP59pFFJ4ZK9iHtbzWjlGYLXuL:cyaySfThKH4hFiq8ZxMTLXuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360207, "uuid": "37647812-aed6-440b-9729-c81325b51a30", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360207, "uuid": "f643f79d-9645-40fe-9c8d-626bf5663520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360207, "uuid": "76bdacfe-6c6a-4b71-8858-b13779133f08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6a028e-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676406546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406546, "uuid": "aa6a3050-3a66-4aad-8cbc-b1aa30adf351", "comment": "Malware payload (RecordBreaker)", "value": "a0bf854d3adde4328160436162758347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406546, "uuid": "7bf3c1d4-90c2-4e41-beb1-2e3633003d79", "comment": "Malware payload (RecordBreaker)", "value": "786459d98380a766876fcf35996ccb829f909a2809a8b4bc62df294fd7231f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406546, "uuid": "800ea2a7-3ab7-4527-8a20-9acc8088f70f", "comment": "Malware payload (RecordBreaker)", "value": "72be15c429b4a3e4441e0c1b10394b7549974a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406546, "uuid": "476411f7-33f8-4292-9cc4-283e3d2b8781", "comment": "Malware payload (RecordBreaker)", "value": "e2ee04064985e9dd4c147823071ec299c5c2e312925138a1d9ec6c2924e8da2829c62f7552b0ca4aea58c94d70c1bb32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406546, "uuid": "3c3c4af9-ff1c-45a5-8fdb-64465a4341ae", "value": "T1CA14D0627AE0D079D48B84759531DA6069AEBCB15362805B238B0BBF6F303D257FE353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406546, "uuid": "56ab6a7d-acbc-4b71-a96d-4c54d8c91d8f", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406546, "uuid": "7bd69937-b0f1-4f61-bd17-71210a2c2089", "value": "3072:4OONJO0LstBU5FguWlBWPQsHiDCgR8QIXNVxIjb9bj2s/bz0:oLCBorWlIsGgjSxKb9n2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406546, "uuid": "8797d94e-3cf0-4054-ad2e-ab4be868d3db", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406546, "uuid": "f3379955-3af1-49c8-9d59-c399d0209fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406546, "uuid": "321615e8-839e-4b76-8eb1-e6538f459874", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5967e285-ac72-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676384264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384264, "uuid": "9e69a8d4-8bca-42c7-8d3c-9625c5af85f7", "comment": "Malware payload (AgentTesla)", "value": "303efa74e4e9cf4a07a685d45b62b2a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384264, "uuid": "1f17179b-f71b-40f9-aa71-47b5296e073b", "comment": "Malware payload (AgentTesla)", "value": "7878c151e7275b02792479eb673f4406f15aca3242e4b525ddecda93c06ea312", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384264, "uuid": "0f91aac8-b151-4d7b-be3c-2d21eaff90e0", "comment": "Malware payload (AgentTesla)", "value": "43b21136f103e62f2af9745d3ffaec9883a52b66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676384264, "uuid": "a011b276-47f2-4ee4-bce3-20af0c3d6865", "comment": "Malware payload (AgentTesla)", "value": "321cf5b39467c27a4dc2e5f3fd9d6c086758c125aa2b8be672f32be3a119619d5d7147d2ef09ae4444a7be55f854b951", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384264, "uuid": "151e2981-3102-4efc-b3c2-583401245ede", "value": "T1CCC41225310D52F7CAAE48FA18A3164713B4B736A111F9CF3C8E69E159D3F815AA07E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384264, "uuid": "336591a9-0099-4790-89d6-35cad9d36cb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384264, "uuid": "c684053f-2475-49c4-9213-9dc342b87b7e", "value": "12288:raFFZ6wajEsd1U+WvDeToTopNGpR6bxRXO/5TiTm4HoFzLj:g61jEsvSYoT8w6bx1O/BiTjozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676384264, "uuid": "3afbdda3-5e24-4059-90fa-596361763cb8", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676384264, "uuid": "8b00a1a0-1db3-4bc2-b69b-874655bcac56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676384264, "uuid": "42f626af-a71e-45e2-bff8-fe0539490f8f", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797e75d3-ac9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676403216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403216, "uuid": "9e95cb22-bd99-4202-8769-9f7b875e86fe", "comment": "Malware payload (njrat)", "value": "267f11aeaa62420506bf00912608fd80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403216, "uuid": "efa94abd-7706-4aed-89a6-9f1e872e3850", "comment": "Malware payload (njrat)", "value": "792ad1aa7d042b3a51290003dd51befe14499c85103f02d75cb4a022e1713160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403216, "uuid": "9e11f189-5efa-4d68-8565-7f87f7146732", "comment": "Malware payload (njrat)", "value": "a2c07492f065dce7f90665284ded763f6ab838e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403216, "uuid": "1e25e4b3-081d-4b35-8435-9a7ea09de12f", "comment": "Malware payload (njrat)", "value": "344019a3a129e3c23d485b5705cc21e0efc969c00a443ada196fe6722873b5300e82266a791fc69485a40221d1122d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403216, "uuid": "2ba871ab-b0bd-4174-9785-b60c0be47607", "value": "T17C93E74977E56524E0BF56F39871F2004E34B5871602E79E48F219AA1B33AC48F85FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403216, "uuid": "7b25c251-60f5-4d9f-baec-b9e2a5d3dc14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403216, "uuid": "e7718c04-895f-4e55-ab96-4565974a2557", "value": "1536:S5Kw0i6FHfpmcYM1t/2jEwzGi1dDDDPgS:S5oFHfpzYMj//i1dTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403216, "uuid": "e3a4a6b5-6b02-440d-9469-3e2e9b6ba883", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403216, "uuid": "e031ebdd-195b-484a-abbf-eab60eda4f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403216, "uuid": "e1d32786-ad67-4505-b5af-9dc3bf4aadbd", "value": "267f11aeaa62420506bf00912608fd80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a96420-ac25-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676351374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351374, "uuid": "ca1fa6fa-022a-4244-9499-9d3297ddbfe7", "comment": "Malware payload (Amadey)", "value": "88618b64f1298a053707bd7bef17a789", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351374, "uuid": "3fab735b-1fda-49a2-9efd-50fe00f1fc10", "comment": "Malware payload (Amadey)", "value": "793fedfa81e4b2910fdb82790056b2136f3642a4c24facace4b30b927fac738d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351374, "uuid": "1ffb2512-3c75-4618-9634-afda8c7ac318", "comment": "Malware payload (Amadey)", "value": "a5eadec8df7d84a5a1d4424d0221fda41fc17b36", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676351374, "uuid": "69c5ef91-a61f-4bc5-976e-7a822c39d04d", "comment": "Malware payload (Amadey)", "value": "8129cf5cb054dde66ace501751f9e4a90f7e7dd7a1efede5328cadb3add3f30a86c96d32c39126f672f35a7e61bf991f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351374, "uuid": "0c32a932-a058-4dc1-a768-c9444b61a88a", "value": "T12AF41207A6EC9072DCF5977458F203C30D367E602B39879B678E98691C73A64B23476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351374, "uuid": "4be2e067-1d70-41c5-9275-3bd1915db2d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351374, "uuid": "d4601ae3-9d6c-474d-b706-036b455d62e2", "value": "12288:MMrDy90sDVLjTZ7g8lCLBnIfOuek2iy+kFm4ihY6wXl7FRPgcu+raFOO:3yTDV/TZs4CFIfOuekdyLihjw17F+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676351374, "uuid": "8445b929-7bf5-4893-b3fd-5a4e7905b67b", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676351374, "uuid": "8f3aa4c8-8e05-49c8-bfee-20f05421e6c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676351374, "uuid": "7fd654d9-1b41-4cd1-b9f2-0d70d24d9a32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483aed5e-ac62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676377363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377363, "uuid": "0bacf17e-03f1-4059-bfea-ab17dae20651", "comment": "Malware payload (RedLineStealer)", "value": "35f02ef54f648d6ba89f6fc5ad3360c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377363, "uuid": "e6fb4e60-f37a-49c7-8094-d4ad352ef857", "comment": "Malware payload (RedLineStealer)", "value": "794e9d3b0cd0b4c594e0fdc955b76d3ed2ced25670f35a50b6848b2739425a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377363, "uuid": "96e7a742-41fe-4477-9a49-dac16bf21ea1", "comment": "Malware payload (RedLineStealer)", "value": "a82f063c961e633bade276b0665052bfbd987281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377363, "uuid": "57bac62c-cb05-453a-9ebf-e43247e25299", "comment": "Malware payload (RedLineStealer)", "value": "bb7abf04fe97b84e12fefce2f8f86cf7d0511d1ac0a4580d22173e8d14cc7e6aee95833d374237373af8bfbf636e300f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377363, "uuid": "af9ec93a-c499-4f15-91a7-4aabe53da066", "value": "T1E1057D40BA89DFA5E50601708826D1F21E15AC7ED651A20F39D8BF3FFAB3749104DDAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377363, "uuid": "35d9e984-e375-4920-aaa7-e73eb6b1de53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377363, "uuid": "ed493002-5baa-4d90-912b-fa6cd674020a", "value": "12288:WT0h2DW3KCxIFyd7qMU+NtLANbURpKVuC3SdgpRBuuWB:WT0h2VCxIQdmJ+bL2w+qYBVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377363, "uuid": "aa9092a9-7c9e-4497-9db9-475b96c8f125", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377363, "uuid": "f7484827-5670-4f07-aa4b-82088d5932ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377363, "uuid": "42c31483-0833-44cd-a46f-1eec232e6bd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c345d8b-ac40-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676362848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362848, "uuid": "8a872860-c47d-4afc-ba4b-316eba559d29", "comment": "Malware payload (RedLineStealer)", "value": "2f5b229ead74a153d4ac59edd25288b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362848, "uuid": "75a2103b-ba2e-4e17-807a-0f3601773559", "comment": "Malware payload (RedLineStealer)", "value": "79b7017ae1c67b5cfd2bcceb4f6ebaac440d7ae460dd4a72f36b2d56c742ca4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362848, "uuid": "5a4cd1cb-b58e-4d11-872a-69656bc224ba", "comment": "Malware payload (RedLineStealer)", "value": "2ceabafae72dc608760bfa2ca041968fcb3bdbb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362848, "uuid": "d3b23fae-acee-4181-a394-cab9e3297e64", "comment": "Malware payload (RedLineStealer)", "value": "e7880fd0ce2754396aa12dc78ad2d0cfa57fdd0b68a3bf1bc49cc61cda381c60ba7c9ab514c61747187f945903b4b5c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362848, "uuid": "f5e113a3-b2b9-49cd-b8d6-c0fc83f3aea5", "value": "T107A4020BBAE98035F8B557714DF303D71A327E505A3483AB328A9D891C726B5B93137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362848, "uuid": "bbb12962-311c-4597-9f4d-3104ecdbed1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362848, "uuid": "19cb76cd-d022-46d3-8761-e8a34b420927", "value": "12288:zMr1y90cSOwt9GVmsT24GWUdEfrb8L9+:GyEOy8VzgpIP09+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676362848, "uuid": "f655be6c-12e3-4eb1-b4f4-c813a047f0ab", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676362848, "uuid": "ffc5c9d0-099a-4fd7-97fd-e9950d6da2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362848, "uuid": "799157bf-5f47-42b6-9efe-936be3e11cea", "value": "2f5b229ead74a153d4ac59edd25288b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d429f7b5-abfa-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676332930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332930, "uuid": "b5aec45f-1c88-4dee-9847-43d77de2fa1a", "comment": "Malware payload (TeamBot)", "value": "03495aba668cfd6258d369a23af18a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332930, "uuid": "0d7d15ba-2862-450c-9add-119e59b38282", "comment": "Malware payload (TeamBot)", "value": "79dc30536a2ad92e5759157b70469d4660dcb8299d7d4851af0bf2bfdbbb2c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332930, "uuid": "93a820fa-204f-436c-934f-7bbb98973128", "comment": "Malware payload (TeamBot)", "value": "c03c37c78548e8078fd53705b49a170b5caab028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332930, "uuid": "c8530223-b0e5-46e1-8ec5-d48672a7c91b", "comment": "Malware payload (TeamBot)", "value": "7739182a434db3a942b8246977d52a8d6f3c2b96a89fe42d2cc05e7ae3a1a77e1d14a4ef516c6c473c3cce6b8a28f4c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332930, "uuid": "9fca9a5c-a015-48b4-a768-5dba684a618a", "value": "T1E714CF12B391E471E4674A318D25C1F4A67EF8211B799ACB33986B3F0DF22D0CA76791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332930, "uuid": "94ad2125-1bf2-4460-b0e8-bae94e2c2396", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332930, "uuid": "03830e22-cb29-4543-8163-245a8e18d092", "value": "3072:CJ4uFa5zvmCUx9MOY7sijH5wop8yrfxAtSQ6G+aWT8jBUlI:CdovZyyR7siLgyrpAtoG+7xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676332930, "uuid": "4582e448-af7d-40de-947f-1460f4edd6c0", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676332930, "uuid": "7ced8784-dacb-4109-a92a-f02307fdb4fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332930, "uuid": "3aa276b8-5f0e-4972-a69f-f5d5a0fb2625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fc95a2-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676363245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363245, "uuid": "ff7e8d46-0b53-4e9d-bf97-ec3f17594064", "comment": "Malware payload", "value": "c76c1ac2b67bd9478c278f4a49113ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363245, "uuid": "6cb41382-76df-44a5-8d5c-21268f911ed8", "comment": "Malware payload", "value": "79f7b1bc276064e45067c554a2df232e702b366e08d8551aa1548f17b56959cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363245, "uuid": "27e37704-18ee-4842-9c43-183689e7c383", "comment": "Malware payload", "value": "0c7a1c7eca86f9c101d88c8df458c6ac6acdb1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363245, "uuid": "f12c5ee1-43ea-4e3b-b339-187fa2b494bf", "comment": "Malware payload", "value": "996e0662aeb49920bed20785be7632247b2d628c6c7784d94c203b6f030d366f7b4727bfe968f84af1f1765446216b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363245, "uuid": "0477e4e3-af87-4f54-ba4a-4fd4140bc41a", "value": "T1A275AE343EEA9019F1B3EFB55BE4B5DADA2FB7633B07941D1091034A4723A81DE8153A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363245, "uuid": "9d6bebd5-b2f9-4ba8-8842-51d61487026e", "value": "12288:SmvHpRY1nZzJ6J5oPhYIcybkhsq+kVOIT6Hn/zLBSVa21Bj8stwOfL/EH/vdfVE8:S+xeSA3BjVMcfX9gGw9cX/QKsjqjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363245, "uuid": "06b539ca-3eba-4fcb-aaec-6e6d6f8eefa0", "value": 1626624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363245, "uuid": "6395a907-ff53-4aea-83f8-dbad44d4ebbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363245, "uuid": "21b265c9-a692-4381-8ca8-bc3a305d2c50", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b60c4f-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391796, "uuid": "8df9f0a7-f32f-4ae4-812b-e2e482ff98ab", "comment": "Malware payload (RedLineStealer)", "value": "fa55493a10f7e5b22d631b02a8d6f032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391796, "uuid": "03b55e40-c63b-400b-824b-04615bacdef6", "comment": "Malware payload (RedLineStealer)", "value": "7ae0505356fa2b6b7053a5a65383ae8f63a4a3f952617c4dec0069e70a14384c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391796, "uuid": "55485e76-e388-466d-9fc7-d90b0985c4e9", "comment": "Malware payload (RedLineStealer)", "value": "8e68250218529f0dee5297bd4f7ee13083c8cc73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391796, "uuid": "f82dde5e-9403-44bb-a432-4479276b4f98", "comment": "Malware payload (RedLineStealer)", "value": "4b47110665f51dbeb0bfc2f63b79a8ae9c24b3c4f8ad189e56474fc719df41b7f3ee935bd77b44e45324f6777cae342a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391796, "uuid": "c98f1b60-b388-4c4c-bc05-eb8acbe932f7", "value": "T109F4121BEBFC9032DAB917B025F543D31A367EB05A38839B534B9C590C739A4A275327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391796, "uuid": "c43e6364-0fc6-45e5-83fd-4ab108005f72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391796, "uuid": "4ba02672-1604-4739-b94e-b1ac82f3ee50", "value": "12288:1Mr1y90wmfVTDlWnnH3XjjOkRVJ6rPFY44wGKDKNOiWoMvUnanKvYO:0yWfV9yjLR2rZ4XsKNOiWospn0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391796, "uuid": "ae2f14b3-57a8-461c-bd0d-adbeee2d3a00", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391796, "uuid": "2f01729f-10bb-4bd7-84e9-34b33af26842", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391796, "uuid": "f3d7c78a-e769-4fa1-b149-c31ed8836ebe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e166c677-aca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676404678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404678, "uuid": "170fd4c0-ec06-4215-af80-07616e96a867", "comment": "Malware payload (RedLineStealer)", "value": "8b7fba0d49bc778e51db2b65dad33807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404678, "uuid": "ac3e0ab6-7ceb-4090-bf87-97c28b800bb3", "comment": "Malware payload (RedLineStealer)", "value": "7b12c149e0d943fbc0257a3dfc1886c41dde6501c51512bace9deef83fdd309c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404678, "uuid": "659c6cd0-d267-4c34-84b1-acbc689eada2", "comment": "Malware payload (RedLineStealer)", "value": "237fcb229347c804d3c35014abb84fe6b1e64d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404678, "uuid": "40d00e93-f709-4592-9bbc-7325cd348f39", "comment": "Malware payload (RedLineStealer)", "value": "53154f9f5b604e9f09657fd2739680bbcd45e41e2021ea4c7f24761e0cb5e71cc6189c14b0a5975758aaa4c5fe94313c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404678, "uuid": "50070d3d-f463-45a0-b795-c39627405dc0", "value": "T1E4F41217F7EC8526E1E15BB058FB02C31A357D519A3582A6374E68AD0C327B0E9317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404678, "uuid": "7e23667b-e791-418a-bd32-edb5e6f72538", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404678, "uuid": "6b553260-f711-4b8e-a5aa-cf1b208ff12e", "value": "12288:DMrdy90d5IuRZvE4n/X2FLwixh/2K65CRVTolXoZCPo7QxcGA5IBQTmu8yM0:aymJZ84mFcTKhKXoZCO+IIBQa0M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404678, "uuid": "aef48756-59cd-41ee-b321-b344087d29d2", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404678, "uuid": "064dda39-1b3f-4abf-be33-03daafa52466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404678, "uuid": "79452707-b4d7-48f3-a9b7-114392b48817", "value": "8b7fba0d49bc778e51db2b65dad33807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b7f272-ac42-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676363612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363612, "uuid": "bd0a1b98-a8e1-485a-a3af-4d39d847909f", "comment": "Malware payload (GCleaner)", "value": "175d727fc3ce7de45a5852af548c0887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363612, "uuid": "5c37764c-771c-438d-9040-372633be60d5", "comment": "Malware payload (GCleaner)", "value": "7b605e9234da1839af73fa2aeb8e1dd11eb6ea48d4d0b6ca9ee1d49809a9a24e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363612, "uuid": "1d517583-7883-4259-9f34-3908c98bbd3a", "comment": "Malware payload (GCleaner)", "value": "f3e1f5c82b6b269c5dab505337c9412736d2d26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363612, "uuid": "79dc4a04-aed4-4827-98e7-1e4fc0c02c4e", "comment": "Malware payload (GCleaner)", "value": "5b799176c97d2b6b85d3af0c307b4fc8a64dd543bfc9c91c6c6a5d32b2587e83b19182f5d272c117e5b878d83635f1f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363612, "uuid": "4f68a278-330f-4181-af50-da4f766f8411", "value": "T150F512BC7105C9ADC280BEB4CC3A98E76CCB6EE3E8E8945270C97F3F56B91855609117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363612, "uuid": "a19b1c0c-7ad9-4688-b632-ce85968b29af", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363612, "uuid": "6b395366-3d03-4fb7-9b3b-b2fcbed26c35", "value": "49152:rdH3dHe8egsfvCtNiq/26vgajgBnAp0eKym9SsKvXRBax3TJL0kzM9LCgv2MR:JH3d+8eLSCnESGZyzIux3MBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363612, "uuid": "0391b3e8-404f-442d-9e40-d7a610b7306d", "value": 3359181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363612, "uuid": "ff190729-4c88-4ffb-b50a-f79acc0b495c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363612, "uuid": "a9491340-2a49-4896-99b0-4d0d8b2a02e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82824ac5-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369301, "uuid": "d1b778c8-d119-4d8f-96eb-d6acc863d31d", "comment": "Malware payload (SnakeKeylogger)", "value": "8f5977a5cf8b2232d2c1d032928c964a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369301, "uuid": "f8cde4b5-9522-4a11-9d83-5ad53539417a", "comment": "Malware payload (SnakeKeylogger)", "value": "7b71dd79f9b04b7696c34eff69d3708cba187bc4b0700a18ad0ce0d1f38d4f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369301, "uuid": "8cd0eb89-3354-4b87-91bf-fc2d38ab4bf3", "comment": "Malware payload (SnakeKeylogger)", "value": "4d922a79278cbc0f0edd536380f3b4402430fbfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369301, "uuid": "41d5005f-13dd-40e9-a629-a5fad0b53c09", "comment": "Malware payload (SnakeKeylogger)", "value": "0d94c49855db52082ee129b951957cf369384f86b1fe227ecf9777d3278df5315c87c5e5737aa464018908759377801a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369301, "uuid": "9956bebe-8999-4d8c-8132-8634ff676c39", "value": "T1E5156F25CD7B1292D0B6B23382B35C1AB6EDBC46731FC995BD8636C51B2050CED87DA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369301, "uuid": "e4a6cbc9-0f32-435b-9c3a-761cf8c2c275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369301, "uuid": "a924a39f-7b1d-4256-a0eb-d378509c5d95", "value": "24576:sfeIUjsOX6NTnrtOXA+/0CRR/AHNLEXq8fSWUBuNbK:Ce1R/AtCSNBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369301, "uuid": "0457c14e-3529-4d76-bde6-9ca31a1f0667", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369301, "uuid": "d0bddc58-a815-4f76-932a-2a3e9d4dd579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369301, "uuid": "da835cfa-55e8-407f-9785-591a0dd5fa2c", "value": "PO#88224, 88224-ADD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8af3297-aca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676405577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405577, "uuid": "8de00c21-6194-43c6-a817-8daeab5b2ee0", "comment": "Malware payload (Amadey)", "value": "67ba32d5e5a319301878830ae411331a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405577, "uuid": "124f27c2-51ef-4733-9087-8e2faf1bddbc", "comment": "Malware payload (Amadey)", "value": "7c1cf258c4d49df4df6e9fcc71be4d3e5d585e29f04369f8af6700b9015ce4eb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405577, "uuid": "d862f97b-1e6f-4d76-b1c1-893a99cde3ba", "comment": "Malware payload (Amadey)", "value": "268b53afa2780ce3e2accce45dc2faec1651ded3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405577, "uuid": "e997613f-9568-4061-ba4e-73971243c761", "comment": "Malware payload (Amadey)", "value": "6741ab810380fd561f630dec457c3f18ccda21f7d69ea01cac304aab75e82aae8b9ccf1a29e6114c62a7c0d6ec182724", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405577, "uuid": "4988b6a9-ebf5-4577-93cc-cc3a39be5f19", "value": "T160F4120BB7E98136E879577115F603C30A3A7D606E74879B238F9C5A0C726B4A53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405577, "uuid": "e4775e75-f7f5-4155-a4e2-8137224d89dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405577, "uuid": "75a475b5-576b-4d94-84be-0e981513524c", "value": "12288:oMrWy909TII7ZQm1CKzVDxhcemACxStjGIkVMD5OFo57WFLbQ5OGvZ8zxZ/emlXS:Oyqr7zFx8jx6kKDwFoRWF3Q5ZvZ8zxPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405577, "uuid": "1985452b-d59b-4cef-a266-2e967db96907", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405577, "uuid": "a116f290-8fba-4fda-9efd-18438d2b855d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405577, "uuid": "9e8db55d-9680-413a-853e-4fa8486620a8", "value": "67ba32d5e5a319301878830ae411331a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94701219-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401972, "uuid": "9ebb27b1-e7f0-4d6f-87f7-47e781916a6a", "comment": "Malware payload (RedLineStealer)", "value": "602e43944b161d1be0f1f95d3ec749b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401972, "uuid": "66af382e-e57a-492c-8c65-082e031f0f10", "comment": "Malware payload (RedLineStealer)", "value": "7e02d67fff32b6d175d0a5803d625688f7b5cf07452c437874d0ff375aa4daba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401972, "uuid": "e37b958a-e3b8-48d8-aaed-8ee35e8dbb30", "comment": "Malware payload (RedLineStealer)", "value": "f736d52520034a000f4326a0968e89f6ca22cb69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401972, "uuid": "593e946a-3b9d-4601-8ae5-42a9deeb5ab4", "comment": "Malware payload (RedLineStealer)", "value": "f6cbc10c99372c0a4e1d071bae47bf0089ced6d6517afcfb77d7c6f11b211f49d693d0eb7f560bf996218082bb8c709f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401972, "uuid": "750aad37-624c-4f54-9eda-8631f83bb9b0", "value": "T15EA40217F7F89021E8B5237018F613C306357EB14B7886AB278F5D5609B3670AA3636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401972, "uuid": "a5231fe7-fc96-405c-b705-8e073592fc06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401972, "uuid": "e6be58d6-2e21-484e-a10b-90e9d339f118", "value": "12288:oMrOy90piEekqNc98HQmrQVZKcKH5Q9dacig:my5hkaAQQmsVvKZ0ajg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401972, "uuid": "7c035861-76da-4215-95d7-b08ffccae5dd", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401972, "uuid": "5ccbeab2-95b3-489c-8c59-920fb49b77e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401972, "uuid": "6c6c4a62-1be0-4ff3-b258-93f2459ea9de", "value": "602e43944b161d1be0f1f95d3ec749b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3b8de9-acb5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676413315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413315, "uuid": "9c977216-207a-4241-a69e-f82b0b5af784", "comment": "Malware payload", "value": "7803f1337e0220942123de1764f53ff0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413315, "uuid": "d18ee5d9-41c7-4bd2-b165-5007764c09c7", "comment": "Malware payload", "value": "7e61c9da4575e52f0df6a387e9f885a96e5f19ea570066d3380c936089cc1aac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413315, "uuid": "335d7bf8-465f-411d-9f2f-654936d48b21", "comment": "Malware payload", "value": "8d2892acea23b9cc700ddf3c780ff61ac999453d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413315, "uuid": "392a3f1e-fa2d-4eaa-9d7f-9d83afede507", "comment": "Malware payload", "value": "efc3f6088eeb37cecfa8acdf3d23c89e9ca095393567146bce6e92eba1aa08b3dc9edc98a3a7442eb61265f7a1579836", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413315, "uuid": "04449e1e-82a1-4a18-b89c-8315eb14f960", "value": "T171C3756A3E61BBBEE5A8863107F35F70C395299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413315, "uuid": "14e5cd21-4635-4372-b8e1-391ca11e04f4", "value": "1536:fVNy7Kwv/VhKnyVIYcd/NdlkpW7YQ/32rKAP9XO/uYe7ealbA8D/WTM++vg8:K7NyDYe/uYeP8kW/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413315, "uuid": "6c6499df-569c-4cdf-a32b-6e0f08c66a88", "value": 119162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413315, "uuid": "e50e2095-3c3d-4179-bfde-5e9bcf2d9aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413315, "uuid": "2d6a060a-af02-4bd1-aa53-d47f2a7e29ae", "value": "7803f1337e0220942123de1764f53ff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5800338-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676359615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359615, "uuid": "01e27619-5408-4bdc-86a6-8ea6607772af", "comment": "Malware payload (RedLineStealer)", "value": "85de4e86217d37d2757e9fe28b2790cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359615, "uuid": "fa4ad966-33ce-4fb3-95e9-1e9e3ccb649e", "comment": "Malware payload (RedLineStealer)", "value": "7e63d4e091db604cc5ae0c4c17331d1479ec69ac3d7730f39466d1c90762d614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359615, "uuid": "26c22fc8-1cfb-4599-98b9-8c0eafaecd68", "comment": "Malware payload (RedLineStealer)", "value": "2cebe3cfa11731b8e77918f2e3db572032bedfb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359615, "uuid": "d219bb4b-7ea0-4986-85ab-8429134395c8", "comment": "Malware payload (RedLineStealer)", "value": "e8b7eec7569dfbcc491ee9454e2963fd893303a92e2cfde0a461cec84c467656e84978949d2debdc101c7e08ce5f1b1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359615, "uuid": "c0bbe649-a664-42db-a816-36ed697c313c", "value": "T144F41247BBEC8123F5B4577118F706C30B3ABDA09A3487A6634A9D1E1C736E095B136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359615, "uuid": "416fcb78-d2c4-44bc-be75-f20b09dff955", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359615, "uuid": "51beaf7b-b0ed-4c2f-9493-8206e784cd6f", "value": "12288:RMrvy90+sPM8cJu29BIx1FC+P2kGoSvD2BJd+x7QBNiSFxnCbz73zGDM99sgBV:uyOUxkpx1g+P2kGoSvD27dk87iQmDGoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359615, "uuid": "504a4b79-53ac-47ca-9d66-13c99b1b5d2a", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359615, "uuid": "5879b6f1-bf41-4430-b6ad-1c549ca59c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359615, "uuid": "2834fb69-1254-43d2-a18d-90e4167ed3d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33b21bd-ac48-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676366483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366483, "uuid": "e69ab11a-ff64-4316-8b1e-e181a0651193", "comment": "Malware payload (RedLineStealer)", "value": "85aec1152773f64a687d95090c808765", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366483, "uuid": "e3c717df-3dbc-4f3d-b611-70851c7b7776", "comment": "Malware payload (RedLineStealer)", "value": "7e9c0a88ceb8c00464e0b537e86bc01a9edc647870cd555ea5a4ca97246b125b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366483, "uuid": "2f94b89b-0535-4f9e-bc3f-6f065f94bd9e", "comment": "Malware payload (RedLineStealer)", "value": "d47d9a1995aa687919c740e3997dff7f20297fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366483, "uuid": "cb407630-aac9-4f1f-ae51-d061a495e039", "comment": "Malware payload (RedLineStealer)", "value": "73e816089e4d7c3eab21bc42388c80318309ef3602155d59f9ccccb1ec5c757ccaf8b58f77315197045fd15961f063ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366483, "uuid": "8ab4a1f7-4e22-40d2-9c3a-6238699f475f", "value": "T18FF4121BE7FD4026E4B49BB018F603D30A33BDA49A798287338E5D5A0C72660757977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366483, "uuid": "8cba22f0-838b-43a8-b4ef-e6ece7990959", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366483, "uuid": "d458aceb-d314-47e1-a167-f40f0ba1ca14", "value": "12288:YMrOy90c50blTRy9rBsbuphBWMMquQRDLFp4nlYb28jEGloQ7/EzezQsaoa5KORm:WyT0JTcVsbuphBWMMquQ1knyK8zGQ7uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676366483, "uuid": "0eb7bb34-d867-4f51-8bfc-ad3192f6efb8", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676366483, "uuid": "e8f8e2c9-c2df-4f45-9d58-fac66655636d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366483, "uuid": "9d2e2a96-0cc5-4a39-8b18-628ba4ccf12d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2481bd0-ac4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676368978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368978, "uuid": "d3710038-3ab2-436f-9de4-c1047e7252ad", "comment": "Malware payload (GCleaner)", "value": "ec8057f7129a642be7c6eb184bf3de42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368978, "uuid": "e61887d2-25b9-42fb-8d6e-70533c1f0d5f", "comment": "Malware payload (GCleaner)", "value": "7f253b0416306160aa4b8c5e6cb6945f06f8501d13247c336ee504c58af5e490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368978, "uuid": "b4278d3b-c306-4251-94f8-7651dddd8e5b", "comment": "Malware payload (GCleaner)", "value": "072ca18ca1eb4c70d0cd89cc34e74961c266302f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676368978, "uuid": "37812f26-7529-44ad-9124-b9bb03da3be8", "comment": "Malware payload (GCleaner)", "value": "e2a65b03c1fd98abe835eb1a3e8427110b0e9fa3af1b4271a01a3729661a16a984a42c305195481b1cb241375d0abb3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368978, "uuid": "9f93ede6-234b-4c88-a3e3-55f760887198", "value": "T150E5123CB505C8ADD280BEB4883AD9E71CDB6DE3D9A4D562B0D93F3F95782885A0D107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368978, "uuid": "97d1f29a-4aec-4d77-9902-88c5529bcc5c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368978, "uuid": "2c3f2a92-6a74-49e2-b4e2-04bf7ba7f346", "value": "98304:JH6gZvWHJQFJjanAjOLLS4hdw/Zn6pwv2MR:dJvSIJjaqMrgBn6pwvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676368978, "uuid": "f7808230-6d69-4ae2-98c6-634999353d91", "value": 3186452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676368978, "uuid": "695259fa-d128-4cd5-abcd-f3dc9ea0c465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676368978, "uuid": "7663d2a6-29bd-4a10-909d-69b4d46db2b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e745ed-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392627, "uuid": "a9d41add-22de-4147-bacc-4282a25c04c8", "comment": "Malware payload (SnakeKeylogger)", "value": "04093bbeaa9a12184a4598088f17944a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392627, "uuid": "96b1e8d6-4a88-424b-87b8-0febc418d855", "comment": "Malware payload (SnakeKeylogger)", "value": "7f67d68e60053f36c54541fb5485491e3db0c418b615e6d5d738afa715a250fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392627, "uuid": "97c887c6-e752-40e6-bc46-5ec8acb56458", "comment": "Malware payload (SnakeKeylogger)", "value": "091a566ea26f9c914c29a483f17456566c727ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392627, "uuid": "8d8271bc-7f61-4525-a23e-bc4deae70bcb", "comment": "Malware payload (SnakeKeylogger)", "value": "5ae471b10e4986da0fa934f0c96facd0be9f16738d29c25e12b7202fd49a70aac56dbf2e06c5ea78669f188c29e9382a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392627, "uuid": "4d7a8e64-3789-4b79-a011-bc7596bb04cc", "value": "T16EC44B8CC4BD4312EAFD0F7DB19F29081DA0044A266D4D3A97E7F880E57726A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392627, "uuid": "a32488ad-e51f-404c-a3f7-99bfc8ceacc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392627, "uuid": "c49a54e0-1187-415d-ac99-c99207fa84fc", "value": "12288:jD+eces3NoUi2C6I6vuP9oziQzI2lXjrIesk7iXwYq1:Xces37uP9ouEyes4i3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392627, "uuid": "e6070e9e-78cf-4762-b25c-86b22311b5ec", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392627, "uuid": "2ed83610-f64d-46af-b3fe-e6b0725a65a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392627, "uuid": "9b6a4851-1772-4f65-8b52-14f67ffd94df", "value": "Inv-Faktura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec48e025-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676372484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372484, "uuid": "69f2ec70-94a8-4b30-ba6e-787d8b88fc06", "comment": "Malware payload (RedLineStealer)", "value": "02536174de6604dc478ace3778f002ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372484, "uuid": "6a8bea82-825b-4cf2-8439-f80681000d39", "comment": "Malware payload (RedLineStealer)", "value": "7fb04bf2e24442dcc49441d71d45fd196ac989256faa0e78718cc388d30f7b4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372484, "uuid": "eb3e561c-0634-4eb5-8c14-384821a4892f", "comment": "Malware payload (RedLineStealer)", "value": "0933618e8c3e1c8d40ff71dc64fc2521cd3a28cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372484, "uuid": "3ad94bbb-10e1-423e-90f6-bf62b27ee439", "comment": "Malware payload (RedLineStealer)", "value": "f5e2c3cce4c183a1ef1a7b8922a4dd2ddedbbb463421a15bdc182e526064e08e1e48163a5e7c6eb9e97de4aff17e73b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372484, "uuid": "06ed0a87-e16a-4074-838e-534bd080c5ad", "value": "T140B4120BE7E84132ED751B7058F702C30A367EB15A74829F568E5CA91CB22B4F63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372484, "uuid": "bb55c76e-631d-4c66-bc9c-e6e7af828743", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372484, "uuid": "6a87ac3e-c707-4b4d-aefd-c695a2bcbc7f", "value": "12288:wMrSy90mZJgr/Bsip2uvPq+NAO4A1Eg8TUB5PUHhFEh2l:yyrSBsip2uvPq+NAJA11eUrPUHhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372484, "uuid": "13ceb56f-6743-4bec-8f6c-526742e3c5cd", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372484, "uuid": "d8eeeba2-8509-469b-88f1-2e525f62d646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372484, "uuid": "16bb66a0-3449-402f-b8a4-ea5f7804b107", "value": "02536174de6604dc478ace3778f002ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d587542-acbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676416510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416510, "uuid": "59b6bc01-f2b0-4f5e-a8a1-f7eb90acbe65", "comment": "Malware payload (Smoke Loader)", "value": "1cc09832f4d0629481cdbd69d7764b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416510, "uuid": "db7a8639-ea32-4c0e-8913-32e99cfb152b", "comment": "Malware payload (Smoke Loader)", "value": "800f5a0a0b2fd5a38da027aa265fcd0717f180a7c11a09b2515eefa7312ac9fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416510, "uuid": "7687ebba-6045-4c15-95e9-32472edd75b7", "comment": "Malware payload (Smoke Loader)", "value": "5c2c1d9c26c200d753c27d5efbf05a75fcedfe69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416510, "uuid": "c4f93176-e438-45a8-85ac-e69929e557a4", "comment": "Malware payload (Smoke Loader)", "value": "6cb5b35c7a10204800c68db4aa214f09408127f354e4b19627f34c33b1434b7c32d133dbe01faca1e5037759c84d482b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416510, "uuid": "01f1ab1b-1c97-4a1a-9841-f6c1ad4321b3", "value": "T12514D02275D0F076D11B85794820E6A0BA7FBC32A355C25B335C26AFAF303D25BB9356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416510, "uuid": "2cc0e79b-0f6d-4f61-a305-2aa23a222f80", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416510, "uuid": "bd209899-b578-4b0d-8b5c-4552b3dcf60a", "value": "3072:zvxN374L3XWbL5FwmbkPTjpeMrJyh1zMW1vRL2XIGVww:/4L3mbrwmYvplrUYW1vk4GVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416510, "uuid": "34496e5d-e519-4185-b3b8-850f27507038", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416510, "uuid": "f2a80a62-dc3a-46f8-b9b7-70e840b72cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416510, "uuid": "2e9d0f76-20d9-4fc0-9ca9-8a58028c1302", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a09e564-abfc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676333558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676333558, "uuid": "514a6c43-a737-4c18-9474-276455329af1", "comment": "Malware payload", "value": "d014cd7a74589e1f451d811c1bb02437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676333558, "uuid": "13c2ed42-de59-4be8-9cb1-b1f0b4b002e0", "comment": "Malware payload", "value": "80757d0bb9cc8a5177c7ff9549d074adb2f43f873d65a250740c2424708bbb20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676333558, "uuid": "ca9cf584-0ab6-4905-9639-d5ae46086c50", "comment": "Malware payload", "value": "98a4c98d476c40e93b601ac72ab9fdefaa673074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676333558, "uuid": "014d413b-c67f-4480-8a80-1491e69281ac", "comment": "Malware payload", "value": "2340689c40194d4c075cf68b50e6dcb85e2cde7452c42db4c60b049976dd67058564b21cd56733c3a5ec17e820cfef93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676333558, "uuid": "9737760a-4c33-4277-b74d-b410de62f647", "value": "T128B4120B41F1DCD5C04C00B40306C840213918184721C2070D94003FB4500BC1189105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676333558, "uuid": "2080a786-f6f3-4573-ad77-333b02329d93", "value": "3:WlWUqt/vllEYZcFTS9gXeF+X32Zp:idqGVg3F+X32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676333558, "uuid": "9ba8a4da-0310-4f4d-b88a-2331e6f1314c", "value": 520197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676333558, "uuid": "4cdfe2a8-c04b-484c-8cc9-9896c32eb1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676333558, "uuid": "9ba508fa-397f-48ac-9204-00cfad75b762", "value": "09.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634672b2-ac4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676367101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367101, "uuid": "2f0211d1-6c2c-4244-9ccb-56f8ebb20746", "comment": "Malware payload (GCleaner)", "value": "5982d6769ca4834946638bc93135f1f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367101, "uuid": "5e8da81c-f27e-4f6e-824f-9ae68b350811", "comment": "Malware payload (GCleaner)", "value": "80793860a594cd3b744e893796d37569e0c6a9208b6588c3b435caf58e31499e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367101, "uuid": "fce59694-e3a1-440f-a75b-1dc0590fe041", "comment": "Malware payload (GCleaner)", "value": "6630f0160cfb8882eae8629cad22c87ed838f30c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367101, "uuid": "67e28110-f035-45f2-8414-514b2747e83b", "comment": "Malware payload (GCleaner)", "value": "4afa24a752b339d90a0bb1a8642b1236fd6810c78ca8da6c28108c92a8ab7130acd3d0abaeee1a150b111ee181914468", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367101, "uuid": "0eb3a4e8-1c56-4965-aa65-ea5dd0235e06", "value": "T119E5127C7151C56DC680BE78883AD8E35CE26DE3E9E4A062B0CC7F3F51792889B19257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367101, "uuid": "8328285f-84f5-48a5-9523-19f008016a60", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367101, "uuid": "42261502-32fc-47d0-b529-59d42698e310", "value": "49152:rdHIAr4WbFfxZHKwxmGp+jjtfuszjVXjImCXEWDafdYJC52uAs5ouTOLCgv2MR:JHIA8WbwwcC+1fuQVW0zfdYFu9huv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676367101, "uuid": "c2cbe400-b326-4a5d-8a17-deeb854b9e46", "value": 3170637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676367101, "uuid": "1e8d7ff2-a6cc-4460-86c4-f4449f5b09d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367101, "uuid": "ed8e9e7d-e90a-4fd0-9e75-43ccb4538a18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5292ab17-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676399285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399285, "uuid": "136c2d43-1446-4db9-aff6-d271cbdbd751", "comment": "Malware payload (NanoCore)", "value": "86c32b57a1feaff9d5dcf345e4b92185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399285, "uuid": "9723936a-1a28-40ed-9be2-99bf2f28f728", "comment": "Malware payload (NanoCore)", "value": "80b6578c3790af7fc6b68c26414c3cc693235de382abe5beda6619a5aba92617", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399285, "uuid": "ab01c5c1-d862-4585-9ae8-944c794a17f3", "comment": "Malware payload (NanoCore)", "value": "775436938d5f5384f73ca3718bb79866909f45bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399285, "uuid": "45413f14-e504-421c-a209-f0e28fbc615b", "comment": "Malware payload (NanoCore)", "value": "5246a1b6dea0ec09cc6b11b5ba7f7e9aa2f15d4fafcba7ca3a1844a32edd85b157bede5c55123d652e0f7b1f0b1733d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399285, "uuid": "0776d060-79fb-4e76-af29-7cf74a5c6c8f", "value": "T168E46C8DC5FD4212EAFD0F79B19F29480DA0004A266D4D7B97E7F880E17722A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399285, "uuid": "e5562ed2-2a3d-4642-bc95-3701048b2a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399285, "uuid": "73934d5f-3c7e-4803-ac28-bccb2bb0afda", "value": "12288:3ueces72pQIdv5YJuxkRvh7SsLCwqdpYUdk2TC4oJ3toGN6:vcesieIdv0uxgh7fqdGUdpQJSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399285, "uuid": "3cb38cd5-cc97-4471-b466-c475c5997a2e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399285, "uuid": "e5766f47-1d47-4dfe-9848-902d3944f331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399285, "uuid": "98b916cc-1f9f-43b9-b37e-6df3cd3a8793", "value": "86c32b57a1feaff9d5dcf345e4b92185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a825d97-aca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676405392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405392, "uuid": "c2e4e645-54d7-4117-bedd-6e4038993b61", "comment": "Malware payload (Gafgyt)", "value": "f98f90a9d41a29523ae63f069eb25aaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405392, "uuid": "ff712295-4e73-4197-8be7-ced4d021e38b", "comment": "Malware payload (Gafgyt)", "value": "80d7d535edefb1846919e96ba320a18734f93e28c9a564575fc5cf5f6a828243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405392, "uuid": "2a6d6909-4014-458f-aa64-bc83e2e5a4aa", "comment": "Malware payload (Gafgyt)", "value": "09a5fc68a08a983b38c2a4fbc1bff4da98d76c53", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405392, "uuid": "0d89c3e1-b328-4f25-adc6-873814bd0482", "comment": "Malware payload (Gafgyt)", "value": "8f81f65f1d86693a8f937414eabf54df8b063f898cf5bd62ffb57db65e2683024f201d70092eeaaad4d7bfe2a12e8c04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405392, "uuid": "960f3d14-67b8-466b-9829-3fa8a9e61106", "value": "T1E4735C136991CB7BC4C747F92BDB952144A3F83E1F32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405392, "uuid": "4a0b29e3-dc8f-4cbe-8017-3cb52d78b38f", "value": "1536:E7IZuQa/+1iDnD+Q8bQ8O32Ls0FnswNCzvmA+JbOm/coZ3ymj:KAaG1ItqQH2LDnsECzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405392, "uuid": "0fa640f3-ffd6-4ec5-b256-db7c738e6e36", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405392, "uuid": "06ed28df-5ad5-43b0-ae31-234abc5271d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405392, "uuid": "1e0b4034-6a3e-4b94-8b95-dae0365c7a4a", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb21ecf-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399998, "uuid": "7918b91b-ff9b-4d0f-8d61-d7cafb464129", "comment": "Malware payload (RedLineStealer)", "value": "848bf9890703ebaea8b007e9c0c20d24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399998, "uuid": "ab40dad7-1749-4cf3-81fe-8927dd73f93f", "comment": "Malware payload (RedLineStealer)", "value": "811eb60a2fe6da8e92d739288505db79f1dfa7828cbd2c061f0766394cb06088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399998, "uuid": "11a5212e-4119-4cb1-b23d-2916d186d4f8", "comment": "Malware payload (RedLineStealer)", "value": "3318bf51e093a28cf04b5a8895cad497c7c02ad0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399998, "uuid": "f44db38c-f4b7-4f3a-8292-469ffba4b490", "comment": "Malware payload (RedLineStealer)", "value": "cdb05fd7c1de8b35ae2fc80fed624d7442d0589fbf9ec266838704a7218583132278b93e247e59c573df520dbde361a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399998, "uuid": "4db947c3-7386-47a8-973e-676e7d083ee0", "value": "T187A4011BA7E84032E87057B06CFA03D316367D716B39929B278E6C5A1CB2570B23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399998, "uuid": "07a98202-e357-443c-a06e-d57f66f05b08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399998, "uuid": "7737dcec-c540-4784-91ec-2130194e715b", "value": "6144:Ksy+bnr+dp0yN90QE7s7RFHl05KpiV0s9144/WdIbehv8J3ZHZiGq7QIiJjM5inx:wMrRy90CtFHqEc95/WdIK8J3O7t2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399998, "uuid": "b485fc4e-a8d4-446f-8c53-7a7f14ec5e85", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399998, "uuid": "66e177f7-1a5c-4256-99b9-44a09a649759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399998, "uuid": "f72df14f-0023-4ddd-87ea-20310f5041a2", "value": "848bf9890703ebaea8b007e9c0c20d24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6b4c06-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676408406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408406, "uuid": "5fe29530-3897-45e7-b426-83baa1ea99ba", "comment": "Malware payload (DCRat)", "value": "2fd02daf2ff34081162d522b24104e15", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408406, "uuid": "148074c8-c76e-46e1-8185-7d799b5a0d17", "comment": "Malware payload (DCRat)", "value": "815e613e725aeea4768051d514ff32771f971043566b3546bd60bd78b8ab5d92", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408406, "uuid": "a28b7446-b940-4fee-b995-0c50be1b510b", "comment": "Malware payload (DCRat)", "value": "23425727070610fe467db4c1bae8716c703b9500", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408406, "uuid": "d1171ff0-3fc5-4f1b-a443-b751143488e3", "comment": "Malware payload (DCRat)", "value": "aa6ba9c74682027e89dee6e28be258cdbf6b2807044c49168df09347549162900670a985e08b257d49e04376154b2e9a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408406, "uuid": "fe62409d-4ba2-4a40-aa6e-c497357277de", "value": "T182E5DF027E44CA51F0181633C2EF45488BB89D526AA6E32F7DBA376D65123B77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408406, "uuid": "7dd9e70a-f90b-4cf1-9d36-9769afac57f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408406, "uuid": "6d6246d9-2f52-4151-b86f-fff71efa5e26", "value": "49152:YxTVTFx3B6z7Q08ZkfCnUceiGcErH7hZs9JrDrIo9k33kRHaG+:6BFxQ7j88YUncBrDrR9k3eHaG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408406, "uuid": "dc8c67d6-7b83-4146-a262-c33019a48d00", "value": 3228672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408406, "uuid": "36b780f6-e860-42f5-beca-7dd245eacca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408406, "uuid": "be663ab0-19fe-4994-838f-4741a4ba3ca4", "value": "2fd02daf2ff34081162d522b24104e15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcbcf3f-ac52-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676370417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370417, "uuid": "78ff0e77-2261-4dba-af2c-3cfc40dc1a15", "comment": "Malware payload", "value": "536c0a808e0fd42c8f2ad08e5cf2d82e", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370417, "uuid": "3f3c920f-5a5a-4b22-bc32-4ad8382ee65b", "comment": "Malware payload", "value": "82b14fe79e814eece77afc53a40d18092c07cba10da06e41c081aae3c48b1fc9", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370417, "uuid": "b5a97845-e781-4f75-94b4-837e5f402f64", "comment": "Malware payload", "value": "3d6c1bc6aa053623f538a55e866fada72afac89e", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676370417, "uuid": "e41574a8-531e-49dc-b2de-58de7ba2d7cc", "comment": "Malware payload", "value": "fcc4ce2162db14bba7cb9fed8ae0d4e2e0c7487812dd6a09085d1cf85032aae3d07173274b6107110a47f0e1aa784c22", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370417, "uuid": "bf3743de-91d3-4877-9d95-470cb63232dd", "value": "T11D6423E850C7B816C7C2D3E1D08E3FBE5477EE36589D62485345C1A3F24439AE976B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370417, "uuid": "66235c44-2b5d-44f4-ac90-2802b8428d57", "value": "6144:yd+wa9CNwKhliSKyeD5yzEC5voUn7QqBmBGOSID6GYP4DatvioYX:ydSCb2Rlyz7Nos7BmBQSata1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676370417, "uuid": "fa6f71ed-359f-4141-934e-6149beecdaf8", "value": 331070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676370417, "uuid": "1cb18dbf-ba21-4322-bd14-8aad5435fa02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676370417, "uuid": "c318742f-49b2-4fc8-861a-8edf6f3429f9", "value": "Ziraat Bankasi Swift Mesaji.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5524e3d-aca4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676405866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405866, "uuid": "fd39934c-4390-41fa-8611-1031b51df35c", "comment": "Malware payload (GCleaner)", "value": "5cb85ccf1999b40ce92ac194823f26f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405866, "uuid": "73712286-517b-46b4-907f-363391b51c02", "comment": "Malware payload (GCleaner)", "value": "82b8a9b5410be2544da27a0d6ac2c18458cdda39f45402e01aea852326d7f1eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405866, "uuid": "7966c648-1765-4997-b738-3154bfeff915", "comment": "Malware payload (GCleaner)", "value": "aeb80cd1b727cfcde3444d2ebd34f8a330d8f1cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405866, "uuid": "4172fd27-4a92-492d-88c6-a38728a7ef84", "comment": "Malware payload (GCleaner)", "value": "962f2bc9566cc2e9da4f1ae799e2aedebd8ad1f0445aeacdbd444c186a1cc57d799f91012a3ca7764f4780e30e57c3f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405866, "uuid": "4f169057-4d7d-4453-beb8-cc2eea1cfa08", "value": "T170F5123C7144C56DC680BEB48D3AD8F71CE66DE3E9E8A42270DA7F3F55786894A0A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405866, "uuid": "00c15d29-4613-4e84-b5bf-17e713faae76", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405866, "uuid": "7d64df4c-184a-4d0b-90ac-e2010f383f7a", "value": "98304:JHzix4Q11rJW2JZhd/gwSspjmxrpS/uev2MR:dzLQLrJW2JXlqrpS2evjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405866, "uuid": "72e3b2f9-1e1e-42cc-8570-e85c78a53e26", "value": 3371194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405866, "uuid": "139c2f81-37ac-4c34-883f-2f2943befda2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405866, "uuid": "38e89847-c11a-4cf4-bfcc-7fb04a449591", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989adaa-acc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676418302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418302, "uuid": "1fb79034-951c-49f2-aa6e-707a1b7bac56", "comment": "Malware payload (Mirai)", "value": "49c842fb865e7d3bb8c0fdb8572021ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418302, "uuid": "fc925eec-d87a-44ff-b816-7026e841e9ed", "comment": "Malware payload (Mirai)", "value": "82e7427a30f4ae575d12c3126a25cdade48ef7ab419fbf06b3aa9077d7f4669d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418302, "uuid": "5a4becf2-8163-4381-b940-a8d5a2506031", "comment": "Malware payload (Mirai)", "value": "4a9db958c916b688c103d88e19ce543bc9279109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418302, "uuid": "20f737e6-8678-400a-a7ea-9dc52e8e1148", "comment": "Malware payload (Mirai)", "value": "9abf36150a97162c19b2b2dee4bb91fdc7f781a8e88f7b1dfc975f1fbc2b8c6631a7f79d4e869505528ad844d80dc49d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418302, "uuid": "3eaac472-2fe6-4b4b-b1bf-bb450af7ed99", "value": "T120533BC8A5C3E4F5EC001D7D307AABA1AA73F53F2039ED9BD79A25739942243E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418302, "uuid": "f026d660-666e-47e9-8103-ac799aaa3e3e", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia7jGKO18Hq6PW3kkx0+j/KUAm9:diYpROxmxhXMFnKl/GHCHqL5x5/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418302, "uuid": "9384ba6f-6dfb-48ff-be52-88cf1910a63c", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418302, "uuid": "1022d3fd-2880-4073-a949-63909e086cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418302, "uuid": "20ec93ad-8845-4924-8a44-d0d0b52f72c9", "value": "1isequal9.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5657f124-ac3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676360637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360637, "uuid": "4f21fafb-22af-486c-99c6-6511e058096b", "comment": "Malware payload (RedLineStealer)", "value": "b705a261fb9a7391b7e1a43421ac03ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360637, "uuid": "9ef27608-f25b-4fa9-8546-1d9b6a2b6dec", "comment": "Malware payload (RedLineStealer)", "value": "835cb33a3d2e786789a61d707323b279e5da0eb0f63674f46160cd5951c0ef2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360637, "uuid": "a86c9be1-56e8-4cfb-8dc9-91de20df272a", "comment": "Malware payload (RedLineStealer)", "value": "cf7a20dd20d81783db607f2654c35054383e1034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360637, "uuid": "175907ce-7590-4d5b-a68f-3ec6f82f42ca", "comment": "Malware payload (RedLineStealer)", "value": "6963af5e9cce71df9110208a4a024bb8a58e790f12f0cbb00cb5fd51e916f1c57a88df90034df44d322b6de37180d294", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360637, "uuid": "33e49718-444a-44c8-adb0-cfce1a04469a", "value": "T123F41207FBF88462E4B197702CF607D30977BE2056389B96274EAC191CB3661B63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360637, "uuid": "275d5f26-e693-4d8e-a34d-efeff95cb3e2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360637, "uuid": "7ab3a14c-04d7-4138-89cf-1bc897af376e", "value": "12288:nMrny90X9ga0VqWUjbPcfUQjfkfSxFG4f9M5cj/kIrVVsgbzvPL2fkAK:4yS9gnVIaUQjfOkfN/kIrLTPKfkAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360637, "uuid": "0bb46733-c789-4e0d-a29c-c88ecee35030", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360637, "uuid": "7df59d9f-0b1a-47d2-8cee-6367a2b50c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360637, "uuid": "7aee3031-2449-47cc-ab01-fa39273c2244", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293f3616-ac32-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676356695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356695, "uuid": "41a0943d-c406-438d-a52a-8d3670aea419", "comment": "Malware payload (RedLineStealer)", "value": "9eaaff64e525164b5867d3b4b36a6c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356695, "uuid": "905eed5d-84be-4382-b0ce-7a1d4a3b7255", "comment": "Malware payload (RedLineStealer)", "value": "83dfdf93120ae5b90962966a3994aaa2753b5eea45e286607c28683883339959", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356695, "uuid": "af7dc1e4-50b3-4fe2-9584-188c1d068f53", "comment": "Malware payload (RedLineStealer)", "value": "3b55ae077bfb51925a154befeecec2cbfe283cb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676356695, "uuid": "31c057a2-92d2-4baf-9f57-bbea72f9fe20", "comment": "Malware payload (RedLineStealer)", "value": "13ec6509a6dea731495df9ae9f3a1004e78f97979e10e17240e8630fd0958699154b9115b51e00db5dca393f3414d1c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356695, "uuid": "25024e9c-9fa3-4627-adcf-4673d20a9478", "value": "T14BF4120BE6FC9032E8A1537455F602C31A323D915A34D3A7274F9E9F1972A60B2763B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356695, "uuid": "1a50e8a8-0a4c-4f1c-a41f-5dd3331bb9c1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356695, "uuid": "a32e8705-97c4-4d77-9ad4-4227e62701dc", "value": "12288:PMrFy90VDhYNMU6+QGlZFh4fLaflpK1Bj65acZoS3wb4:iyYDhUE2SfmOaz2cwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676356695, "uuid": "27c26e5c-b0db-431e-8db5-4eeed11604c4", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676356695, "uuid": "5f0dc05b-47c8-46ca-99d7-fa66ac31f4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676356695, "uuid": "f0a41973-cf7c-4439-b7ac-360683661ec7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cb342d-ac77-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676386434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386434, "uuid": "d768ea5e-e188-4a02-8d80-0845bf21d4dc", "comment": "Malware payload (zgRAT)", "value": "d25375ff7b52148e4c84459bc2e79051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386434, "uuid": "cb345f9a-b7eb-4ca7-8b00-d0a5d188a74d", "comment": "Malware payload (zgRAT)", "value": "841c1860b52b3817eed70e4d1f1bca972f0406e666bd8d034735fe70cc713831", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386434, "uuid": "07146e10-f43d-4baf-9612-ce128d1e97b8", "comment": "Malware payload (zgRAT)", "value": "bacb7847a1ba685a4a5dd0bdf2ef4bb841049ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386434, "uuid": "4551d548-f749-452e-be5c-613205dcc641", "comment": "Malware payload (zgRAT)", "value": "a7f28711910b6c273f7ab3fca06af7d63d73e0e24a5a7d476e229410129b1050ef551167aec36cc7eb9dc4bdbba9e91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386434, "uuid": "c30d3e0a-45c1-45b9-a8b5-dbba2359c5ed", "value": "T1F9A512D0C4C9004ECE19EEB8A0017E8D968D47DFD9B23540766996EFE837DB8E15392B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386434, "uuid": "66cdc0c8-1159-4330-8a9b-28f9394f8016", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386434, "uuid": "648d1f82-b201-4062-998c-11bd70bf62b0", "value": "49152:5HugbTfeJ7YUwZiDJ7Gj3tuQTxmHC44VmNC76w0dtEqOhh9UZER:5OETfeJ7Raj3Le4VmNCGw0dtEq1CR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386434, "uuid": "8347b714-9fef-49cb-98fb-aa4b4b2f01ed", "value": 2063360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386434, "uuid": "4867ad5d-4706-4bf0-8f1b-8e2573673afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386434, "uuid": "e5267707-1cd5-4462-9e64-528ccaa8c1a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf7c1cc-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676375197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375197, "uuid": "b3cc30a1-b54f-4f19-84e6-a4b332835dad", "comment": "Malware payload (AgentTesla)", "value": "d361e5fdf4232da920ed1a28bcb1ceae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375197, "uuid": "1484f6c4-05da-495e-87d7-eb2fd8df2b68", "comment": "Malware payload (AgentTesla)", "value": "842f0c665fdc15b778d33347d736ef588e9d3e66de357341bdebdf80d6016f85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375197, "uuid": "3ced50fa-dc1b-48a7-a16d-cc9cc62a0e7e", "comment": "Malware payload (AgentTesla)", "value": "c4b1df0365307f2e09036d23a5724dacfdd8e4ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375197, "uuid": "4b3cde7e-6b6c-4707-be7e-80f16c12979b", "comment": "Malware payload (AgentTesla)", "value": "a95f5b82a1c55f126e1a97da4722ae29e456d73e69b1b4c233fceeabae7a1c5819ed6be9f4600e79cfbb1a6b00bb0c3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375197, "uuid": "a7c0c7ac-8c9a-4df5-9ff5-3631da4976b4", "value": "T1BCE46B8DD5BD4212EAFD0F7DB19F390809A0044A266D4D3A9FE7F880D57326A707EA5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375197, "uuid": "abbeac05-6daa-4798-9b93-c74a880c20fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375197, "uuid": "1d683ef4-28a1-4aa2-be20-71aaa8acd274", "value": "12288:HfWecesY+Uri/OaGd6aXleNeU7tJKNUO35oA8Jws+ozdzgAp+Y:fcesv4dVd6aAEAoUgmHws+oZg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375197, "uuid": "97174d6b-e3fc-41b8-a028-38b45f2aea52", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375197, "uuid": "e322421b-9499-41a6-ba43-56f6ade86aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375197, "uuid": "0d909f94-ac8e-46cb-a904-45f60d8f477d", "value": "Teklif Hk DGN A.S_20230214_902195153_699008811600000_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c2702d-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676392628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392628, "uuid": "a95bdaf4-7101-4262-9976-67d49ee0fb91", "comment": "Malware payload (SnakeKeylogger)", "value": "7a32c1928846d1043e443474fa6549c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392628, "uuid": "6385c9d7-b4e9-402c-bb82-c176368fb01d", "comment": "Malware payload (SnakeKeylogger)", "value": "8447a1c529bb04ac97e6b9ad4ebbf0ee99d64af1a7cdb52ba4347906056bdcbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392628, "uuid": "6351c7b0-e9c1-471c-ad9b-ff40f3cf04ee", "comment": "Malware payload (SnakeKeylogger)", "value": "90dc678dc61fc932b17b20e2f2ae0d50a5a0e094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392628, "uuid": "f33f3840-d315-4520-94b0-7fad3cd4be36", "comment": "Malware payload (SnakeKeylogger)", "value": "f9f0f34819b723ee35d7458c8a0d1c6f2d21dc4da3b05ce9539fb25d06badc3e9d68254d93d65595797ba7483938e88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392628, "uuid": "08b66a93-ff23-4eb5-ac5a-5e274839c3b6", "value": "T13814025862D0C4DBD97347752EBB92A9AFC4D62214A9BB0F03500A587F262D1CA5E3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392628, "uuid": "6ad11dd7-1126-4a8d-a3b4-6a7ed047bf6f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392628, "uuid": "fba0e83d-910a-4247-b570-5c388d826fa1", "value": "3072:HfY/TU9fE9PEtuXbEH0dveCvCzm+hNvKTovGunhfPIKRy/3jZaHeZSLk08MbE42z:/Ya6RHvvwbhNvGANlPAVaHGBIE42z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392628, "uuid": "78cf2ded-8729-405e-94a0-b4c894c4b091", "value": 202117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392628, "uuid": "eaa3243b-631b-4b7f-bea6-929c4d694211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392628, "uuid": "1935b8cb-eb37-48e2-a11d-e6e3a1fc5269", "value": "crypted file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a6cd05-ac19-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676346251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346251, "uuid": "a3a7d138-c8bf-4e7b-bfeb-335b2e497655", "comment": "Malware payload (Smoke Loader)", "value": "b12349c4e286ed6d47ae911d49ea4db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346251, "uuid": "06de463a-134e-4e3b-b8eb-508d25dcdfa5", "comment": "Malware payload (Smoke Loader)", "value": "849d6739e15eb62ff2b3fd09564f08321c3f5d14f2aada829a9b23e603e99bd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346251, "uuid": "9962a518-f6b0-491c-8b19-e9fe2bd82955", "comment": "Malware payload (Smoke Loader)", "value": "ae40dfda0368d4693b3d536e51339eb28f4a7a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346251, "uuid": "8076d126-9f0f-4398-a1c8-a8d63c8fb4c9", "comment": "Malware payload (Smoke Loader)", "value": "f07c90b2765ca03f4bb9e3600f0dec67277f5238166cfef09d81b70bc280b799f7618cb748f46e6d1ac1ba3debfee598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346251, "uuid": "aabf7db5-ba35-4cbe-a9dc-92da9e678839", "value": "T1E414CF22B3A1D471E4274A329C2DC1F47A6EF9615B759EDB33946B3F1DB02D08A36390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346251, "uuid": "9fc63295-83f0-4d35-ab13-8fb3c1dd5f44", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346251, "uuid": "e1df087a-30c4-4a9f-bb25-6f78423c24c0", "value": "6144:7RkObQHQnYr1GT5CTBMoN/mZFlCYMPeUv9u:7Rk6nYrEq2oQDleeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676346251, "uuid": "72025e2c-9222-4fca-ad34-f82abfe3c8ca", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676346251, "uuid": "85555733-6089-448a-8776-029e02be980d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346251, "uuid": "54f06420-35ff-4b9e-bea5-edb3c3b7e8a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ec628a-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676392801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392801, "uuid": "34192bbf-3d52-4815-a19c-5b009c09d8de", "comment": "Malware payload", "value": "cd5c414970f6843ec61848b5d122e80f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392801, "uuid": "4dfa1dbf-7807-4af8-9c6e-de7c26fc1151", "comment": "Malware payload", "value": "8524a5d1cdbc35353877b901da67ea917420527ffc48b4786fdec67dc1093ecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392801, "uuid": "84939a15-02a2-41f3-936d-c66b9434cca0", "comment": "Malware payload", "value": "9588d7af3315fb33ab0cec1c0349aef2d26b275e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392801, "uuid": "f8bd2998-9ecd-42ca-b4eb-bb112f51af0e", "comment": "Malware payload", "value": "9aa9f25499cfe91b191dbfc042c4ecfe68a02dcab44137ab90c404051641c9c75b071f5bf57f67b5ef12d45389d3dd56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392801, "uuid": "c4ac3a21-1117-4d69-b313-e7eaddac6e00", "value": "T107A3AE3232D0C072D5A326715874C6B56F7EB822677888CB7BA41B3D5F707C1AA3A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392801, "uuid": "ff6564ed-1b72-4ef2-8e61-7a062104f804", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392801, "uuid": "7a1263aa-be18-4afa-b2f2-aa5b5daf360b", "value": "1536:UdMBNoDAriSPUzWJ9roGtEYl8XwhXkhZuIcZjnrC389b:UyBNoD+Ugrdbowhwsy38t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392801, "uuid": "7382ccee-f0af-4c33-8ae0-097261f82aff", "value": 106102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392801, "uuid": "c5b3c558-5f70-4feb-84e5-944395cb6be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392801, "uuid": "389c0875-0ee5-44d0-bc72-be5de6d4b5d9", "value": "cd5c414970f6843ec61848b5d122e80f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538e7550-ac02-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676336151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336151, "uuid": "088fb1ee-9825-4988-8b70-32bdd88fd4eb", "comment": "Malware payload (RedLineStealer)", "value": "fcbadae7656c0c4ec9364f84bcdae346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336151, "uuid": "36d8faf0-3bb2-468b-8060-f8c4df460d9f", "comment": "Malware payload (RedLineStealer)", "value": "85a115531a948bfdb9528614ac5f9ae3a0711dc4c4d16dc2a90a1ab0e9a193ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336151, "uuid": "b92341fe-f33d-41e2-ad79-4c6fee378977", "comment": "Malware payload (RedLineStealer)", "value": "5ae1d9aef7aa4b57ffb086aea1e0841c60699398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676336151, "uuid": "fb4a9854-c4b0-4cf5-b331-ef45556c4d53", "comment": "Malware payload (RedLineStealer)", "value": "ec4188a3042f1f8342b105cbf3d7428a9c178206bcdc0990e006ecf0d58c682e06e098c9c5c91b78a402ebc8cd41c7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336151, "uuid": "85e4d4b2-b583-4d98-aab0-008d55150dff", "value": "T11CF41207ABE89023EDB46BF054F307C30B357E514634935B278ABD990C726B4A27976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336151, "uuid": "6208da9e-7515-483f-b039-3dafa91f81a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336151, "uuid": "968d97b7-19b6-4bdb-a511-d8ca83907f19", "value": "12288:iMrNy90D3tDR/ByVPSpsKiP5eJiI7O6KRsQNAPD6Q221GSk0:PycRJoPSpsKNiIVP+Q2Kxk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676336151, "uuid": "fb86939f-70a3-47fc-9117-c505ee577c17", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676336151, "uuid": "ba893996-c534-44d8-a212-ae1f3cca3fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676336151, "uuid": "cebaec79-24e7-42e7-afd0-7dd70615f118", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ca168b-aca3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676405578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405578, "uuid": "acbb1723-c4c1-4229-b8c3-538680a412c9", "comment": "Malware payload (RedLineStealer)", "value": "8e27e86acfe902271ed5638e04446150", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405578, "uuid": "3c8f2bfb-e446-42fb-9186-4914afbe00ba", "comment": "Malware payload (RedLineStealer)", "value": "8611a9dca789986cf828bf4447048ba6d1abf0ac1c66c04d2f1bdb69614e7ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405578, "uuid": "0c549f88-4b16-4e92-9f4d-b0b95abfb860", "comment": "Malware payload (RedLineStealer)", "value": "03907adb653f6826e977535fcb73e56394134672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676405578, "uuid": "97dbe449-8329-4f13-8861-2d5ca35c9c51", "comment": "Malware payload (RedLineStealer)", "value": "e7a1e265511cb34e456006be3414fa286ff8522757c6e6e83fed46108f8c33e8fee088b09bc5788fd9d26de6b5b485c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405578, "uuid": "e66eb6be-cb64-480c-bc49-e904d989989c", "value": "T1F6C41207FBEC8436E9B15BB058F747C31A35BDA19934829A374E5D5A0CB22A0B630777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405578, "uuid": "a5f1d0de-71a3-4a72-8d69-e97a031cca01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405578, "uuid": "eda7d425-4181-4340-91fa-b67aa23a8844", "value": "12288:DMrry90OPms5Vq/fkznpb/VldDXR0TNlXonW88TX2:0y3PTVqMpdTCPXonWr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676405578, "uuid": "7ff36e44-cc11-44e0-80c5-16e36dc82459", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676405578, "uuid": "3fa78ff5-37e7-4f83-b15a-92a6fa1a3a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676405578, "uuid": "5e4db201-3325-4020-bba9-b44cc56f9a8d", "value": "8e27e86acfe902271ed5638e04446150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a565e8d7-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676392981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392981, "uuid": "50b95a1c-bcf7-414f-811f-3f63ae580a3d", "comment": "Malware payload (AveMariaRAT)", "value": "49e55370798abca611e43f9e2acdc42f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392981, "uuid": "e4eac817-4eda-4779-9e48-a7dae82d8e42", "comment": "Malware payload (AveMariaRAT)", "value": "864fd241f052d4f5e4efc5866b6b204ed7f9d4fc848b91f1e5ea91543b7340ab", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392981, "uuid": "3d2da21b-9be0-4276-9757-4666259f851f", "comment": "Malware payload (AveMariaRAT)", "value": "5876e6029211e449ee7dec014474a05958755736", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392981, "uuid": "e566e0a0-0043-4cea-ba9a-0f3cc0016f11", "comment": "Malware payload (AveMariaRAT)", "value": "b7d879a01c4231e543ce905cf25202586955562f0e0a55dc5289866a2cbd1db8d1c959d9a5dddc9ec6c5ca5ecee5aed9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392981, "uuid": "a1ab7880-651a-46fe-8344-378effa64bfb", "value": "T1D654B6E4645F48B6E6089D0DA4D4B1056E76FEE334C598B163AEE430CF66EF29EC044B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392981, "uuid": "9b4d9aa8-9c90-4f9e-9483-3624d8fcbcee", "value": "3072:iE2CiFzEdny6x13u2jF5ho8xBBWVzFtr5RDAw5wfY:tkFmy6zHjF5hNxBcVzFt1RDAUww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392981, "uuid": "0f51f79b-53d8-4ea1-b2b6-a7e80b937085", "value": 305226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392981, "uuid": "30a3d60e-8e2e-4264-978d-d4a9b4e9cd50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392981, "uuid": "25083345-2bd7-44f0-9a4d-57034762ef4d", "value": "SKAS A.P. Ltd. Jepon Project. PO.50017221.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75567712-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676381304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381304, "uuid": "8ed5bb4a-b4d9-4b8c-80ac-aaf60b5145cf", "comment": "Malware payload (Smoke Loader)", "value": "319642ed4983ecebf06e8fbb986dcf15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381304, "uuid": "50fa7111-17ae-489c-8fb1-a31267f665c1", "comment": "Malware payload (Smoke Loader)", "value": "86b1f391612e8af718e1129b8407fc031f477dae7af568a63f3ebba81ccc0d69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381304, "uuid": "23476e12-cd76-4e6b-9803-711f373ea072", "comment": "Malware payload (Smoke Loader)", "value": "c05afddb252096b770ffb9ab68c3bfc1abdb2bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381304, "uuid": "1d1ebc0f-b7bd-48dc-b9d9-458c919387ad", "comment": "Malware payload (Smoke Loader)", "value": "ca13a6e657cf31c977d7820abc837d77c65aab78855b6cb87bcc0e63b6bf00fd92989aceefc61e7a9e07ebcff9643945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381304, "uuid": "468db5c5-3e13-4063-9283-65ee4fa96040", "value": "T17004CF3A75E1C032D16B85775921D7A0EE6F7C73FBA0C19B23580A6E2D302C18A6A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381304, "uuid": "3de9dd45-c7ce-42ed-9542-ee63a347877a", "value": "033c129a4522b4dc7e5484557290091f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381304, "uuid": "5b0ae98f-7728-43aa-bf77-cb9970bc728f", "value": "3072:ty6LIid5oFFlRRV/8lQAKQZcQMF6gZsEq9GIUfhBR0:dLIi4/0lQpQU6TEkHUJBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381304, "uuid": "339fa405-d335-4e0a-9faa-ade61ffbe84e", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381304, "uuid": "6431302a-561d-46b7-8d6b-b89957fab30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381304, "uuid": "eec21f9b-3527-45ed-995c-373ace3b1435", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc5fb1-ac4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676369038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369038, "uuid": "833dd7a0-bcf5-4232-acdd-60488947b3a3", "comment": "Malware payload (Amadey)", "value": "c68687cc1798217d3fe872bbd12493f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369038, "uuid": "f787c49e-0408-4971-a05f-7ae9c49b6ab7", "comment": "Malware payload (Amadey)", "value": "86cd01ac90dda7ddbce396c300ff943a77aa0527a161bfb1bbec3d84228fd302", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369038, "uuid": "d3ecf6f4-aeff-4b91-873e-cbc7221a6239", "comment": "Malware payload (Amadey)", "value": "73d0c55ffdced471f4309a89c0b3e333f56796e6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369038, "uuid": "118c0c6f-dce8-4a89-82af-682be971e6bf", "comment": "Malware payload (Amadey)", "value": "613421caa4ad3e73f3c8f356561ecda03ccf206366448bf849cf8ac67b3b07e85f2fad33ce567b4a667c8c297583ed8d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369038, "uuid": "3eab703b-d407-4129-a984-f3f455d4ee22", "value": "T1FCF41207E6EC4111D8B86B7069F603E30E3B7E609674C79B278B1C690CB2570E576BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369038, "uuid": "dbef99b7-d9c1-481b-84e9-618903cf838f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369038, "uuid": "6d50816b-aa46-4d73-a2ef-ffe6a9d554d5", "value": "12288:mMrOy90POn+KN93yQsKbFm4JQ4SzPjzRdD4K19o4R34NS:oyPnxz3yQsK7JQ4Sz5dkK1W4R34NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369038, "uuid": "511da11e-ec2f-48d5-b7f3-399065991af7", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369038, "uuid": "ac533f01-b8a2-47bf-b011-15d256e455bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369038, "uuid": "078be5b9-ec07-4a93-a700-8aba81d7b800", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1734c2ea-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676392313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392313, "uuid": "97e315bc-3324-42c0-84da-10a5251f49f4", "comment": "Malware payload (RemcosRAT)", "value": "2d7af49308637ee1f3ff1b9bc37e5e7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392313, "uuid": "80d61313-de83-4937-8084-8d0bb965ada5", "comment": "Malware payload (RemcosRAT)", "value": "86f7982d492e032928fad4608bd2ab06f98998372773d1e8a79e0167cf022fe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392313, "uuid": "4f230c90-c1e5-44a2-af30-7582d510c727", "comment": "Malware payload (RemcosRAT)", "value": "719e60c82a3dee99b1695e93fceea99de03be99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392313, "uuid": "954c3459-ac9b-4432-941d-0a6358c1d96d", "comment": "Malware payload (RemcosRAT)", "value": "00d3f79733d1bf0153b8e2c4f82cbcc6fb45749719e0c0ada257e3558be7ea2ae1799b262cf76728f1fc79f4ae5cd7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392313, "uuid": "597c7b82-727a-4d50-ae4d-dc561cefe715", "value": "T199B4225076E0D3AAD4E316753C7B4E662B9A4D680DA1B2871378379D3F737F48828362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392313, "uuid": "f3ab9b39-6f0d-4d0a-beed-f1444282e8b4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392313, "uuid": "4d6fa605-cac9-49c2-aa38-b16a9ff42be2", "value": "12288:tYg1x9gBWzav81VK3lGDPXg9qiKfAsm0QBiTQY4Ak:tYgXqPvM4VGrwFtThYPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392313, "uuid": "df5b086a-82d4-45cb-bff5-3571e5174d9b", "value": 536654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392313, "uuid": "24979088-fbb3-4e36-9d9e-758debd5468f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392313, "uuid": "ccbcee50-043f-47ff-8d0c-f1420524cc93", "value": "USD Swift Bildirimi 13.02.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f823a3-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381332, "uuid": "18a378c7-b171-450a-b594-cedb02bb1bde", "comment": "Malware payload (RedLineStealer)", "value": "bcbd0a70baa4f35362d92c2c699836ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381332, "uuid": "59125c5d-824e-4b44-8525-ad71070c53c9", "comment": "Malware payload (RedLineStealer)", "value": "86fdc11fed0ba89fef508c13b01bc3cbfff47ed41b1dde1a0c896c928c382322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381332, "uuid": "e9a8fcb8-bafc-4594-ace2-0174e06359e7", "comment": "Malware payload (RedLineStealer)", "value": "b91c3ff5ddfdb6cabd99169e23d7a6c952f945cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381332, "uuid": "361ec33e-da40-4381-9d90-6d3e1a27fadd", "comment": "Malware payload (RedLineStealer)", "value": "4d6f9f48a259f06a521c3b146abf2c73a7ffe0d295769b10c5e258d6e3a825d990dc5de4f895239cbe5c4490be44b6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381332, "uuid": "b89dda7a-9c78-406a-899f-b5021f14c575", "value": "T1EBF4121BEBF89172D5B047701CF203C71936BDB05F38939A674AA85A0873B64A135B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381332, "uuid": "356a3ad7-09e7-4759-9513-087e263fb7dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381332, "uuid": "38467e5e-ffc1-464e-ba04-c83396cedf09", "value": "12288:6MrE3y908N7UOPJ62WJuwCBmUVJ1+wNgVe3FQ4VylT3BRpP/j8At+/qvyCk:ky9N/PJvNrmUVJ1+UZVApPIAGqvyCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381332, "uuid": "1638189d-050d-48b6-aa82-fe41581b6bdc", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381332, "uuid": "9c6cddd3-677a-408b-be8c-1f0ee8a5383e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381332, "uuid": "7f909846-8657-4b06-8c15-09992ae6653b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9b8ca8-acc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676417908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417908, "uuid": "5cf31886-3cfb-4139-8aa7-8a2e013958ea", "comment": "Malware payload (RedLineStealer)", "value": "5c472f3757276148300c9bd454f00e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417908, "uuid": "ee0b0352-8b04-4da2-b7d6-c8ace1b15af8", "comment": "Malware payload (RedLineStealer)", "value": "8703d34e07160e0f9b6d0342bac1786bf460e8919f0ce1c3d0a30fa79c51f257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417908, "uuid": "00a9fcd5-09f7-4727-9b78-777b346870b3", "comment": "Malware payload (RedLineStealer)", "value": "77e5208d38d6c4e30e6beeecf8b550f6325a6226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417908, "uuid": "5f553328-6604-44b4-b380-ab07cee92dac", "comment": "Malware payload (RedLineStealer)", "value": "4c2ad14f49e1b6170051723cf287d3229ee301ea71d3421dc3b176a070162953e03c3f6adf247e2e245c50b86840e39d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417908, "uuid": "22f2b964-0e78-4f92-8331-3e34ec874334", "value": "T1FCF4121BA7ECC526D87477B01DFA03D30A3B7D606738925B274E3C6E58722A4A13176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417908, "uuid": "d28232c0-2180-4a15-90f0-559a4ea256c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417908, "uuid": "f8ddc27a-2487-4cb2-bd88-0fed1213982d", "value": "12288:qMrHy90Xx0zwMqo0lZWT3v7DQbW/aB+8T64FBjAalhWKaKwWgyGkLreBCqZY84m:Jy0KX0y3v3SW/aB+8T6QBeKwWg2qS8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417908, "uuid": "d89db399-4f48-4e22-88e0-b312e2fd68d6", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417908, "uuid": "0cb1734a-b573-48e1-9a57-1a322f058f95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417908, "uuid": "87257ba6-bcaf-472b-9e66-87efe6a47b0d", "value": "5c472f3757276148300c9bd454f00e5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea977ba2-ac16-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676344994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344994, "uuid": "830728dc-696d-48c8-8f8f-580ccf0ef8f1", "comment": "Malware payload", "value": "e3a08ffb7106ece9612d3aa8078a8287", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344994, "uuid": "33009c88-9888-4c91-b1f0-58d68db8eb64", "comment": "Malware payload", "value": "87b5ba7da8aa64721baca0421a01e01bb1f1ca8a2f73daa3ca2f5857e353c182", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344994, "uuid": "cb6ddc82-1a5b-4f54-bc64-b8e3090ceed7", "comment": "Malware payload", "value": "c059eec897c48b81cfc6a6765e176cc88231c31e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676344994, "uuid": "5799a698-e9ab-4268-bb02-c7ded3bbca12", "comment": "Malware payload", "value": "3e9564faf8b968a4ee5422f2ce477777553e76e37a5d1d7adb6abf30b9baafcc9d752c84aada22bfa48a1b3c19f4dacf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344994, "uuid": "6fccc60b-c016-40ba-874f-db1d66fb8947", "value": "T10921E8DF2270B72A8746894B3D5FD0AFF414C861AC53BD18E4E84B2B751580B70CAB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344994, "uuid": "29340d14-29d1-49f5-80c1-0bdcc478565c", "value": "12:z5jn/GP3+aIi5jn/GNM+aNFn5jn/GQx+aQKQm75jn/G46x+a4eK4em75jn/GRx+T:l+KqP+ggfdM3dzHdITYODcyAd69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676344994, "uuid": "d02d3774-1455-419a-ad03-d6a0f638f3e0", "value": 1184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676344994, "uuid": "865beb05-c717-453a-ae3c-eb94c9490fac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676344994, "uuid": "055325ec-603e-4b36-a90a-5cf06aa56480", "value": "87b5ba7da8aa64721baca0421a01e01bb1f1ca8a2f73daa3ca2f5857e353c182", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc1350d-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676399921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399921, "uuid": "d9bb645d-889e-4732-aded-dd032b35c9e1", "comment": "Malware payload", "value": "7dc0294aa33a21a84b53cf3b779a9cc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399921, "uuid": "d8fc1ecb-0695-4137-b529-5a91ae91d4b9", "comment": "Malware payload", "value": "87b9b70549d830766e29b5045be0d08677e80ccbc3d1df65964f0324127c68ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399921, "uuid": "4c317f5e-49d0-4bb5-b756-e77568804752", "comment": "Malware payload", "value": "c1f1060849c7337777c4da248f7bb8f5f157540d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399921, "uuid": "760c46a0-8e5e-4785-91d5-fefbcce05f14", "comment": "Malware payload", "value": "c0f7a5eca6cd8c6787ced1a8ce46b6d18e2ec41d8dfe3edd6ea48e31f693f1c63474043e4bcdb4ac8336e07219d8d25f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399921, "uuid": "f2ccf1f2-7177-4c05-a227-2eed230797a0", "value": "T19EB4124A28089B63D93CC7F85E2668B8D371AC6039B1E2761D873DDF21317A5445BB8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399921, "uuid": "73e635f7-155f-4624-8e84-4a9e8d950016", "value": "12288:6h6q6EMiYC0ND571Vd8NremF8FirV81vawjOuuNG:6YXSQ57j4emqp18vNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399921, "uuid": "812acac7-0259-47af-b9f5-83f044e45242", "value": 502126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399921, "uuid": "da9e491a-0630-4c9d-addd-73ca0bc650ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399921, "uuid": "535d699c-4df3-4e51-bb36-d18444686709", "value": "7dc0294aa33a21a84b53cf3b779a9cc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a51566-ac68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676379902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379902, "uuid": "30375096-df9c-4d3e-9f11-354ab355abdb", "comment": "Malware payload (Amadey)", "value": "64ef29e7d8b6cc1138b782597840e65b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379902, "uuid": "bcecfc77-5d3b-49dc-ab22-ccb3b84d68f2", "comment": "Malware payload (Amadey)", "value": "88497fd776f0c4d0e4e421446b3f226da628539eb926f613583f9c893fe32632", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379902, "uuid": "b8a46d2b-d491-47b9-8daa-afd6303c27f3", "comment": "Malware payload (Amadey)", "value": "db8a595b7eded7681190e40a030dce17a7c8fb83", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379902, "uuid": "2159479e-8b86-4769-8e3d-04c60f26cc69", "comment": "Malware payload (Amadey)", "value": "13bbfaeee0cf1176783cb3f3a26de8ba28be0fffd77da5a97974ccaca3e3f954166e7cbda143f084cff7a408db13970a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379902, "uuid": "a28b151d-360a-4606-a894-6fd4295e2afc", "value": "T1E5F4120BE6E89022E8B617B059F503D30E37BD705A388797260F9C6A1873B64B635777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379902, "uuid": "1e9e0d48-52b7-4959-b046-780115072729", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379902, "uuid": "88916fce-98cb-4359-a192-bdc168355e1b", "value": "12288:/MrYy90RxrZ4MzdGrYo1NDlPcYtaaI1F341GL1k773j8AKOdLLb:zyMxraMEYo1NDQaZ1i10MAXnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676379902, "uuid": "c29da777-d61a-41b8-a204-2ae5cec86bb1", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676379902, "uuid": "0013abc1-afc1-4268-93e7-2fcac8f2bd37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379902, "uuid": "f81ca4f5-027e-4a91-b02d-eafad4d0ed17", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca5ee0f-ac82-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391356, "uuid": "a3fa8ed5-24c4-4e35-8295-10c129c91b01", "comment": "Malware payload (RedLineStealer)", "value": "fa11a94a39f8aa4bce613f6943799c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391356, "uuid": "826a72b5-7a41-49b3-9ec2-8699bae08e9c", "comment": "Malware payload (RedLineStealer)", "value": "890649fb63e5176c147307c856bfb1b98ff14e7f6063d5586ae49092c06fe639", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391356, "uuid": "a6907556-d1b9-4c0f-854a-57a563cbf26d", "comment": "Malware payload (RedLineStealer)", "value": "46377f5d2690457244ff73b9025ba69fb2ebb881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391356, "uuid": "edea542d-ca40-40eb-88b2-f090f3eba83a", "comment": "Malware payload (RedLineStealer)", "value": "13d6efedd1793fcf1c1eb1f52b8bcb3d0b313efc2bf02dd47c15da07ebcdd4ee5a4804f5fe6ebd75523c36c96e36f73a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391356, "uuid": "350885b8-4a93-4e4a-97bb-cf7cd1498a5d", "value": "T162F4124BE6FC9132E57553B01DF206C31A3A7E705638C397278AAC6D0873A74A636367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391356, "uuid": "2c455c28-0186-4dbb-98a3-8175410baee8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391356, "uuid": "e4d28d8b-96fc-43f7-8ecb-b2d857852107", "value": "12288:pMrVy90IWYb2g/BUBC2JjpJX1LFH4sh5661kyoMrUnaWYG5zR:gyGkB6DJjpJlOsq61kyoApWvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391356, "uuid": "41072135-8137-411e-a57e-0095dc2489de", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391356, "uuid": "70eff7e9-5764-4daa-9272-dfc534b6dca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391356, "uuid": "acb0d7a7-0771-4bdf-9058-120f74da4461", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c866850-acc2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676418683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418683, "uuid": "5c757ef5-cae4-49d8-b248-7c50ba8b1a0c", "comment": "Malware payload", "value": "63a9fa931fdebbd901816cef218e9496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418683, "uuid": "69d18776-4e8d-4e7b-8a59-975d58d4279d", "comment": "Malware payload", "value": "8965f23f9a25f53e625f997b270591f7901ab46ab57ad60b2ee97e4dec8a11ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418683, "uuid": "31e4d762-ecb2-4481-ba6e-b5ee2723e25c", "comment": "Malware payload", "value": "0260e2d9300c72f7c66ab922806d2b5710c94f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676418683, "uuid": "b26cb9f4-0a7c-4f41-b899-4bfbb10efd65", "comment": "Malware payload", "value": "e7b1aed3a1fb0583569372d65b98ee0faa211b58019a1176592eecf8ce87a3e73d95d95475a01e814b91047e15c3766c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418683, "uuid": "bd6b9028-4079-42b4-80a7-c0f86e99178f", "value": "T1A6252343EBF98036D876577068FB42C31632B9506E788362334F6D891C62661B076BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418683, "uuid": "760a0216-39d8-45c2-b34c-081382f56750", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418683, "uuid": "6010c116-1b87-4d7f-8782-a4d79a8a21af", "value": "24576:/y7XjygoGmkR3+tdA5dJXBchKmWmEtTQ/jLpu:K7zyHGmkR3+tdA57KAHtEnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676418683, "uuid": "8c3c73b1-0662-44ec-b4b7-8996df08e767", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676418683, "uuid": "9fc744a0-21c0-4e32-af56-105b4a120447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676418683, "uuid": "66be40dc-3152-4b51-a083-ea373bd4160c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26bf6ded-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676406513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406513, "uuid": "ad62011b-d860-4794-a0ec-c22436744892", "comment": "Malware payload (RedLineStealer)", "value": "ed73395d8b913ce4fa9d20c8aed3b568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406513, "uuid": "69bfb15f-610c-48ae-8b94-6ca18ecf5c30", "comment": "Malware payload (RedLineStealer)", "value": "8a14a2521d97e93b3ef602d1e2f4017cedb303cbc102bcd19486e7ad5c0c5b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406513, "uuid": "4064afe5-8c0e-48f2-ad80-d7b2875687f2", "comment": "Malware payload (RedLineStealer)", "value": "618ad505149e3aac845a62538970496ea7d8c937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406513, "uuid": "7e4ad297-f9eb-4031-9d69-cb6c16cba4fa", "comment": "Malware payload (RedLineStealer)", "value": "53b7bdce8a2ff9ef6c10cf1f939b6b72bd50df9b08681e63f4d5c1d340e39715ee5c2314208796c924d0404fe8b6299c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406513, "uuid": "02706a07-f653-4875-bb32-1481f3dc5985", "value": "T1E254F12239A1F1F2D01B9E75B830EB605AEF787A8751C00B235C1B6B2E3C6D14B76756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406513, "uuid": "c79aa275-bb71-46d5-a52c-a4cb8d694ecd", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406513, "uuid": "8f96d9bd-b7a9-4413-a5fd-d9f238e6a65e", "value": "6144:iLiInwov5mOXJJ37iyOrxl+KLXeET4s0J1ZeAaVdpk7K:iOInw0mO5pJOX5LXemhsBapk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406513, "uuid": "11c2bd26-fc66-44f2-a20c-fa9886c4b0f2", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406513, "uuid": "dfbf0142-3383-495c-b466-1556574cf23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406513, "uuid": "42583142-0e26-4609-b82b-91f13ca3918d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a448183-ac5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676376212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376212, "uuid": "899df5f3-91b1-4111-9dd5-a852cbde4056", "comment": "Malware payload (Amadey)", "value": "96821dfcc892eb59903c95995f9c4afb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376212, "uuid": "541b37c6-d2ea-4136-a87b-c1f13cb1b607", "comment": "Malware payload (Amadey)", "value": "8a6e412e448a3897fc2025d0fa5809885273d8b642c9c3b7cbb4af06222430ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376212, "uuid": "764cd2ed-3511-4d25-b087-d108fc2fb85f", "comment": "Malware payload (Amadey)", "value": "be478cd42eb28e7fec121332a4df8ae30ebccf16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376212, "uuid": "f859c945-1c90-4e0b-820a-fbf604a0c5db", "comment": "Malware payload (Amadey)", "value": "940115908f90157d8639b39a6e91882a00e3e5b64d8179dd7b7199a38e8d5192a96bb89baefe3d5172d745172b518281", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376212, "uuid": "2a60c76c-f584-48f0-8809-b24f586382ab", "value": "T1E2F41257BAEC8531D975637018FB02D30573BEA0AA348397274BAD290DB2A60F176377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376212, "uuid": "aa5d6ac5-df9e-4a16-84e2-76820fe06663", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376212, "uuid": "9142f4b1-6c44-48d6-9045-cfd47134666f", "value": "12288:RMroy90yYE2aCrmQCcY8oQNwfmVeck1wNyFs4K37OrfnvXMvnc11/AER19tJdO:1y+aCKQw8oQ+eMecK3iPvcvnA9ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376212, "uuid": "2a40749f-7be9-4518-b53f-b84c48b0d3b0", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376212, "uuid": "9ca9ea94-76b5-409e-a02e-bc016a215dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376212, "uuid": "c8372e62-7a0b-483f-9ad6-2d1ea0ad165f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a86a3c-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676381417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381417, "uuid": "04b77b35-2617-4ed2-af49-2af9ee9ad5f8", "comment": "Malware payload", "value": "93bf648e0a7619b5c97bf395257e8cba", "object_relation": "md5", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381417, "uuid": "daaebdea-0f7d-4f28-88d2-1236adda38a8", "comment": "Malware payload", "value": "8a6fdfe5c2802b564b6d76d02fa183c360cd1a04e9cc7e8a0589a6a4a6a65892", "object_relation": "sha256", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381417, "uuid": "55db70c6-12e8-4c3a-ae20-56e72ae1afee", "comment": "Malware payload", "value": "cb0a7ec7940bb05f2655af0a75b20f5a71199da1", "object_relation": "sha1", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381417, "uuid": "6ff51702-a76f-4b11-8fe5-1ac8e90688b6", "comment": "Malware payload", "value": "a338677dc649caafe8b6f13516e6c20e36b90fdc517a735d1dfc87b005247bdee620a1979726b5318f54d6ee5b4c4c2a", "object_relation": "sha3-384", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381417, "uuid": "a5ed588a-d372-4cdf-b152-396ec9dbdf4f", "value": "T16B374AC3F854B1A4D496E3728D2551A1BA317C8A2B31A7E71A91FF681F327E49F72700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381417, "uuid": "2365869b-6f75-4aee-b736-d659901e50c8", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381417, "uuid": "0635ce1d-16ba-4537-93d1-cd1aeba8db5e", "value": "393216:P3aL2BsgB7XPAPd3JXTofF4xnkkNTUkwfClRZOt/5srmSMY2fJvuTDUdd/M4FjpO:PK87TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381417, "uuid": "d5f76910-ab11-4b6a-b902-cde51f4ee5d3", "value": 23307776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381417, "uuid": "9d5138f5-244a-4067-ac3f-7e2f6968faa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381417, "uuid": "cb59d4e9-3c36-4982-a923-26acfa02b2f9", "value": "MsSgrmLpac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280447d-ac3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676362616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362616, "uuid": "e20ab429-adce-4c74-aeee-0190117d6347", "comment": "Malware payload (Amadey)", "value": "af989941d35e4f054ff8a62303ef0235", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362616, "uuid": "e60b293e-f0cc-4c3c-876f-bf221d040449", "comment": "Malware payload (Amadey)", "value": "8a859f3dc97a5f1be20e730162c8cbd638110970219fabe158c414cea4aa8bb7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362616, "uuid": "f618567a-c4db-4974-a664-029029c8f83c", "comment": "Malware payload (Amadey)", "value": "0243d88a55805a4daf62ee3c25825ba707a5eb10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676362616, "uuid": "2b14a6e8-d289-4f5b-a67c-b41e74c37770", "comment": "Malware payload (Amadey)", "value": "0181bd451fd76cfd7b354a14b976c12a4a439bf46d3e18a6b5138f07b896aa6a8efdff628f194eb75a2cd01646a3f5bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362616, "uuid": "afe034da-8347-43fc-93e3-cee909957f78", "value": "T1E1F41217E2FD8032E4B68B7058F752D30A327EB19B75875B234A584E1C72578BA32727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362616, "uuid": "366d7081-c00f-4a90-a085-d23212bf696c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362616, "uuid": "ac86671a-7b0c-40b6-b5f6-2d3bd03e056a", "value": "12288:MMrXy9046lIRZLUsXCDhSeanpP3Bk1DFl4Fig7NCpe0p4U74dz8ugBD:jy5QMCDUeanpPSGFP7APL70HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676362616, "uuid": "7292bd81-8238-45ab-91f7-e290e4993fe2", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676362616, "uuid": "209e5610-2cbc-4e85-b017-4efd10c2d2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676362616, "uuid": "507b26ea-6dc6-491b-a67f-eb2dd01200cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c91e8c7-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676382122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382122, "uuid": "1f6d1153-dc7a-469b-b3a9-15640e23c5a7", "comment": "Malware payload (Amadey)", "value": "35411044317e33dd1b45e9c538d4ccf3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382122, "uuid": "a7053773-5b71-47b8-bd48-18440c6f8a4f", "comment": "Malware payload (Amadey)", "value": "8b315f184f21e87e2cffeb630973021118108c76b422f1aafec3e88fd0287c94", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382122, "uuid": "096d45ed-f54a-4f81-b2ec-3672783c3de3", "comment": "Malware payload (Amadey)", "value": "d7118d2cd52df9ee15000468203300798ae5dda3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382122, "uuid": "29287791-e99b-4a80-88b9-4fe4e2f30d50", "comment": "Malware payload (Amadey)", "value": "4662949bccc6c43738481a1a5a3fff7a1ffbdf6d83a02684e0e25b7f7a1785f2250816bfb84ca7517654297c0e937760", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382122, "uuid": "47d20d66-41df-43e9-96ec-18ca57511b4c", "value": "T1E1F41247F7E9C022E8B19B7115F602D31B36BD906A3887AB175F8CA91873AB47135327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382122, "uuid": "84746c6d-7ef9-42a3-9a56-e4e6911b7f5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382122, "uuid": "4f105a95-91a8-41d4-ae9f-929d0fd9e240", "value": "12288:8MrJy90H/s45uVmCWaATb8Hp9Nrd/JqfMD5d195WiI/9qcf4AT9/XMvRc11/friR:lyeHoVmXTm9NP/DD19NIhfthcvRIW+zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382122, "uuid": "14194be0-abb9-4bb2-a980-426c6ae6105d", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382122, "uuid": "75abe63f-f786-4ed3-9e48-0cfee8e048d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382122, "uuid": "802fa28b-7904-4d15-a190-c82439d499b9", "value": "35411044317e33dd1b45e9c538d4ccf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450f5c9-ac90-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676397221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397221, "uuid": "52ffc3a1-06f9-49af-ae9f-b6431737ca25", "comment": "Malware payload (RedLineStealer)", "value": "9abd2859541e32d14f5fa42b96115656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397221, "uuid": "10e88fe1-b9d8-408a-b075-6f4b1661f93b", "comment": "Malware payload (RedLineStealer)", "value": "8b4a803c2d13eacc7554ac5d6e63e80ae7f35c7d121101335e5df03606f1e7ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397221, "uuid": "b7c30e79-88ce-49d2-be1e-401f80444571", "comment": "Malware payload (RedLineStealer)", "value": "eee3a42536616ce81a573ed06de8914d0f99eba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397221, "uuid": "ae53d623-dde9-4099-b9bb-b648d1381cab", "comment": "Malware payload (RedLineStealer)", "value": "a90a26f472b1982ee8902cc1bfc9cf39d3d112403bdeb44371fe8c1beed46f29a3d2194237eb38c0e76f586baf38a820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397221, "uuid": "4ee0cfea-64b9-423c-a869-64357de05353", "value": "T118F4120BF6E85032E8A153712DFA46C31A3A7D20A63483576B4F5D7D0CB3674A674B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397221, "uuid": "5f128b29-379c-4281-a7da-7e6f62d3b746", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397221, "uuid": "9841ab20-aebf-4985-8731-2b044c145093", "value": "12288:2MrDy90Vrvs7VgEMMhNXJorAURb9KFP4Iu6EzTvY7SwZfqgCZdvHNW:Ny4rUZgARorhRzIuD5RgC9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397221, "uuid": "ffe2eb52-c2d5-4165-8dd5-22073b54e3ad", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397221, "uuid": "18f6c833-d641-4cd0-a329-7f18350ff149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397221, "uuid": "3e48a838-3598-448b-b9b5-1091c38356fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08425c6f-ac44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676364371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364371, "uuid": "e9900046-e375-47f4-8792-0c50ecdc9768", "comment": "Malware payload (Amadey)", "value": "d82759c0ff826c95b1659e7987285bd1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364371, "uuid": "36f82153-0baf-449a-ac4a-81c3430c77b3", "comment": "Malware payload (Amadey)", "value": "8b59d22aaf385b20794549384a1e984d748224d12c653c6ec17f97fac74b3ca1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364371, "uuid": "9c9db25d-d663-4018-beb3-ddd93d18951c", "comment": "Malware payload (Amadey)", "value": "c4f72596acdfb0107402c723a66c6218310fd651", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364371, "uuid": "783e089d-672a-49ae-baed-404a0b21711b", "comment": "Malware payload (Amadey)", "value": "d5a9a14c81e9588c9ad2c5cb4d749b48fb330a70b9d0299360613a34d42f63cdaf95ae66552438d93c05f5e211de27f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364371, "uuid": "e2b2addc-9437-4255-9bcd-1ceae57ef1cc", "value": "T1F2F41207FBE94062E9789BB018F347C30936BD915674829B234EDC5A1D735B4AA3633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364371, "uuid": "674b73fd-7561-40cb-959a-a9f3560a73e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364371, "uuid": "16e07740-a57b-4abc-800a-99e9f5ff183b", "value": "12288:OMrqy90GrJV/YPHJ7W5py6W/Ou8qtvDx+JP2JCljlm7mp5Twrz1HW:cyd9VWHJ70wWu8qtvDx6P+Cljlh7wr52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364371, "uuid": "93655f15-3117-43c6-902e-e9fb1171d2ff", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364371, "uuid": "dc185604-02f6-4c33-bb83-4aad2294d2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364371, "uuid": "33d5a398-8736-45e3-9bb7-c05986a63191", "value": "d82759c0ff826c95b1659e7987285bd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adf7bd1-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676402252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402252, "uuid": "5e010904-8c77-4ac9-b33a-20e272c9f07a", "comment": "Malware payload", "value": "88031b27ecb08bbc20c809b7fd5ee5e3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402252, "uuid": "b486c1b2-9003-4a11-9310-a03737250d2a", "comment": "Malware payload", "value": "8b6246a2b1d2bf17d9e31bb330446aaa43210e5240ce436e5ba2f5ce08c6d5e6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402252, "uuid": "555d6fb9-321b-40c8-bda2-2dcf0fb5dd16", "comment": "Malware payload", "value": "ae2cc92b64d7d542695223246faca1af90a7bb61", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402252, "uuid": "21471847-d714-4d12-92e9-ecb0c0b6edd4", "comment": "Malware payload", "value": "c09f8b8d364c8e6710d083578d48f33a4f4c53f4fdfd24f9ed2527b1214f38f7f07fcc371612977c17c00c26aa116169", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402252, "uuid": "011cc709-eaae-4531-b544-eeb1089dbc50", "value": "T170456C407BE8EA27D15E5772F4A241244BF0D806B753FB4F26A8A5AD2D437407C892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402252, "uuid": "071b8250-a932-485e-965a-dbfea3010508", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402252, "uuid": "47225858-ddcb-4cce-abab-6c77a6b740d4", "value": "24576:tCaVcl5731qq27uovjgUpf7yJ1rga/v7fcsuwB:tCWSqjH7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402252, "uuid": "2e08f652-6cbd-4393-8ab8-f72371d671ee", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402252, "uuid": "22ca4805-7c86-434b-b17b-f1c0c2515269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402252, "uuid": "0f0b6d7c-1ec5-4d79-8fac-c75c9cd8d53e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71bfb2d-ac69-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676380583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380583, "uuid": "034bc464-6fd9-48ab-87b6-fbb749821ef9", "comment": "Malware payload (RedLineStealer)", "value": "60c667f706fe83097687776d2dc7a6ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380583, "uuid": "d784d2a3-ea47-4b28-9cc0-46215464b966", "comment": "Malware payload (RedLineStealer)", "value": "8b8fe0b520fe21836a8d0f9d1096ed1510b00e04c77983e059ba9b01f90b47d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380583, "uuid": "eea3bfb0-29a0-4122-9c24-7c71fdc8009c", "comment": "Malware payload (RedLineStealer)", "value": "158bb2c111fcaa0dac6a67485c38cc31cf72b222", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380583, "uuid": "e13d2abf-25e8-4833-82d8-422372081452", "comment": "Malware payload (RedLineStealer)", "value": "e1eefd6b2ca3d5f27da4b56282227302f65c65a601840a7781eec88d4afc36fbf39deae2c57430f3267f4e9f33da1ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380583, "uuid": "8d137d7a-dd43-4b24-b64f-f0ffd676bca9", "value": "T11FA40207BAE89032D8B4577058F603D309377E61AB38929F178F6C5A49735A0B6353BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380583, "uuid": "150ae2a1-dece-4e25-97a2-714487a0e8fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380583, "uuid": "06d0a0ec-75f0-406c-a48d-e0c2183858b0", "value": "6144:K4y+bnr+Fp0yN90QErwioS0w3cqfpD7/jG0nnGWxAqO5M/6CDT8w+ybdaEHCRm8x:sMrpy90uioS0TcbFnGa7OW/D3JkWPZ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380583, "uuid": "b7023eb3-3817-4312-929d-5a8193b50a51", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380583, "uuid": "cc9dff53-8f13-4425-95cf-d13b06f4167e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380583, "uuid": "15b804de-0942-4e1c-92c1-b1070bd08642", "value": "60c667f706fe83097687776d2dc7a6ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d61e50-acc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676417619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417619, "uuid": "9eb1d7c9-086e-40e2-9431-9aa1b2258c5a", "comment": "Malware payload (RedLineStealer)", "value": "e17f7cf5c6f5fd3e4e87a92b8ddfdd34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417619, "uuid": "f1c71f2b-5074-484b-abda-0fba2816cfd3", "comment": "Malware payload (RedLineStealer)", "value": "8bbd6eaae75e90db569a9f7f113f0cb587998ab8a49cbcee7be65e719b959c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417619, "uuid": "1550fb56-ad8b-4061-9be2-b8360784befa", "comment": "Malware payload (RedLineStealer)", "value": "054f58127d09878b275cdf046fea6b7325b726d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417619, "uuid": "06e71e9b-db70-4735-b000-858d390bb7b8", "comment": "Malware payload (RedLineStealer)", "value": "2d12117c4dfbcbcbb1df8e80f8171e176751e687983efa3674e5521bb3ab9e1c1949ee0f0e332c8941400ad1d2aa0f41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417619, "uuid": "b35d56d2-60c4-4245-8224-fdc34045f3e0", "value": "T147F41247ABECC136D4B46B7418F503C30A36BD609F35836B224F9C5A1C76AA5B23536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417619, "uuid": "34344c9a-204c-46e1-a0f2-13e04bedff6c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417619, "uuid": "b26f9a08-de9d-45b2-a838-b30eed2e4084", "value": "12288:NMrpy90yZZW0hHdJpbRGA4UhXw7zM9m0x9PHMWHaKxWynAGmWHp3MKdzfQ3:cyj+05pp4cXUzM9muqKxWyvHVMKe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417619, "uuid": "ab7ec43c-52c2-4ab1-8c7e-8f49358c5631", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417619, "uuid": "b2597a82-8bc4-4a33-8b86-21f351f93e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417619, "uuid": "2021efb8-5503-4c89-a63c-c383695a46fb", "value": "e17f7cf5c6f5fd3e4e87a92b8ddfdd34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78db640e-ac29-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676352963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352963, "uuid": "050bb8a0-d20a-45ab-af74-a667d5fce688", "comment": "Malware payload (RedLineStealer)", "value": "0eda887d6d9d00eb813d71bca61c1587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352963, "uuid": "6e082298-16ea-489a-94e5-16a800dca82e", "comment": "Malware payload (RedLineStealer)", "value": "8beb84f7196d0ac0c0caed4f75a250a899b81931d8577cd2e4f3db54ff68b59c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352963, "uuid": "ce020981-aad0-4a21-93ab-2c110ef088cd", "comment": "Malware payload (RedLineStealer)", "value": "83d677b73f94ff43f82bbde8196c6135799b2d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676352963, "uuid": "c29cf89b-d417-4628-a51e-cc932051e8f3", "comment": "Malware payload (RedLineStealer)", "value": "df26600ba49cc5ab9ae0574bd0a229474d14977f4df47209b31d2a7866673c39a93bf3cffe821ab95a12ab137fcb1917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352963, "uuid": "66ef5e40-8efb-47dd-8e68-102ec10dde8c", "value": "T18CF41207F7EE4121ECA597701CF647C30A327D509A38839B678E4C591C766B4BA7A32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352963, "uuid": "fa0f0d18-c111-4ea4-bbe1-454943350c50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352963, "uuid": "d73caf3f-a655-41d1-9788-d042fd630a46", "value": "12288:SMrey90z8+zLL9I1V6hDLHGtcYqHZrYFG49xbqy+jvmNaaunrnBMdo7uRZ:EyxmL06dGtcYUpo9xcjr51Io72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676352963, "uuid": "d6fef57a-5ad7-4a15-b601-63ab24e930f1", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676352963, "uuid": "4f2a87d6-7372-4c6c-accb-ba02a4a80cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676352963, "uuid": "b1cec688-8c47-45cc-84bc-9581fe3e06ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10156309-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kovter)", "timestamp": 1676350640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350640, "uuid": "a07f1bc0-807e-4325-8cdd-2a618afe152c", "comment": "Malware payload (Kovter)", "value": "acd46f88a6f90143090c342c10544ccf", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350640, "uuid": "a45f9c3d-11ef-4f2d-9a44-ee48a78ef71e", "comment": "Malware payload (Kovter)", "value": "8bf1319fd0f77cd38f85d436e044f2d9e93e3f33844f20737117230b73b60f6c", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350640, "uuid": "f018df5b-e8c8-4fe4-a6b8-481b41585c83", "comment": "Malware payload (Kovter)", "value": "bb90bed3b0d747feeac32536d75c6d153b34be0b", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350640, "uuid": "66ebd0d0-d9bf-476c-9df1-02d15f786d50", "comment": "Malware payload (Kovter)", "value": "4e03becb60fb2267fdf59bfda430f120f5d3da7013af2fef0a9a2e658fa6362500bad839eb1b2d23e42d73c684197ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350640, "uuid": "b724ea20-7ffe-4b39-9d07-15e1b7af0784", "value": "T136F54A157784CD26C07E07F54863D2946231FCA39E2346AB35F0B72EFDF56804DA2AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350640, "uuid": "fb298428-8ce1-47ad-a903-1f6fb540375d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350640, "uuid": "476bebd4-32e9-46c4-a68c-7da04a364900", "value": "24576:v54IAnWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKI:CIAWjdAp1PagjLuSh3i+FtvkMzT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350640, "uuid": "4ac916c9-73da-4446-83ba-353aa364b35b", "value": 3438608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350640, "uuid": "6ca9c316-c17f-4407-9d38-e2d16235f7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350640, "uuid": "f5ecc52d-ebaf-4b27-a897-813785aed69f", "value": "2023-02-14_acd46f88a6f90143090c342c10544ccf_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758eee4a-ac86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676392901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392901, "uuid": "0898b22e-b6fd-4b5b-96ac-fbe9faeec9b8", "comment": "Malware payload (Smoke Loader)", "value": "a8092c9154d78434533d5b5e6bc10100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392901, "uuid": "0ffe83dd-b4d9-45bd-af8e-48f1f68e7aeb", "comment": "Malware payload (Smoke Loader)", "value": "8c5716696984dedf4f11e3c3aae1b86e94aec2594587a168a14d3d7032170135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392901, "uuid": "47c6c09d-f38c-4af3-a90a-3fc0a1b1eece", "comment": "Malware payload (Smoke Loader)", "value": "d7d60ddbce4379bf2d81e25f36ddc3c1cfe1040a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392901, "uuid": "83602321-a144-40d8-bb1c-032426c76d42", "comment": "Malware payload (Smoke Loader)", "value": "d65191162aae3dcd9bcd12abe196f3d73bdcfa3a3be0c8294fdc9a421909eecf629709836b76e4c07430727e968cf9ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392901, "uuid": "d3139f14-0c46-4046-82d3-f464a676e795", "value": "T1B504C01333E0E473D5A216329D69C2F53A6EF8220A75968B3794EB3F0E702D19736395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392901, "uuid": "6772a2e4-25d4-415f-9eab-2ff30739b4c1", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392901, "uuid": "673b67fc-5f24-4e26-b3e6-23f4543678c5", "value": "3072:/omQ0u5DnN/PTx9TL8/IYF2RCc6geWkYdIAXnHKBPouE88l6+f:/VQvN/PTx18/Ik2AcTePYuQnIQuil6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392901, "uuid": "d0b79212-6a0a-4b18-8b0c-85fc235627e0", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392901, "uuid": "a0934d1f-d336-4164-aeac-3546eb422a7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392901, "uuid": "8e6bd3b6-b76b-4f12-9744-16f0e3affaa2", "value": "a8092c9154d78434533d5b5e6bc10100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e45202d-ac64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676378313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378313, "uuid": "479e6c00-d1ee-4122-86d6-e3c474d965db", "comment": "Malware payload (RedLineStealer)", "value": "ec989fb39286930c84700417dc1e513a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378313, "uuid": "d82a08e9-9d30-4927-b8ea-7af9ccba2582", "comment": "Malware payload (RedLineStealer)", "value": "8c7ba35a63e61f99cf2630a2457264780383bfc6d82daf5f3fa45f7a154547d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378313, "uuid": "074c1d36-9fee-4e21-b5c7-0ee9da490462", "comment": "Malware payload (RedLineStealer)", "value": "99c1971ed621a291c013c7c6ed295f3319839402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378313, "uuid": "bdcb3b23-652b-4f17-a89c-208db36f8f53", "comment": "Malware payload (RedLineStealer)", "value": "f02554d6e4b69ce8d7e625d07508a795785c86d92cdb150756107d91bc1037335d49a760d4c32bd41f0232ea7ea327f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378313, "uuid": "cdcaf4c1-34ad-4873-8ff6-05571388d3aa", "value": "T160F4120BE7E89422D8B18BB059F213D31A36BE605F39878E635FDC590C72650B63476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378313, "uuid": "c0604795-1132-4025-a0ce-a30840c73e0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378313, "uuid": "298cfbbc-66ff-4e6a-a240-dcdfcfc7d9c7", "value": "12288:oMrLy90Zkp4J/S7SovuQyVdFq4PiwxPSgYgoDj8ASX0EZdJ:zyOkp4JxovuQANPj8CoMAmBZdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676378313, "uuid": "192b90fd-6e25-44e5-bc38-df17b639e845", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676378313, "uuid": "92d0d642-7605-4367-ba75-72edcbe981cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378313, "uuid": "2d20f785-a30b-4c98-b995-05ebe8f60b70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5093982-ac40-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676363023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363023, "uuid": "4851a18a-ec7d-433e-9f47-b2373678955f", "comment": "Malware payload (RedLineStealer)", "value": "9c257e63d4451aca104923a2aad6309c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363023, "uuid": "42437899-f8d0-41b6-a52c-f91b171a1bb6", "comment": "Malware payload (RedLineStealer)", "value": "8cd5ecd704a00c5d31069cd26be7bbba059bae826677787d6689d2b4eef03097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363023, "uuid": "b85c7f67-34ad-44dc-8c24-8ca17044cb6d", "comment": "Malware payload (RedLineStealer)", "value": "6fe8ab142bdc4fb69f4e01df3b48632fed75f083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363023, "uuid": "23503cd4-6449-4705-bf7d-76d185e21e30", "comment": "Malware payload (RedLineStealer)", "value": "3e5c07fa3263acbb9d756615011c9acb479cbdce17320f3bd29f68a789d8905893044136baa3d116e36bc89f5534edf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363023, "uuid": "9a881b2b-85c1-486d-ab57-8d41544ca283", "value": "T1DFF4125BB3F88032E8B547714CFA03D31A36BE614B38C39B668A5C6A4C72574A13577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363023, "uuid": "9cd59dd0-9a1c-4c98-9f9c-07b9e2296eed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363023, "uuid": "47d5ce7d-8750-46a8-a3c6-228970dfe979", "value": "12288:/Mr3y90DeWKfb3S7D/rsgoHrJDjy74Ff4PwGlgJwMo3I9L7sTz/D+py:8yFWKfbC7D/cJ0PVH7Y17S/D+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363023, "uuid": "7409bab1-4070-4f61-9c1c-1328401c743c", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363023, "uuid": "2ef4e3e0-bd1a-49cf-b98a-e3e0fa9489f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363023, "uuid": "e8fc369c-129b-4a22-bde7-ce66bacddfbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006155a3-ac4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676367364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367364, "uuid": "ee56ec7f-c214-4b44-9241-9a630c372b6b", "comment": "Malware payload (RedLineStealer)", "value": "e4f18bf16ec83aadc467840a43d24f43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367364, "uuid": "adea6cff-fb7c-41b9-955d-2851409c8cac", "comment": "Malware payload (RedLineStealer)", "value": "8ddc703be06eb9dcff06322321f9a99ec09f2fe7b5c4be11a7250c58302509de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367364, "uuid": "2e65af9e-213e-4f81-9cdd-1f94c98a127a", "comment": "Malware payload (RedLineStealer)", "value": "5d7d4d6728ad566a4bbab62abf71b8d2f422e4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676367364, "uuid": "94450446-4c7a-41f3-80ff-31207534c11f", "comment": "Malware payload (RedLineStealer)", "value": "073dee240f1704a58059771c6548cd34e9fc17b4674ced8f9f156a195974d75495332bfd4ffb5f70a961ce53e4cfe11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367364, "uuid": "b7ad97cb-762a-4d36-99de-1363a1d08647", "value": "T11BA40207E9EC9422E8F457B01CF602D30539BD616634975F234EAC5E08B26B4B63677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367364, "uuid": "9106b6e6-009f-47cb-a120-40e9f44a26e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367364, "uuid": "7f14e4ef-1d04-46a5-8c9d-f698a2010ec9", "value": "12288:hMrty90UdCw+uZGcm87iTOHxu4FEmA0DpbSiWTYC3:0yzCw+ucchiTIugA0QiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676367364, "uuid": "20812d25-796a-40d9-b196-11a25cbdf187", "value": 480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676367364, "uuid": "54b0c7b8-5516-4947-93fe-5ed7edae44e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676367364, "uuid": "eb231f2d-625a-4550-9e77-1f9b86905951", "value": "e4f18bf16ec83aadc467840a43d24f43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df5fa6a-ac9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676403196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403196, "uuid": "2028ddc9-db51-46a3-960d-d91b93d608a4", "comment": "Malware payload (Amadey)", "value": "195dcd448e11a56b72dcf965fd931996", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403196, "uuid": "d24de6a2-a7aa-4564-87ff-0678d6162a7a", "comment": "Malware payload (Amadey)", "value": "8de4b51dc58ed65d401eebdf4c8a0834b6dd442c2dab5ce6e4d51897432ecac3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403196, "uuid": "e5f1e51e-8913-4350-9522-c3ff6dbbbfdf", "comment": "Malware payload (Amadey)", "value": "2a8319fb535d4e0b8cc3c0f8c5888ade90384739", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403196, "uuid": "58a4ea37-6875-48cb-b202-8d7720928a95", "comment": "Malware payload (Amadey)", "value": "4a285b5ffb218037ae7bd600ab8bc736960a31db3e61ec4cb7c8bd7c7205c7da6b400e4a5acdd65187cfc43dab11b81a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403196, "uuid": "02c982e9-2c45-4030-9e49-11ec5df88089", "value": "T1FDF41207E3E88071E9B12B7029F703C30936FDA1A639C79B134BAD9519726A4763536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403196, "uuid": "98b99c81-cd2e-48a0-8f01-15ade6322330", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403196, "uuid": "de94acc6-d086-4e99-81dd-0f366f9368f8", "value": "12288:5Mrcy90W68GVqIdPh54y4YQFUp2pbiJCNUrMD5vlA59CgoTp4BUao51tzQ89cpm9:pyr6bVqm4y4JFThiJQZDJlAiZao5DzQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403196, "uuid": "c48bda22-cc90-4495-a2ff-fd7d96f5c7fa", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403196, "uuid": "7e1a522a-74ea-49d1-95dd-83c5aa8d7cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403196, "uuid": "334aea65-f150-4e11-8f30-57f8857f43b5", "value": "195dcd448e11a56b72dcf965fd931996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e6ae58-ac87-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676393435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393435, "uuid": "8ec42fc1-0ec7-421d-8319-fb89a5ba3457", "comment": "Malware payload (RedLineStealer)", "value": "b0e7c98018c703c577f4b5ef97693ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393435, "uuid": "3e21139c-66cf-4ad7-af80-cec2e7acdfae", "comment": "Malware payload (RedLineStealer)", "value": "8ef16cddec164c6ccb980c89a83d5f6c70bc89c2719ebe1d55b68d199845373b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393435, "uuid": "4d361df8-4daa-4164-a5e1-05cfec7334e5", "comment": "Malware payload (RedLineStealer)", "value": "e5c965393716a5ff402e570558ebf0359137bfe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393435, "uuid": "be6e35b8-17b7-49c3-b0bb-933cfca26bb9", "comment": "Malware payload (RedLineStealer)", "value": "ed7680315ab998273868ef74ca3a751c82566c1cbd7709384c0c8fcb0c318fdb099b4b80b41f2e81ecd0ffaed819c713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393435, "uuid": "78495197-ea1f-4e75-bd89-96aee8fbe1bb", "value": "T1B1F4124BA6F89132E57557B01CF603C31A33BD605F75825B638E4C1A2C73A78A634B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393435, "uuid": "3d3ec30c-8f14-4629-a94a-c29b04209ff4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393435, "uuid": "cd87a718-3157-4e9d-a50a-d026a87322b0", "value": "12288:nMrhy90RYPk/dNW+PVdTAma2lvbQiFM4iqGdqZyltC3ibr1lN:mybsd/PTTA3cvbri7DtC25L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393435, "uuid": "45467480-310f-4edd-81d2-f418ae6558ae", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393435, "uuid": "2e3c401c-aaf2-425a-9bb2-1980690a850a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393435, "uuid": "1c35262e-c56d-4955-9888-09b925d7919c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951b5591-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369332, "uuid": "c3ff5e21-3cbc-4ccf-8203-1e030232cbe4", "comment": "Malware payload (SnakeKeylogger)", "value": "dc41567f1622889f498fa7e593d1eb3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369332, "uuid": "7dda7e0c-f920-4260-85dc-07db365aafd9", "comment": "Malware payload (SnakeKeylogger)", "value": "8ef98d00c944e13f6a8218128dd5ab1c6d4cab97d431a4bfa0e8c99801bd9df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369332, "uuid": "c189c653-ff11-4cc3-a1b3-47794e5f8f38", "comment": "Malware payload (SnakeKeylogger)", "value": "e1b99555d640baf5e2633f139c56304572638b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369332, "uuid": "1e2f3b34-d0e7-414e-8a0e-9f87dadf5b31", "comment": "Malware payload (SnakeKeylogger)", "value": "52fc4c5db32870ff0eed413e662009c1513d2e7a0e29b5d1cb73b4fea051db11894240d10dfb0fde98a5bd5f2a81cb4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369332, "uuid": "be5e481a-2527-4605-8a72-c362a214d19b", "value": "T176441204F2B4D493E8D74B31ADB92FA3BEF062121471575B57428A7C3A3B690DA4E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369332, "uuid": "056355c2-b4eb-4ff6-9dcc-61dee9580498", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369332, "uuid": "5294ca88-eeae-4d01-8585-39d05127cd0f", "value": "6144:/Ya6glsP7gkQSmSCOXezU7EKloUezvuwKCKiGgZH:/Y+lGbQxxOXqU7EKWLvuw+g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369332, "uuid": "fa1e50b8-96f3-45ab-afc2-8ac2145e9ab0", "value": 266419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369332, "uuid": "e7302fd5-92ea-4534-8df6-51765dcde896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369332, "uuid": "ff343f43-7be0-4866-8e60-f05a744ba3a3", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aacd7672-ac9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676402010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402010, "uuid": "98960ae1-d7a5-4859-8e10-7d48b220056a", "comment": "Malware payload (RedLineStealer)", "value": "e127bec067f77fab0cab89a2b2b55a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402010, "uuid": "965ca17e-b947-4ead-894a-ae916533c6f9", "comment": "Malware payload (RedLineStealer)", "value": "8f1c9c6ef74cf82007544de94875bab29fbff550d50c906dcccacbd288c32915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402010, "uuid": "ee962181-724c-4a5d-85bb-973e782e1a57", "comment": "Malware payload (RedLineStealer)", "value": "c88fb067f534f50a494eb2598966ce7d18bb2e5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402010, "uuid": "8b7daa26-2843-49c3-a67b-cf77d9d913b9", "comment": "Malware payload (RedLineStealer)", "value": "f8638480e79ea4296327f1c4904458eddd373ab1deda89da5a27d3971b76b497eeeb029601f18cb919e41f2265ffd505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402010, "uuid": "ffeb7d4a-64bb-4e6a-8e2d-82aaf4fa9b25", "value": "T1E7C5CF0074C1C432E873153389F8D7B99A7EB8200BA559EF67D80F6E8F217D1EA35666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402010, "uuid": "f45390e6-9f26-4804-86a5-619e25f74132", "value": "a0df761def5e2d5671a380b13ea87cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402010, "uuid": "212c5449-dc94-4549-90b0-7aa343ed13bf", "value": "6144:dnpp655BSQlMVr1Ckmp5RNG0AODI/trtyQFyHjVl3NLXh6GaGQYJ3LVWS:d3655BSQlMVInGVwQcDj3d4G/QscS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402010, "uuid": "d36e48d0-1c30-414b-b582-da70cb36a10c", "value": 2621440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402010, "uuid": "c42fb47e-0788-4dc7-b863-a6767a2da2e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402010, "uuid": "0c02d62a-5cda-406e-b6cd-f4f5e944bce3", "value": "Set-up.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd266aaf-acb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411597, "uuid": "3f08baf7-bd57-4d4c-8983-07882cfc9a23", "comment": "Malware payload (RedLineStealer)", "value": "da74bc8136079e15f88523d4299a9fe9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411597, "uuid": "70cf9b4d-26f6-401c-9683-d830671262da", "comment": "Malware payload (RedLineStealer)", "value": "8f318d927ec360b7c0253704bdc6f688273a4bbdae88b14366e4210c94e36203", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411597, "uuid": "d7daa617-14b5-4e60-8c6d-1b3e7c7902ad", "comment": "Malware payload (RedLineStealer)", "value": "8fae60c5e78efa616f39ca1535f1c5f3c6596de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411597, "uuid": "5b9fb786-cc39-4599-9189-ad56656b1ccd", "comment": "Malware payload (RedLineStealer)", "value": "85575193d9a36d333fa4408cde6faec531d1d5e43c18ab1a54cd991c47a09b317f5233db36b8c2e4a9463ace7f91783b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411597, "uuid": "9644e02c-0c8f-47d0-96c2-8030a23ee492", "value": "T14AC40207D9ED8132E8B5177019F712C30A3A7DB0AA74839F634EAD5A18F2661763532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411597, "uuid": "d7bcada6-1da8-407b-8133-7aeddf8ead18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411597, "uuid": "ad014ed1-a948-4842-b395-33ef9d7b3f60", "value": "12288:+Mryy90YkitLXYWgUl0OhefRvTtfsh2E/d1oCq:IytksrsG0FDER/PoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411597, "uuid": "701602ba-255e-49bb-b581-f87a29d7ee89", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411597, "uuid": "efe5089c-1ed5-4b71-987b-3c8f1fccb7e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411597, "uuid": "78e09332-bc92-4e40-a4ef-82497cc93a9e", "value": "da74bc8136079e15f88523d4299a9fe9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcfb4b8-ac9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1676402582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402582, "uuid": "a430a9df-c420-43db-83d0-9e438366dbf5", "comment": "Malware payload (Vjw0rm)", "value": "f9adb1451b03a65ea245677dd394fc0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402582, "uuid": "ddeccbfc-cd7f-4a97-8c88-049acd4501cf", "comment": "Malware payload (Vjw0rm)", "value": "8f5a6d4e7058dde1ab46efd1497b6d49e702d2d627a5cdef9a71a0e7ff40dcb8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402582, "uuid": "d208f0c1-7503-49f3-a015-342967dcbc39", "comment": "Malware payload (Vjw0rm)", "value": "ecd4244677b57f8e154eb1ee62067c46d0fab3b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402582, "uuid": "bc97b890-0f61-447f-950a-4a41fb6d8481", "comment": "Malware payload (Vjw0rm)", "value": "38085734eaf4a6f538ad3273f33d34021d13a2834cf13eecfa87bd26fa4e97228b1f1e3d3d4decf0778704edba9aa2b5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402582, "uuid": "08c0bf7e-a243-4ade-a044-db196e954cc4", "value": "T11A811F9C284B963C53D27B8B802DD148CDF548B47E28D2B6148CDAC5360E979C7B69BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402582, "uuid": "323cab88-1180-4b5d-b70e-734de6dd31ea", "value": "96:SABNo5Dqk2c24ZRMHXE6/BIg+Ys+fJHDdQqR7bJyKhkOS4UK:zSz2c24ZRMlBIDYs+fJjfRfNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402582, "uuid": "4ea42b12-a349-4cf4-ba88-08ab36fba0ae", "value": 3874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402582, "uuid": "bb5d44ed-1471-4fe2-a38a-4a691acfdfdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402582, "uuid": "f620f737-8812-4e08-b7ed-8bb6d74e73f0", "value": "Invoice0214223.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48109f78-ac35-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676358036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358036, "uuid": "5273fb34-fb55-444a-a5d8-69b69101ce0c", "comment": "Malware payload (RedLineStealer)", "value": "cdfade87d970684b84a65bd1a50aaec6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358036, "uuid": "e1d04b08-f33b-422b-bb52-6f9e74ba1ab0", "comment": "Malware payload (RedLineStealer)", "value": "8f880c14672cee55f91271d01ab42f59b69ac2f402120e468227bf7de5cc982a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358036, "uuid": "5e9c0656-51f3-4ae1-84cd-c519a44319ad", "comment": "Malware payload (RedLineStealer)", "value": "a4f9e6a8f6a60fc06d9cb698d44c59634fa53799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676358036, "uuid": "9b5e8985-8acd-48cf-8ef4-e75ddb689d00", "comment": "Malware payload (RedLineStealer)", "value": "60fcf267eb7a7021e430c9a08deecfa0df23f580cc78b37f94e76daf8d42c70d657f4449bdba924046d3ecb0abc03363", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358036, "uuid": "243576ab-43d1-4308-a247-78c81c20e76e", "value": "T15AF41257E7ED8070E8B55FB018F642C30E367EA05E34839B235E9D5908B2678A23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358036, "uuid": "80f30585-310d-48c2-838b-c308d8316df8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358036, "uuid": "7361f692-d3e9-4c11-b27f-0be6a5583bcd", "value": "12288:HMrty90zRyVCVGdNPD2OKuG1aEPj23nNTFU40vg9vTJGSijO3IR5P8T:+y9VHdNyOLWaE6dZ0viTOO+5PW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676358036, "uuid": "17e816c4-7cbd-455e-a50b-669d3f23ae27", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676358036, "uuid": "4ab78f23-ef9c-48dc-b85c-6b35dae1b945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676358036, "uuid": "203dbfdf-f205-43be-a493-3a98ce6edc00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049b1a80-ac76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676385840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385840, "uuid": "7469ab8f-4a4b-4ff2-a0f6-245331e97bce", "comment": "Malware payload (Mekotio)", "value": "85b9bb33403a1cdb5f39ca2b3447c63d", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385840, "uuid": "00c74665-ae96-4aaf-9396-9ff8ac603c0e", "comment": "Malware payload (Mekotio)", "value": "8fb638acce77d9ffa18ec67aa89d3363166d97770de21f022e363e7536f0dfaf", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385840, "uuid": "f929d0a3-daeb-4088-90a4-4eb626ee32c2", "comment": "Malware payload (Mekotio)", "value": "0a88b47926a5ce20f4b1d08ac948698d5334c045", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385840, "uuid": "55e8af38-864c-4bcb-bf8b-438ad9cd3d5f", "comment": "Malware payload (Mekotio)", "value": "239e9cc951c450aba7d3837b6dd2ad28d20ff39cc390e91df5811b4c9be27dda1b5dc92bf6ca2e6cc79febe14dab8366", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385840, "uuid": "30e6cfe7-b766-4ce6-92a4-c5c3b18bb379", "value": "T10C8633A3813551E346F9CDA15CA8E1BECD8BBB570A78BA379736D81EE30744D1923630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385840, "uuid": "28b98cdb-8d41-4b24-bebd-eb0ecb4da8f4", "value": "196608:CSHGmlvPxR7dytlv8XmPW/8gcFO17ovY/o:5mmlRJdyvUXpdovYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385840, "uuid": "fad2e3ae-5162-4650-b669-89d7d8dcf6c1", "value": 7986786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385840, "uuid": "8fcfcd33-b8b1-4dff-8868-dd1826649086", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385840, "uuid": "12f4d015-11c3-4615-8a93-79a1eeb7f6bd", "value": "ID-FACT.1676385535.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db0071c-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676382124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382124, "uuid": "599e1539-7f99-4b2d-9c1a-576f3c67af75", "comment": "Malware payload (Amadey)", "value": "a7b5ce8fdd08e00e6ea8f857dc56bfb9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382124, "uuid": "df193d6f-361e-4731-895c-fa99e8f3baea", "comment": "Malware payload (Amadey)", "value": "8fd74b036d0f3679f2546730143f496017eafa6202d6296758da51fe5c319816", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382124, "uuid": "b79faceb-1567-42ea-975a-97ba1ac4c854", "comment": "Malware payload (Amadey)", "value": "db3bb1f2216769b956cc81b6bd1a4374c9daae68", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382124, "uuid": "239f7ce8-b14d-4d10-b52a-60929351a5a5", "comment": "Malware payload (Amadey)", "value": "e849e9eb5e97cefa7c7f7207be05761c5f6576a6399af67f29ef1f0cd7a83cd34537c77615efacb70f765d58c67d6fb8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382124, "uuid": "b13a3b5f-e817-4aa6-8e20-09f3d38e7c65", "value": "T184F41217FBDC9172E8B0677028F602D30A36BD5197788297278BAC6D1C72690ED7472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382124, "uuid": "19eba99c-7c2a-47cc-9205-794174fc1f94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382124, "uuid": "a74b7935-a657-408d-81a2-ec5579c6c961", "value": "12288:KMrIy90OkTnCXjFothEeIx8jsqmFvD8lJ0Kvnw1YoXMvuc11/vLF9NObHnEV:6yKTYotHkFvD830KfwaocvucFqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382124, "uuid": "739c7e37-ff0b-4cad-aa15-2449a1142273", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382124, "uuid": "fecbedf7-6a9f-4897-9a71-2479ae5470d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382124, "uuid": "76d06e4b-7f47-4fe3-8149-f42526973ab4", "value": "a7b5ce8fdd08e00e6ea8f857dc56bfb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae864cf-ac5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676374844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374844, "uuid": "d050d7b6-89f5-4af8-b173-550996fb7f3b", "comment": "Malware payload (Amadey)", "value": "e6d7c428cd8279ce99e41aae7f811957", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374844, "uuid": "84f48ef8-e5c3-4222-9714-b7f95f3f813a", "comment": "Malware payload (Amadey)", "value": "9007df1a8957ad00924e6eacb7e14da9276aba8762f171ed2a0082b60907222d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374844, "uuid": "56b0825e-437d-4dab-89f2-29bb9b97af5e", "comment": "Malware payload (Amadey)", "value": "feac57a85c714f540be1b3e4c0f6e98cae8831d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374844, "uuid": "d2c239ba-072e-4d5d-b2af-0a16ca928e18", "comment": "Malware payload (Amadey)", "value": "5cd2c7bac41007d5058ef77792c8e3aadcb32ac39c109ca693bd4ff032e72c6fbcb7643fe9ab31ecbf93b651358dc4b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374844, "uuid": "b5db96b9-c4b3-4dcf-a847-77f542174a6a", "value": "T1CAF41213FBED9022E8F5577009F602D31A3ABD601B3982A7678F9C5A0C73664E578727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374844, "uuid": "6ceb2d19-3422-4cf5-844d-5c3d00e08ede", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374844, "uuid": "21eda9b6-ac46-40f7-8274-a0ec73d61cc1", "value": "12288:yMrty90XzPo/Kjjr4bjm5zuQXv6Fg4xLCKjkXMvvc11/7oIYVObIn9sh:PyACW5zuQfSxLdIcvvjvq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676374844, "uuid": "302f188a-791a-4eec-8afd-77c0b1cb247d", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676374844, "uuid": "bd6dbf54-e944-4c2c-b2b5-2acf01957323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374844, "uuid": "1b997cd2-413d-4284-a55e-d314c2b08727", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de38c93-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676363280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363280, "uuid": "59c33457-367d-47cd-9a2f-41ff6394ba72", "comment": "Malware payload (AgentTesla)", "value": "bc5fdcb3e3463f2da149716bdd8fda26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363280, "uuid": "8ac26e66-472b-453b-aa65-f8227d3cc57d", "comment": "Malware payload (AgentTesla)", "value": "90a7021a37bf8c03a2b58504bb28ea318d99eba85063bb6777ea85998c08dc2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363280, "uuid": "0db3ecde-5bc2-4f86-93ee-cebdeaf2104d", "comment": "Malware payload (AgentTesla)", "value": "05d19a48e0c1534bd56bb20aabe1d38b26af1939", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363280, "uuid": "60e4b7a6-bb4d-41eb-b6f3-8df06c45cca3", "comment": "Malware payload (AgentTesla)", "value": "00611f69ff68a4561f73b904c091225872088a63a6a9c2b4064d0da02e719f2fd08fe3ded75734df433b9edce39a6b8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363280, "uuid": "63b825de-399b-4889-a24e-3d8306ae3bb8", "value": "T1BCC41255770A9277CBE84CF428A163955FBA77393000E6CB4C8D6B9D2BC678903807EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363280, "uuid": "eb38962b-8c57-46e7-b14f-6c25160f82df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363280, "uuid": "80ffe971-39f6-4679-a72c-bc682015d04f", "value": "12288:5NFFZ6aT82evSHuiUG7sOl/WSlnnvKCeK4s3n7o8EAoXvB39L9:16aT3e4uiUG7tlnnveCsMo/BtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363280, "uuid": "c78dedcb-7392-4e57-9c1e-550571cc973f", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363280, "uuid": "dd2712fc-b5b3-4442-9ead-068416fe9633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363280, "uuid": "8bbb2d99-10b3-4d5c-8e05-5fa0e08424ea", "value": "Zap\u0142ata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a02e58-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676375480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375480, "uuid": "625cd905-efd6-4ede-bf27-6ebeafd3fd39", "comment": "Malware payload (RedLineStealer)", "value": "16da0007e0acda7e8616a5f5117f96c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375480, "uuid": "201f693c-f99a-4e2e-bc9d-8311434e5acf", "comment": "Malware payload (RedLineStealer)", "value": "90fa06d26f9737a9e1b0d205c754e6f1aa60fd5fbc172db4e109056fb95a5ed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375480, "uuid": "2a01bf0d-f553-43c2-9b9d-f5ece6114b4f", "comment": "Malware payload (RedLineStealer)", "value": "902474d9b8eea879f71ea595010c034a5d36cabe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375480, "uuid": "e0e864ab-8019-4bfd-be7c-89a1658d0543", "comment": "Malware payload (RedLineStealer)", "value": "e9de9214ce888099ba076840180b13d3ef7414c1ebe41b3b6416f9ab678c2c26b1ce4bce56ae2db701a42550713ea45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375480, "uuid": "cc843082-dc0e-4129-8649-f8733ec905e1", "value": "T13954D007E6E88123E8B567701DF203C31636BD615A78828B228F6D5E1D726B0F63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375480, "uuid": "a45e2dca-ec25-4d15-b5f8-5dc8c2c58bb2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375480, "uuid": "ec987fb8-ceb6-4c66-b7f2-aab5011410b6", "value": "6144:KZy+bnr+Vp0yN90QEyCX8Z437uebg8/Udiv:jMrRy90wdsdciv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375480, "uuid": "bbeced18-1c55-4e0d-b343-dd4ae388fd4f", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375480, "uuid": "401e4681-fd52-462f-8247-31db2652fbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375480, "uuid": "9bb77dcf-4d97-4974-9bea-5c27f2000327", "value": "16da0007e0acda7e8616a5f5117f96c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62960704-ac41-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkBit)", "timestamp": 1676363234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363234, "uuid": "3d052999-c375-4ad0-b1b5-83ecfc3d46a5", "comment": "Malware payload (DarkBit)", "value": "9880fae6551d1e9ee921f39751a6f3c0", "object_relation": "md5", "Tag": [ { "name": "darkbit", "colour": "#02D6FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363234, "uuid": "104516e6-12df-49ec-9c12-ab5e5cd570f2", "comment": "Malware payload (DarkBit)", "value": "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff", "object_relation": "sha256", "Tag": [ { "name": "darkbit", "colour": "#02D6FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363234, "uuid": "daaa8e41-d3a9-49b5-be51-a36052fc31f7", "comment": "Malware payload (DarkBit)", "value": "30466ccd4ec7bcafb370510855da2cd631f74b7a", "object_relation": "sha1", "Tag": [ { "name": "darkbit", "colour": "#02D6FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676363234, "uuid": "c4f8c217-6b10-4904-927a-d0df74ba6ce3", "comment": "Malware payload (DarkBit)", "value": "bdc890dcc0e752dcc899a48037e6b54ce4a7de5cf47e56f18d79e9597d9071c9099d8d228f2a4b6f03f5d28be4553fbd", "object_relation": "sha3-384", "Tag": [ { "name": "darkbit", "colour": "#02D6FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363234, "uuid": "f05da771-5cf8-4032-8836-bf3214062186", "value": "T19C460743F815F2E4C49BA1798E2166E07631788A2F32B7E71A91936A0F357F49FB1710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363234, "uuid": "c43d594d-000f-4b7a-9335-53796f3bfbb5", "value": "9bcadd8ed34a63728178995d1b006421", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363234, "uuid": "ee85ef8c-5a56-4cc6-b929-eafb947d7397", "value": "49152:S4mkYp+03HbhndpeoVK9/0cjXd77yg6PxHuy7vDKD12K5EKGHg1q14gUynCLgIMk:UF31ed/XB7AbvbAEKGpTI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676363234, "uuid": "37c28a6c-6de6-491d-98fa-d9dd38dca825", "value": 5385216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676363234, "uuid": "cfc36b16-a937-437b-85e6-fb649b14fd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676363234, "uuid": "2164f6ec-9b2e-4bea-90a7-daca88809369", "value": "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c49c03-acbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676417596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417596, "uuid": "57da76b4-faa8-48f0-826d-08049bd5b589", "comment": "Malware payload (Gafgyt)", "value": "e738603761e28335204ade425a9ea238", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417596, "uuid": "7132bd79-e97b-4fe5-a140-62f5737a197e", "comment": "Malware payload (Gafgyt)", "value": "9152495f606fb07735c1d4c375bfba73e1b742299f0cbfb0f93200ff29cba94a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417596, "uuid": "7c5de84d-fed7-4a4e-a2f8-48788f05fa76", "comment": "Malware payload (Gafgyt)", "value": "6fe4f1e933467e8ad05bb3c40c345a05ce2a4cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417596, "uuid": "16288fb5-1a6a-420b-a18d-39595370202c", "comment": "Malware payload (Gafgyt)", "value": "85d0eb120e15fe2c304674478e06861ee5ba776f88fa1f914fbf5071f7887c1bf03427f7340073093a90a1153b056d1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417596, "uuid": "304f4028-4448-45ea-aeae-c7c1dede6378", "value": "T1B9B35B27B791C67AC08796B027CFA9919423F17D0B37326B77D42CA03B159C91D6DB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417596, "uuid": "99fd25d1-aa20-445b-84f0-41484a844e3c", "value": "3072:RAzBuL6lAZIZy8o7yzJOaGuC/TL5Fmn1VrX5hUZSE5:5Em7y18/Dmn1VrX5hUZSE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417596, "uuid": "e7c9fc97-634e-4f62-983b-0fc9916d22f3", "value": 113627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417596, "uuid": "e34d6a3c-3a11-41b2-b8b3-65ea1a2c4e07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417596, "uuid": "66c87b15-b625-4a8e-8b27-4edc0e2c1895", "value": "kray.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44edab0-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676406723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406723, "uuid": "4ca7e29d-d89d-441a-b04e-d38f13331f9b", "comment": "Malware payload (Smoke Loader)", "value": "d60292aea77aced3d69332e7df734163", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406723, "uuid": "278d1617-c867-400d-9470-120703bfdf97", "comment": "Malware payload (Smoke Loader)", "value": "91a147b594bf43c13ead6f77453decf73f50c15ad39de2ac06e0c8e435aa0fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406723, "uuid": "677ad2f3-0339-40b0-8977-a3a13db2d71d", "comment": "Malware payload (Smoke Loader)", "value": "de2da56e9da2c382707459d094425988435fa235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406723, "uuid": "942b1a6e-142c-4979-bc7a-34f38b73b0b9", "comment": "Malware payload (Smoke Loader)", "value": "1e2cbe085eab4f2762e6a12752fc4c5c7cbfdfbb99592ada4882477fd752e4e86716c38454abb68902fa036de055b8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406723, "uuid": "1197f79f-198d-4f68-88d3-1699945cf9ca", "value": "T16714E01134E3C072E46BA5385570D7909EBEBA71E363819B378816BFEE202D157B9393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406723, "uuid": "fd11e997-3800-4a64-a25b-586d968e07df", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406723, "uuid": "ff9ee917-9b10-4290-ad3a-202debb23c5f", "value": "3072:3VceNapL2p3/5F26t3sLtK4ch1WFKLg41JpOpluX:WnL83f2ysLtK40W141G3uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406723, "uuid": "b910a7ca-5487-448a-9c0b-5a4c66175169", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406723, "uuid": "7f553a8e-26ab-4e39-bdd0-82defb98cb62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406723, "uuid": "25bc7b07-04df-45c7-84a2-210ab4b04903", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca98fcd2-ac19-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676346229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346229, "uuid": "4702ab82-5459-4f8b-8bac-ea1996d82220", "comment": "Malware payload (RedLineStealer)", "value": "408b60c3e3c90a90093262e6a4d652cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346229, "uuid": "f41f7984-f30c-40e1-bc94-6df05af7e590", "comment": "Malware payload (RedLineStealer)", "value": "91cf0e95a98258e959bba426180d21b9c258ea2b5fa752fc09ad1305cf0f4342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346229, "uuid": "992df494-812d-4ab6-afda-408255992e9d", "comment": "Malware payload (RedLineStealer)", "value": "55f80bbede5dc9b03c2cbefe1a3b45f9871f70c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676346229, "uuid": "cdae060c-b757-4920-8a14-ba9dfaef6fcd", "comment": "Malware payload (RedLineStealer)", "value": "fd6e3fdeef7d3c38ddd30257056e2c1ddb6362d6136f903397075c2213f2f0b9449d47f333e903cf823e9eb929006d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346229, "uuid": "3b9ca915-813f-4d60-a775-f5d3c1ee7e98", "value": "T112F41207E6F85026E9B15BB028FB07D309377E606B748297174FBC2E0C72A64A635776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346229, "uuid": "15d5256e-5f58-4867-a136-af29c90184dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346229, "uuid": "4b1ce279-2220-41f9-a41c-8a95f8b1e114", "value": "12288:LMrRy90UrGehcmzVqdINYpCzJBu0WkWFN4PdM13Qtz+RtAuw1gifoM4X:6ytVhdhhf7nZvPU38yX01gyV4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676346229, "uuid": "59977bc6-277e-4adc-bece-e9e91d85b9cf", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676346229, "uuid": "97a4e9bb-d61e-4cd7-acb6-f3bd7121a225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676346229, "uuid": "251cb93b-e855-4688-b653-c602f5ac07c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add42f8b-ac9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676403303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403303, "uuid": "e4106f56-1823-4452-9552-596b61ffe07f", "comment": "Malware payload (RedLineStealer)", "value": "1d5c3c066f1ef74d14df80b4c62b696c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403303, "uuid": "e2b6a770-7df0-423e-a7a4-e707b57be656", "comment": "Malware payload (RedLineStealer)", "value": "9212518a94a16ef448f27c1420182bed5707050b8287ae68fe45ae858eb85e36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403303, "uuid": "4c78fa34-ba2e-4c3b-a3a2-474a8e96bbb5", "comment": "Malware payload (RedLineStealer)", "value": "74eb91be3e7676c5e2e22cfb745ecd83147f2894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403303, "uuid": "be9e254c-0f26-48cb-963d-a9d58b848113", "comment": "Malware payload (RedLineStealer)", "value": "73afd247e97524be8c4ab40dd7b69c14a1a34372893fb5f9dec5eb9627c3882b32405fcaa19bdf7a51bf8a65dfd47dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403303, "uuid": "5c867ce9-bb8e-4d01-8d24-5e5e30d44662", "value": "T152F41247FAEC4136E9A0977469F703C3097679A0AE31879A634FAC190C73660B972377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403303, "uuid": "dba03120-5791-444e-9bf2-8cddc9297b2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403303, "uuid": "8a108981-4a93-49a2-9fe6-88bb4125a7c4", "value": "12288:qMrAy90hhsOX9Acc6WDORBiJAgIC5F045AKuYexCKA+clXo7cMiXKjw:Cy9iiczWKwJAnI5AQeEKA+eXo7rOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403303, "uuid": "ece65739-fe15-47eb-a2ac-42b69fda2105", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403303, "uuid": "2b9a469e-6265-4b13-81a1-0f209d9df130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403303, "uuid": "9329efff-20dd-4828-bec2-97d3130a5b77", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b17ec6-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419127, "uuid": "87fb2d2c-4d90-4f95-b9da-3df5c1568f15", "comment": "Malware payload", "value": "763dfee813024e4e6268c1e950b25c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419127, "uuid": "7aa8f226-2850-4caa-9e05-51d583e2d180", "comment": "Malware payload", "value": "92508da6a128df1e3962847bc44900241050039ff5307057cc49ad95377e24ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419127, "uuid": "a5163051-8a39-48d7-9b34-8fb249e6c142", "comment": "Malware payload", "value": "26f147e11673fb543c36257bfecbc9f5d55facb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419127, "uuid": "5684a599-8bef-47a4-aaff-1cbf1fb87a01", "comment": "Malware payload", "value": "1ea0b430a90c13ec666650efa8641edf4b955636e4ffd75c7cdee5c0bdaf9baf400fd9ade630ad7f8ef7e40913e00ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419127, "uuid": "c23f6ed6-0f2f-4cf4-a627-fd7a975bc1fb", "value": "T10BE3A62E7E22ABBEE169823107F7AF70C79521D227919342F16CE6185E7124D1C5FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419127, "uuid": "e953354a-f284-45cb-9786-7addf62db87b", "value": "3072:1Atu6SxI/5ZIUj6QP/5NOX6sILJ+DAlwgqVIUFhq1TB3OotUmkmZF01TpM2ke:omclhUFhqfUmkmZF01TpM2ke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419127, "uuid": "36dd0f21-376b-4e77-aee6-93ab12234a27", "value": 146926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419127, "uuid": "1a0f8f99-6e20-470a-9dfe-a09ce71115b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419127, "uuid": "0e0a5ee7-6cdf-4e8a-bd91-2675a5793485", "value": "763dfee813024e4e6268c1e950b25c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5161daba-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382103, "uuid": "b47e6080-e6cc-4579-8c91-8aa6b35d4a7c", "comment": "Malware payload (RedLineStealer)", "value": "156845b1bf7447d5131a1392b2809f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382103, "uuid": "4ee020c0-ab99-4a62-8493-6c7a86a8867e", "comment": "Malware payload (RedLineStealer)", "value": "9255b7a154698669aa8d751692d350651653054f0190f4963e8c28edb37afcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382103, "uuid": "206750c3-93a7-49f3-beae-f87a08d98c62", "comment": "Malware payload (RedLineStealer)", "value": "a525aa16b7fe1dc7a568f509861fce60f957f525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382103, "uuid": "1e8314a3-3716-412c-b427-2f093cf8de2f", "comment": "Malware payload (RedLineStealer)", "value": "8e4be00177a4afe504d8c4dd0dc85db0a6582bf00599edd1a930d80449cc2cc2c29439fb2d62f2fdf3e074076bdbaece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382103, "uuid": "3bf8dc2e-0ea5-4512-adae-aa1ed5dcdae8", "value": "T153B40207B6EC9572E8B14B7008F603D31A36BD619B38869B135FBC5A1873274F535B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382103, "uuid": "9cacecfa-f658-4e07-a414-5a527e9ecb9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382103, "uuid": "5c9e5a56-17aa-4515-ac1a-b25f68290275", "value": "12288:OMrVy90DAo5EyqQ7svdj8POHb9KSTOocNk:HyA5EdQ7kiPsdcNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382103, "uuid": "c55520ca-2e4a-446b-b69a-a5e84e1e5440", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382103, "uuid": "203c6da4-8062-4f5d-a083-4f58710a9d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382103, "uuid": "4da45701-aaf7-4df2-9e7e-05a1d211efab", "value": "156845b1bf7447d5131a1392b2809f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a757a67-ac78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676386735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386735, "uuid": "4151feb1-7412-4966-a04d-fa9f74f25dce", "comment": "Malware payload (Formbook)", "value": "78d35de04c0ca0b5334efc8218e5f6f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386735, "uuid": "11b99f17-1c55-435a-8a0f-7e1f96b4254c", "comment": "Malware payload (Formbook)", "value": "9270a381a5fc9e49c941546bc88d6c1683e15b2b1ffde51f60b23e8972a6b34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386735, "uuid": "f076876a-406b-41bc-a82d-6c9198e2d37a", "comment": "Malware payload (Formbook)", "value": "09964c3a73d8bb55ca25710b3bf70cab1bd2bf54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676386735, "uuid": "47024424-b043-4009-a9df-e54b8aa2f61b", "comment": "Malware payload (Formbook)", "value": "53d94f06f6a0090b060eb7610cdb9472575b905a26a1a46d483268f75df96518ccf654f4ab242265912201ffabb22e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386735, "uuid": "fabf8e24-e0f8-4700-aa36-cc8a52e4c7d3", "value": "T144C4129533094342CAB86FB225F12A9027757E1FA911D60F2C8A74D82EB7F424752FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386735, "uuid": "0cb821b6-372b-461e-b3ba-7140cf8475b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386735, "uuid": "d77c3c6a-ab3b-4d9a-a2fa-c48821a81c40", "value": "12288:GdFFZ6zorGv/wfporNLl6hTx8eB4BgxbnrGKIddMbBL:Y6zor0oBml6hHdTridMbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676386735, "uuid": "df1ea64b-c48e-49e3-be05-e8340efe5e78", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676386735, "uuid": "87d46fb2-6f90-4f69-baf0-86a3184446f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676386735, "uuid": "e0eec9b3-2f9c-4a1c-a477-93e6f14ebb33", "value": "kftt2DEAWT8UMcm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe417f3-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676398985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398985, "uuid": "5f057b71-50ec-42e1-8a55-2dac764133e1", "comment": "Malware payload (RedLineStealer)", "value": "6674b6ed85230a035fdc6d3ba3cfca6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398985, "uuid": "3d2fb0c8-2eb1-40ce-ae36-3748aac98708", "comment": "Malware payload (RedLineStealer)", "value": "92d84147e869be7bc137c01fbc13edf4c08284eed8481075e300b73e57908b84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398985, "uuid": "79c0b008-282c-40ef-b21b-f6c0a9efa53c", "comment": "Malware payload (RedLineStealer)", "value": "87472fc0b0468508da5c223dcf6b76f67d087402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398985, "uuid": "504dc85d-089e-46de-9daa-590700d3c5a1", "comment": "Malware payload (RedLineStealer)", "value": "ae1ef4a2fcb1b3ff8e30fe45ef26f99e9a140b1436243ee8faec78439915fa7d5acb7d49b4c2e960f2996e9a89e4fe20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398985, "uuid": "0fa651a0-8e2c-440b-b8c6-730a86dc51f6", "value": "T13FA40217F7EC8033ECB6677019F603C30A357EA28A748796678A5C1A09B32747A75327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398985, "uuid": "5b03fb6d-8188-45a5-8a66-79ed56644fc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398985, "uuid": "a366c238-722e-42fd-a973-a7cf53b2fa68", "value": "12288:FMrGy90BN18+m05xVUD2pxUb7FuKAteNFKcKjVQ9damEdg:XyS1RVi2pxCFBmeZKR0aJdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398985, "uuid": "a7a695d7-7784-4e13-b8bf-c6777eac205c", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398985, "uuid": "e54b8cc4-785f-43f7-bc53-0fa0a4bb4ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398985, "uuid": "63cd5463-61e7-40c4-82ba-6c0e8f46a0c2", "value": "6674b6ed85230a035fdc6d3ba3cfca6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70886ea5-ac07-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676338347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338347, "uuid": "b5bcf807-518e-4e09-a390-73005968dba9", "comment": "Malware payload (GCleaner)", "value": "0cb5669a6c53c36d2e988f90f2eebda0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338347, "uuid": "736fed36-8578-4455-8592-8a26ad452fd9", "comment": "Malware payload (GCleaner)", "value": "92eeb61d8550b1f56d4f682871b005402d5f320438742af2b0bfeb3bf43f2acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338347, "uuid": "e1af79ff-e78f-4ed2-9bdf-1b09766fbd01", "comment": "Malware payload (GCleaner)", "value": "acf5a81698dfc9e7b26e4f02e40f1281b144358c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676338347, "uuid": "8fc95ab1-53de-4fc8-bafb-4ac7edfbc7f1", "comment": "Malware payload (GCleaner)", "value": "304b6f6e9c358a40fa006f3e96569a9ebfaba53d603a661f9b2e9024662ac985e348816dc9f2b99e84a0d2d7dfe99faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338347, "uuid": "248a3693-0ca4-403b-b955-d0ddb41e0ec9", "value": "T17EE5127C7545C96DD280FEB48C3694E75CDA6EE3E8E4A16270D83F3F52BD289460A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338347, "uuid": "08424040-5db5-4b93-99b9-517b54c903ff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338347, "uuid": "45deb65d-8454-4e4a-95a4-69a553ff3c59", "value": "49152:rdH65P4oUCpIwTC/2WWKghgIfTzhc+6+VB/W4A2ra7Ey3tVXzb8vtIpLCgv2MR:JH65P4o/pIwTC+WZghgch768aoy3XX/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676338347, "uuid": "50a1b82d-3a94-4c7a-8ed5-8c6554d24fe3", "value": 3118349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676338347, "uuid": "c8cb5ccd-7328-4595-8bd6-9917d67f20f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676338347, "uuid": "f3ed6814-8f1d-4c8c-a533-fb500bd8a477", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3ab7cd-ac62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676377348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377348, "uuid": "8b1b4302-200b-4945-89f0-06c54e49b380", "comment": "Malware payload (RedLineStealer)", "value": "9e655429f030ea3a09c4722ca7c44b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377348, "uuid": "cb7c5e7d-232e-41bd-b4f9-a31cd83d7f26", "comment": "Malware payload (RedLineStealer)", "value": "92fe7eac3dd1136d0618a72d3ffecd00bfd54e14fe27048422aad8d1abdd6d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377348, "uuid": "df7f9ac7-141c-400b-8101-4ade97adf164", "comment": "Malware payload (RedLineStealer)", "value": "1bdaddedea416181c8efcb7becc644f03733c511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377348, "uuid": "239ce3c4-2ff9-4282-bc00-fdfcfce93f19", "comment": "Malware payload (RedLineStealer)", "value": "98a1a30945354c0b8fc4f0ad670fcf012078bf508f2c5472684e2b53b15c58577d6ae954f924cb9d43c14d25c84eba52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377348, "uuid": "975be910-1120-45c3-804a-48e63038d76d", "value": "T10FB40217FBDC8066E8B0677028F607D30A36BD616B35875B734EAC1A0CB2674A539367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377348, "uuid": "cfb8a58d-ba89-41fa-bd04-128340ec5644", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377348, "uuid": "c92f1ae5-b5f0-415d-a312-2c2f258b1784", "value": "12288:8Mr4y907ey6BXTjBY0AeHGTyETGXMvg716e79l9fVOSBweL:0ytLX20/pEicvgdz95L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377348, "uuid": "d4c80ac6-dc22-4d19-a287-a12a6d019d4c", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377348, "uuid": "3159d2db-df48-4ec6-ba04-6273e48a20fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377348, "uuid": "06374a00-7ddc-40b0-8121-31891bed0586", "value": "15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e478c40-ac22-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676350020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350020, "uuid": "7ea2b5f8-57ce-4304-b3cd-45e963fdfbaa", "comment": "Malware payload (RedLineStealer)", "value": "cd46312673cc0d9d203427f40b3e274a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350020, "uuid": "64f71ca0-b443-498e-a796-df949b5c7e8c", "comment": "Malware payload (RedLineStealer)", "value": "93ae529d7d511158aeb2ba42f7ac9e8cada410d03015bce3de712a56367aac7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350020, "uuid": "6c1443eb-2080-4b42-8071-d4977dca72ad", "comment": "Malware payload (RedLineStealer)", "value": "efbb7ca5932b92515fe4f6bc509e63b2d34eac62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350020, "uuid": "22e7a8ee-ef6c-4223-920f-f04c485c128e", "comment": "Malware payload (RedLineStealer)", "value": "bb8c0bf65454053fc60c0741def08c9612e22fd83efa52c5590c2d34b36f1dd7967d6087f92d92281abc0f39dcce4100", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350020, "uuid": "76383720-66e0-4cde-acce-3c35d0a1b220", "value": "T175C4121BB7F88136E5F1537018F107C31636BFA15A38865B234F6C991873AA4B235B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350020, "uuid": "2f5f7847-bb53-44db-8fc3-f6e3e6951af4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350020, "uuid": "a69a9142-4240-497d-8ef9-1e392e84a0b1", "value": "12288:hMrRy90dP4K8iH+wRxunOZFEKkqzxvCjriWCujP42Ijs1ijikz44:8ybizRxuOZmK6lrpIg1ijik/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350020, "uuid": "1cf57aed-e195-4d12-9d89-7673e343a76b", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350020, "uuid": "abd6becd-9756-4f8d-8e08-f55552c6f272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350020, "uuid": "4145d641-e6bc-48f2-89dd-d84cd1a3a292", "value": "cd46312673cc0d9d203427f40b3e274a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceab2c35-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1676391762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391762, "uuid": "fabc543a-6ff2-486e-a6e5-8bacc55e8921", "comment": "Malware payload (AuroraStealer)", "value": "9422fdf5908ef9676cd69664a3eeb758", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391762, "uuid": "c9043494-de92-4760-9479-76e63837fd60", "comment": "Malware payload (AuroraStealer)", "value": "93b4f08668d889ae15de8052ff91674a7ba3032520864a08860a1c09210db4f5", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391762, "uuid": "35a32a5e-f1e2-4c60-9845-2e4bdff1c86e", "comment": "Malware payload (AuroraStealer)", "value": "fca31d6375653988370f72dfc96cfdad4ec93662", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391762, "uuid": "70bc7bf7-e2d0-4d63-abd6-376f37293502", "comment": "Malware payload (AuroraStealer)", "value": "c1240d9e0578a8b52d545ac4bbc0545ca9eb8f009a799fe1bfbaa15363048f6747c5b12aa4c1531cf0a3b3169df9902f", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391762, "uuid": "06b39af0-d8ef-4a50-a5ac-582c4022fc05", "value": "T18CE50847B89481F4C0BEE2308A656252BA703C895F3163D73B50F7B82B77BD85A7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391762, "uuid": "422687f3-14d1-48a1-9d42-a1f39df3aa3a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391762, "uuid": "614b696e-b578-4fb7-8afa-86e309041233", "value": "49152:0DB3/EyMqY9pJKKMFC6oaisLFA842Lruk1s:q6q5FpLO84N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391762, "uuid": "fa327499-39eb-470e-a18f-98f745304fa3", "value": 3114242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391762, "uuid": "6ca087bd-ed26-4c2d-b57e-6297dcb119fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391762, "uuid": "fbd3f32d-0697-46ed-b076-ee41d53db50c", "value": "93b4f08668d889ae15de8052ff91674a7ba3032520864.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8386f2-aca6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676406819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406819, "uuid": "95b2249e-705a-494d-a6ac-5ae8969c850f", "comment": "Malware payload (RedLineStealer)", "value": "35109fad95c0dd3b1870089c282a3ba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406819, "uuid": "c6e77d5b-7466-40c4-9818-b190291ea5be", "comment": "Malware payload (RedLineStealer)", "value": "93cc419ee939602a610353fcff8b4c34960c1b354733c6f8300a7a684f220fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406819, "uuid": "0c9a3135-2c9a-467a-a511-5e93e1cb9402", "comment": "Malware payload (RedLineStealer)", "value": "863793d6244c1267af8e3a3d802190a9bf9cd2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676406819, "uuid": "ba311be0-1cd9-47fd-b78a-aeca27b0b981", "comment": "Malware payload (RedLineStealer)", "value": "7a08cacee60bfbac39701a31159d7e6081a7dd34096d9cf7a0d0d5dd573b9793ee3de8906c606a64d63a0aff156362b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406819, "uuid": "9de97b9c-ba80-4884-ba34-f8a3fe5a4b0b", "value": "T1B0A4024BE6F89472E8750B3018F707C30936BD915B78C29B774EA95609B2278A73137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406819, "uuid": "12df54e4-117b-48de-bdb6-033e71c7ff7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406819, "uuid": "a148598a-4ab5-43df-a442-e6458cbba6f2", "value": "12288:WMrYy90goHgAmSGekkrMZNHNcG8cjaZOz8D:+ygH/mSUkIZNWZ28D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676406819, "uuid": "fc6d858f-cdb9-47bd-ba72-41a37116a173", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676406819, "uuid": "37e412f3-e3fd-4fec-b471-11a85e318196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676406819, "uuid": "3963555e-8e13-4bc9-baef-6cd6526eb36c", "value": "35109fad95c0dd3b1870089c282a3ba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe28f5a-acac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676409293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409293, "uuid": "d1dcd626-6a46-4e63-8f53-ead80ab37181", "comment": "Malware payload", "value": "725ae3a353f2f10d80108e504fc0cf3a", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409293, "uuid": "7d64e76d-46c5-4f67-93c8-2194de43c2e0", "comment": "Malware payload", "value": "9422432a83fcbd543a666739ea7b0394b11c2cde00ecfb9b1c530427a1c654a2", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409293, "uuid": "84a06111-be15-41f3-954e-2cb1419f0543", "comment": "Malware payload", "value": "57093b91d4547bba37079e5cc4c113d2c43b35a7", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676409293, "uuid": "cdd9fe8f-403e-48f6-b5a2-12b1b8b3d9ef", "comment": "Malware payload", "value": "8eed6eedf2603a3273f65bdd1d8fde362574d0ca659cea2faed783ad32cbc3cbba366f3e934f5e05a831fe31ccd9e5b4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409293, "uuid": "7afd3c3e-1abc-4ba8-a1f4-d8441507a948", "value": "T1634633D9B97BAC9EE07035350C89D3AD748B7CBDE28C8B717713959C8736CE59A80212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409293, "uuid": "4f43e58d-3683-415d-8d40-ca55ea5bd574", "value": "98304:RRF93fhoDelkErwu5Ni/y2HaL6hG5ZamKUnzCNfnTDIAmCFrP5:TFpfhoDcPMuSy26LwG5ZVLn+nTDPm45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676409293, "uuid": "7de848e8-0b18-4dfb-ba46-2169c062b684", "value": 5862217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676409293, "uuid": "9532fdfe-8d1b-4c03-a26c-cd530090eb85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676409293, "uuid": "c97c2e94-c073-427d-9d75-431f4a27136b", "value": "AdrIan-DarkCat-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77c5651-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676412795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412795, "uuid": "f88e249c-d6d5-4c1b-8052-1740b6f5d2bd", "comment": "Malware payload (RedLineStealer)", "value": "7379e05f5a787e63c63e6db39daa2d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412795, "uuid": "c1f3d999-751e-40ec-ae6a-829063433a38", "comment": "Malware payload (RedLineStealer)", "value": "946d8fabd054c9bea875b493fb2d5b00cff63202510b651fd5947d3a8c5d188f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412795, "uuid": "0cf6bb91-a647-4fb2-9b17-ec8f44195225", "comment": "Malware payload (RedLineStealer)", "value": "804c1ecc536ab77d65b2fa59fa5c2b884d29a532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412795, "uuid": "a88da518-f555-4b0f-9ac8-55751f69fc24", "comment": "Malware payload (RedLineStealer)", "value": "e12bcce2d5d13b4042f13b3272f06956db0ce9557a3a511772c52eb1d0040b9933ae1676004d62dde4bd08a8203ca645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412795, "uuid": "fa687aec-56bd-4fb3-980a-f5c827c03afa", "value": "T1B6E41207E7E9C072F97567B018F913C30A367E616E78425F674B9C5A1DB26A0B63032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412795, "uuid": "7b7376c8-0815-496c-b822-120d077df735", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412795, "uuid": "c0f0f143-9a9c-41d5-a622-7b4c31e1f51e", "value": "12288:YMrPy906/X1Njvo48tBFrhxMyDx3sCF+qtXha2LehRv9NhOh2EncRehn/OHMZ:HyX1Fv/KBzxjDx3sCRtRaxRQRnGGE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412795, "uuid": "05dc9350-a3f3-43f2-90b8-329fb908d867", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412795, "uuid": "7d811eab-e267-47da-ab1b-ff0707ae53d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412795, "uuid": "45712443-3961-42c9-b856-28651994ea7f", "value": "7379e05f5a787e63c63e6db39daa2d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2c5ce3-ac45-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676364889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364889, "uuid": "6c76da78-a686-4f89-93b1-599aa27083b2", "comment": "Malware payload (SnakeKeylogger)", "value": "1ce6c3475eee2141c58390459c511c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364889, "uuid": "b7ace871-2e69-4afa-a769-0a3e1fda7695", "comment": "Malware payload (SnakeKeylogger)", "value": "9489138e9d8e0f172553d5a1ace56b6115205091e46a46767dcea312a4911e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364889, "uuid": "59e56214-9214-45cd-9457-6cdddc2aa88d", "comment": "Malware payload (SnakeKeylogger)", "value": "19287fac22fe912bfe46ca62f17f546511930bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364889, "uuid": "eb62b6ca-38bd-4bd8-a1cd-055f93dec10a", "comment": "Malware payload (SnakeKeylogger)", "value": "be594223852d78f84c519b8ff88bd4fbce4906b16abfa460b6045059ad50cc24745c7c5f6e89ab06675e788fe870d440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364889, "uuid": "68654580-64c7-4acc-955e-dd6c15e485ae", "value": "T19FA407C3F444348DF8DE827BBADA8E26E1D61D5A0D43190192713F50BFEE98297C4A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364889, "uuid": "5f74cb18-d766-46bf-85c4-97c6b7d1f654", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364889, "uuid": "e9b1b7c9-0870-4e75-a32f-18da913497a9", "value": "6144:VYa65RcT2sAsCFybffiTlLYgGVQ1kGcx5IXrngLBfWjhgog:VYHCT7AsTbfixGBdq7yWiog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364889, "uuid": "0e7b2f1f-e7b4-4630-be07-fa44e795c659", "value": 467248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364889, "uuid": "04c0b115-9121-49e8-a1c3-558b52f7e1c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364889, "uuid": "b861780d-bb57-4f6f-952c-1b27e672bc0d", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2845ed6f-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676392342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392342, "uuid": "9e6696ae-70c2-492c-a8cb-e36771240371", "comment": "Malware payload (RedLineStealer)", "value": "30d3ef7ba54a02cc62f3987bdf9a10e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392342, "uuid": "61760c0b-2bcf-4d30-a30a-1c9e0abdb718", "comment": "Malware payload (RedLineStealer)", "value": "949367ae0934ae2a5f1afae2e279972611682d72046d08a38c7372e45dbe82e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392342, "uuid": "d96e51cb-8d12-434d-bb69-8dca539a85ba", "comment": "Malware payload (RedLineStealer)", "value": "0498181fe103123533ddc7fcc0319283b0460fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392342, "uuid": "64243a84-0a00-48f4-8ea9-5b5194a80016", "comment": "Malware payload (RedLineStealer)", "value": "2b3612657fbe8fc1c5a1ce55eab440f1a51363375ac48e629e761971dc99ada58c34c22f04d670898aa7653d9d7d2bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392342, "uuid": "af5798d4-c786-41b7-8e05-d44c2ce92c6d", "value": "T16BF4120BF6ED9121D4B4277089FA12C3063A7E605B78939B275BAC0D6C731B4A93536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392342, "uuid": "35034d48-d057-42eb-b830-0fc1fdb8a4ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392342, "uuid": "b4d0d179-8838-48b9-8a4d-1c3c91b33759", "value": "12288:4MrXy9058FYfHQMcymxxw9SQh23BN8y71JnPzNsCn+GbHNJKL7/wdO+0M:fy7YfH9c3i8xN8y7T5+Gu77+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392342, "uuid": "81a9a47e-b1aa-4f43-8aa8-ced4eb013cb8", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392342, "uuid": "8c8ac231-7071-4a64-9d17-e91ba1dffc1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392342, "uuid": "34e1921a-cf55-4f15-abec-229c6881ee12", "value": "30d3ef7ba54a02cc62f3987bdf9a10e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fabd013-ac91-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676397455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397455, "uuid": "bfcbdd23-bfb5-470d-874c-99efa1c09f19", "comment": "Malware payload (Amadey)", "value": "79d25c37a8f603bbc18e2570fe1037bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397455, "uuid": "2fb01618-7181-429e-8cef-b00bc524843e", "comment": "Malware payload (Amadey)", "value": "94be3eda6dadca191219e6d6a9b8040af2b2666dbaf38cb1a5ecf01f36b810cb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397455, "uuid": "f974dbc9-d20e-444e-bf88-12337fef6b59", "comment": "Malware payload (Amadey)", "value": "dd1098c911f0d4b4e46610c57380756262150db3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676397455, "uuid": "8c4ea48a-d932-4255-9ae1-074b66802224", "comment": "Malware payload (Amadey)", "value": "b0608bb57529f218f0d773f7ba3e29df6751f105d9943c8bab896d332944f26302d109ccc761b4927bd72c1b7121b715", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397455, "uuid": "3495676f-59de-4c32-9d25-87b56e4cdb94", "value": "T194F41203A7E94126E9F2973019F613C30632BEA09A3C86DF178F5C6D1872574B535B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397455, "uuid": "2b3283be-c3e7-4dfc-bf95-2a3bc21318aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397455, "uuid": "cf78f82e-849d-4f12-ae56-b2bb2dedec51", "value": "12288:+MrJy90yU1ugxcm1VyhCZpyjttMD5Emn5pmcw21hGNaxj8ACpXGp+17:7yHUrxV1oYZgIDymn3mbTAWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676397455, "uuid": "33e0d7cf-5526-4134-9b72-51c9044e7dac", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676397455, "uuid": "53038000-5b36-438d-8e3b-c9502293f33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676397455, "uuid": "f4915a44-49b0-4634-b1ef-82bb3e3be665", "value": "94be3eda6dadca191219e6d6a9b8040af2b2666dbaf38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b03833-ac88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676393873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393873, "uuid": "d3be77d3-5203-4e09-aea6-a19fcd8d4eed", "comment": "Malware payload (Amadey)", "value": "7693557f06d68852334fb58a49733645", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393873, "uuid": "06cd24df-74b4-4d7e-950d-9ec0f02e6eb7", "comment": "Malware payload (Amadey)", "value": "959d0029c8d5ca6cd2558753ed6ceae093bdc3d47a135ad624aa9c60873ca226", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393873, "uuid": "cefc70b5-a718-4626-be96-3ee079f18390", "comment": "Malware payload (Amadey)", "value": "67586ba45b2f6ddd900b12a669e027cc121105b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676393873, "uuid": "731f6eb6-34f9-4fab-a34f-01f5960cc52c", "comment": "Malware payload (Amadey)", "value": "4dde834ba99f65e134b7841eaa948cf170046811636342f2a4bc476882e2e2d4f6b5373901b52c0b48c7e8ed1af19ca8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393873, "uuid": "5cc8a169-e580-46ed-9a22-ee01f966aa99", "value": "T1F1F41207E3F88135E4A657711DFA02C31536BD205A3D879F239F6CAA1CB25B4A136B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393873, "uuid": "3fa82a77-160e-468b-8074-8aed6bb62625", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393873, "uuid": "f2f9feec-1bcc-4c34-91a9-68a584a7676f", "value": "12288:4Mrcy90HZFg4qx9lpCIHrCGq98uEx9pvD6hMD5XQ95SJ/SmoCGWXv3+C2qrJVsKT:0yx4GakoFwFBDJQ91HWf3+C3le29l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676393873, "uuid": "45f6431d-c965-4c0f-8945-564d014d627e", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676393873, "uuid": "ac1f23f7-aed2-4cc1-bf15-4d66ce354f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676393873, "uuid": "56347544-2184-4c81-94b7-ce9c4f6c1f06", "value": "7693557f06d68852334fb58a49733645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18785a2-ac8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676395659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395659, "uuid": "b6e0268c-6721-4e29-aa47-5cc7819b3bfe", "comment": "Malware payload (Amadey)", "value": "4c92f7d8a1b7e4215963c5f7edbb5085", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395659, "uuid": "05903501-242f-43a4-bb26-730d99305d8c", "comment": "Malware payload (Amadey)", "value": "96058d2cff451e142b71a0d0d03ca5ed16ec8114a1ec4a71ebde38a88f2287c7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395659, "uuid": "3b04cfbe-66bd-4a5e-8770-e19cdb5e49e0", "comment": "Malware payload (Amadey)", "value": "e88f378c2399fa00765164edfc2196f3abb3572f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395659, "uuid": "c0c2e8ba-c4f7-4dfd-812f-7fc5ca2ba198", "comment": "Malware payload (Amadey)", "value": "6cf5468d92862b50d9f4006287e252603b7825a5540062cd7ec532cb64dce2bb4f8e44026331fd0119ce06b7dc1ced74", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395659, "uuid": "ef8dfe53-5ecc-4780-b5b3-9633e729139a", "value": "T1BCF41207EAEC6432D83157715CFA02D32A31BE615E38869FA68F5C9A1CB2570E53172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395659, "uuid": "62e32395-e347-4f27-85a5-8c6fd6ce4200", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395659, "uuid": "603df98f-86ea-4d05-b6a7-84db3f038eb6", "value": "12288:BMrCy90T3aNZrhvOLJHtzib+Y8bhjKF54JDY8o74g3EgGCjQ9fBv6KaY2:zy9nd4NzixShjXJM8oLbGCdY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676395659, "uuid": "0ea1c8ac-7f9f-4f6f-9f8e-1e24a2fdfa71", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676395659, "uuid": "7e857dca-ecc2-43b2-ae68-67a64388ebd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395659, "uuid": "07cfade0-9ef8-45db-aefe-b2266f24d7ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691d9a15-ac63-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676377848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377848, "uuid": "100f3424-84bc-4dbe-983e-73e194eed70c", "comment": "Malware payload (Smoke Loader)", "value": "9cb499f398ec0574936c3c1ae81333fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377848, "uuid": "b83d47d2-5bfc-4710-97b5-dbeffec6a03f", "comment": "Malware payload (Smoke Loader)", "value": "9610678d1074829a4842834752831d1cf53ede6b417327ccc18bdb9a60f06e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377848, "uuid": "0d90c471-79b7-4d24-a33c-d8fe1d3fcc08", "comment": "Malware payload (Smoke Loader)", "value": "d7e6e1e361772c1461a1b6c92f23e7373e9441cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676377848, "uuid": "93ac7afa-2c7a-4395-bc40-80462aef166e", "comment": "Malware payload (Smoke Loader)", "value": "60c5fa9220e34203aabc7faf3ea548977e8414965b55a60eb671e33efd96b49fcfe5ab2fa01ea901aa48216974ce147a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377848, "uuid": "b5760c86-986c-4136-b17f-3e6c99dfb778", "value": "T13E04D02278B3BC32DDAB85715830D2905A3FB8712BA5C547334A167E2D312E3BE65387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377848, "uuid": "90b84793-a0bf-4dbc-aca1-cc04bdcafcb7", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377848, "uuid": "ec9fc067-d285-4632-96ba-9e551cf46dcf", "value": "3072:Zom8LM+Tj5nVk2mm3156N0BOcGi/UB8S+h3gS:CPLM+TdVvm61TB/KBTO3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676377848, "uuid": "fbf165e6-2cab-4106-9bc5-7b73ebfc99fd", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676377848, "uuid": "63974325-3d36-42a7-adc8-9194592d9acc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676377848, "uuid": "5b363939-0166-4e5e-8a60-bf919dce8a80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3822d98d-ac38-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676359297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359297, "uuid": "06b45d9a-246b-43f0-8acd-4a0371dffd6b", "comment": "Malware payload (GuLoader)", "value": "3190bc42221146a38f260784cbb26fbd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359297, "uuid": "1d6c37e4-16e9-49b3-89ae-07ab807644bf", "comment": "Malware payload (GuLoader)", "value": "9625958ccd5b7aa03607ca23df3d239ee90a64021a998ab4d8fe71f664155e6a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359297, "uuid": "6f913628-88dc-41ba-b1e6-34d090382bdf", "comment": "Malware payload (GuLoader)", "value": "fa56a1a9409bd1a22503a37cdf134798de01ebd4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359297, "uuid": "0418d780-cf30-43dd-88f8-a76fd4644a87", "comment": "Malware payload (GuLoader)", "value": "5298816966607ae21a19169243de8d0a14f8b33147431f5dd08b02f1ceb58dbd285c36cc58e7f1d99b4213af5098345e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359297, "uuid": "3f40c798-6f9c-451b-9ece-0c61e78488a5", "value": "T1C6A4F172D9E807098A0B12F45CC74AC8DF69D1DFA0E1677E6CE323AD1742368C2EE655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359297, "uuid": "5536ac7f-3183-4db2-9b04-d535c09c6a12", "value": "12288:fyrQWFohC5FBBH/00zjiUIl2h4nWzuIU56YF:oQWihIxf00i4mUYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359297, "uuid": "618c6437-6d84-487a-886a-f431be3ace09", "value": 475111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359297, "uuid": "4c3e0e2c-c518-48be-8b5f-3e0ace7318f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359297, "uuid": "68d96d15-3699-433d-beec-61958ad70971", "value": "RICHIESTA URGENTE DI PREVENTIVO 13223.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f9e278-ac67-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676379482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379482, "uuid": "af5bad3f-dc8f-43d5-a929-9cd1e1bbe657", "comment": "Malware payload (Smoke Loader)", "value": "9591aeb15ebc004f6aba2f13619fefe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379482, "uuid": "24005d7f-b94f-4588-afcf-7ee1549d4d5a", "comment": "Malware payload (Smoke Loader)", "value": "9633959773a5b25440fb3496298b5916ae7956e0b6633b5689d0d9e801748a82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379482, "uuid": "43fc4e9f-e5b2-4eca-a3bc-998f39f13e59", "comment": "Malware payload (Smoke Loader)", "value": "3d9806050fbbac254515cd7a9d12f8e5aa13606d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676379482, "uuid": "3ca081c9-da63-49f3-aec6-81ae266df5fe", "comment": "Malware payload (Smoke Loader)", "value": "46f56176c8aca64f5b5bab539df102c8f64367eaadde7eb16cb2db4c7e06011eb9f5607ffaeba8ad7b4b69b725648aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379482, "uuid": "faf442fa-f2f6-4420-981d-cc6168a77bec", "value": "T1DB04D0117AE1C032D47786702831E5B16A7F7CB257A085B733449BAE2E313E2DE69397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379482, "uuid": "cce786f3-4cea-4ccc-a84a-189e2dc40d25", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379482, "uuid": "a2da081d-1ac4-4daf-9f5a-3e59613afa87", "value": "3072:goZe8xLcKU5njuklridUe0QF4Nz/7LMtLtJGPnNtGng0YTYuiSsH6S:nZxLcKCqk87SLMtLtqmgvT3iSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676379482, "uuid": "c78e2224-3edd-4da1-bdf6-0ee2383c53e9", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676379482, "uuid": "734b48ba-b442-4bf2-b5d5-c9a9c24d6dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676379482, "uuid": "19577644-769a-433f-b87f-96784b3137c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4219ee7-ac37-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676359156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359156, "uuid": "23e750a6-dd82-451b-92a8-49a9ba5f27ce", "comment": "Malware payload (AgentTesla)", "value": "7e2a516caab6395dd0d5c53b0c17429a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359156, "uuid": "3ce324a3-4067-4468-9fea-0a7350c28d85", "comment": "Malware payload (AgentTesla)", "value": "9636c00056f472cf80c2608893f5ff8e0b1f6fc318d19bb408e06075cfc02e66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359156, "uuid": "be345d4b-077f-473c-a3d0-d889bac71e72", "comment": "Malware payload (AgentTesla)", "value": "afb8616bcaa193e615e29b0cbc8062121232d396", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676359156, "uuid": "a78f219c-378c-412e-beea-787a9dbf0013", "comment": "Malware payload (AgentTesla)", "value": "2aaeecbfb785e669fe29d2b4c034016de70919d5805919cd94b3e950556007c978f1116e04e028861e1258deacff779e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359156, "uuid": "0db54e7a-bfdb-40ee-b246-21a2c01ef93e", "value": "T1B4F4221B285CDB67C8BC83FCAD6291B093326D757432E2BA1DC73ADF11B17A1444698B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359156, "uuid": "f9869fbc-60cb-44af-b015-922894f11417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359156, "uuid": "81f6741b-b8a1-4fde-b26e-8dde028671e7", "value": "12288:NY8h6q6EMnYC0ND571Vd8Z6R8JXNCZHU2QJwbFutGU7Z2By2iLW:3YXNQ57jRSJXNs02JbFuEgZ2jiLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676359156, "uuid": "7ac6b0fe-e92f-45bf-a7c1-03dcb2135f2d", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676359156, "uuid": "a9f873ae-4958-43fd-9ce6-305a4aea5818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676359156, "uuid": "2650b7ec-c33f-43d2-b768-95520c34b256", "value": "FL1JY0IslSLZz3u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470415ef-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676375214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375214, "uuid": "69695649-f502-43f0-8694-f3f410716fec", "comment": "Malware payload (GCleaner)", "value": "f66f76fd6a2dfc9c22bc10abf949d1f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375214, "uuid": "2115cd46-ed97-4a14-b0b0-a81bb24ca33b", "comment": "Malware payload (GCleaner)", "value": "9684193784853ee52a3164e2c797d541f35751248b0fe770090c1e518298c7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375214, "uuid": "b25573d5-e814-49b0-bfd3-b6b5d754f0c2", "comment": "Malware payload (GCleaner)", "value": "af18e8b39b89a59ab87b5c51a13b0fccd19dc649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375214, "uuid": "46dade83-cedd-4d0b-9730-73e9857820d9", "comment": "Malware payload (GCleaner)", "value": "34575b55e1bb76f1066bb1b76c8f4518ed334de4269142a38105ccc1987556478a5591d9c7024fb3f7522a6525260648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375214, "uuid": "25021e25-3e00-4f63-b36c-61cbfa49902b", "value": "T182E5127C7115C96DC180BEB88D2AE8E35CDB6EE3E8A4A4A270CC7F3F5679184960D117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375214, "uuid": "4af5f166-0d44-46be-8a15-4837bee925a9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375214, "uuid": "94f0c7c5-0ed9-4376-aa1a-7b20086adf9d", "value": "98304:JHjng1nGV0pn3vyq6U4RWQA4Qx6aL/xXov2MR:d01nbZ/NaWQqlovjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375214, "uuid": "a079ccdf-479b-4366-bcd2-8d58b20cba24", "value": 3164577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375214, "uuid": "954e7185-e24f-46a6-b0da-8d1a01478299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375214, "uuid": "b8371d7e-7338-4d03-938f-9aacf59d180a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0f098a-acb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676411593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411593, "uuid": "18d8561e-47a5-4bdc-a5cb-e5aadb3ae136", "comment": "Malware payload (RedLineStealer)", "value": "b205d67855c6a9518f454c3df28148d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411593, "uuid": "2a11bc70-33c1-44e9-8876-84e963dae248", "comment": "Malware payload (RedLineStealer)", "value": "96f65fdd17e0597a18fd472faa0b80452ce17a85ec2bae585131929f905267ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411593, "uuid": "685a554e-1a53-4d9a-adee-743c94f92dd3", "comment": "Malware payload (RedLineStealer)", "value": "b5af6bc576551f51aa612d5b2cbc2afe877b7e49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676411593, "uuid": "abf16faa-27ff-49e5-9bf2-72b3c7051151", "comment": "Malware payload (RedLineStealer)", "value": "a6fa360a53e9e05fb0f0e09d9c4b770da8e8d35407362110eb28171d92cc506bbbc5fe024dc3e863fe2eb888d2a44588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411593, "uuid": "a783d480-5216-45b6-83b7-ec3385784eec", "value": "T125C4124BFBDC9176E9B057B01CF642C30A367DA19B34839B238E5C5E0872970A636767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411593, "uuid": "12c8eb82-caec-4f42-bce8-00d8e987ffee", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411593, "uuid": "87b39dc9-127c-495b-ab60-f1ea626f08c9", "value": "12288:iMrMy90Rx0phzoJAtX96aP4Y4/HNO9NU2CCcjJ0IFnJG:yyOAOSXQK5YtFgcGILG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676411593, "uuid": "19e74c62-6047-426a-8c9d-162330e5862c", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676411593, "uuid": "feb957a9-36b9-4b00-bd5a-48d14c50274a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676411593, "uuid": "002cb839-e051-4c90-831f-f24109b43f58", "value": "b205d67855c6a9518f454c3df28148d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffca01d5-aca9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676408165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408165, "uuid": "d49f013e-c316-4807-abc4-06d37fec1546", "comment": "Malware payload (Mirai)", "value": "ba008dbbd6458dd67253cdf7dda9b2ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408165, "uuid": "83470f87-4435-4d42-8b1c-1ef681111a4b", "comment": "Malware payload (Mirai)", "value": "9715a59d120816e681efb16fd53ef4e1522e1e8157920e3ea38e83286f278269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408165, "uuid": "a564cf67-ef74-4cdf-b7f0-2cfb561f3bd9", "comment": "Malware payload (Mirai)", "value": "81aa045748615e222f55fe3567bc0b5dcbc04d38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408165, "uuid": "3883d420-8eb4-4514-9b30-342105c4513e", "comment": "Malware payload (Mirai)", "value": "6d0d696fbeeb148b31304053dce581ddcf95854cb24c6253e4d20526626fe44d79bb136dbf499d45b3abc161e3ad4150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408165, "uuid": "76777861-13ef-40c9-a176-fc14f1d08ac6", "value": "T153D31805D9508B23C6D22B7AF7AF528E77232BA897CB331156287EB42FC179D1E39510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408165, "uuid": "f0357676-1865-4190-860c-cd4d065e5e0e", "value": "3072:9gfuySdhp0eQTrL0E8GD0O2aH5xsWC0blYe1c45hxnOqh11K9lMmy/QsYJ0Yj/:Q0E8GDn2aH5xsk1v5hxnOqg6my/QsYJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408165, "uuid": "e9240693-95e5-47e9-92b5-f8cfe1465307", "value": 130431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408165, "uuid": "a8f8a14b-c949-41eb-b1b5-e89753dcd340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408165, "uuid": "8fa6a87a-8686-4814-aad9-72f0645ecf3f", "value": "ba008dbbd6458dd67253cdf7dda9b2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98595a7b-aca0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676404126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404126, "uuid": "4fbfbc84-3216-4ea0-9233-688c3027dc92", "comment": "Malware payload (RedLineStealer)", "value": "7cf461732cf9d151aed5ca9f15c9d689", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404126, "uuid": "483cfbdf-0dab-4edb-bfe9-1ee5519ed433", "comment": "Malware payload (RedLineStealer)", "value": "971b14529405a8774ceb5552f3f12fcf455f530e567b71ae043ef166f4ff9d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404126, "uuid": "70a4e0e1-ab36-46c4-96c0-e9295c30dfef", "comment": "Malware payload (RedLineStealer)", "value": "16308873863f9231638b81abe04b80afd0b98c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404126, "uuid": "180f5235-da3d-442f-9e4c-152da7a4f2c8", "comment": "Malware payload (RedLineStealer)", "value": "b17bf68c9b80ed62bb953dfa0c736cc62b04a744dfc68674d3ec26a4f6ce429d0b73cf63aa58dfe2ae77895c744695a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404126, "uuid": "e5b2758f-45f7-4786-9fd9-497978331e78", "value": "T1B354F2213A91C0B2F54785788461EBA0EA7EB8E396A1C55B33780EBF5E307D34B35356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404126, "uuid": "06b29226-2fd0-4f5c-b546-d44b3271e84c", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404126, "uuid": "08f472a3-acf7-453e-b830-bead331bfabb", "value": "6144:RLR/e74WECc7ig0lXoWXuKkrxNReWr+VfBm4l:RV/e0WyQlXo7M1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404126, "uuid": "074e44f7-bee8-44a0-974f-95cfbfa2fa57", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404126, "uuid": "b4be881c-fcef-47cf-9e7b-0f7180d8085e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404126, "uuid": "f9ffa2dc-83ce-4d49-957f-d37e3b38d01f", "value": "7cf461732cf9d151aed5ca9f15c9d689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc4efa9-ac9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676402871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402871, "uuid": "993f6285-4235-4f70-b06e-1e72461a6efa", "comment": "Malware payload (RedLineStealer)", "value": "4b162d35ea6a4ce1c2e2a79189395241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402871, "uuid": "8eb98c64-5e0d-4565-b576-68c6c139c458", "comment": "Malware payload (RedLineStealer)", "value": "9733868cfd42dccf876372845daff275fce62f2926b29930fbc45f3d5cad4147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402871, "uuid": "9d263e75-d80d-43eb-8a78-fff57e8e35f4", "comment": "Malware payload (RedLineStealer)", "value": "f08b5fa4b71d06189b8942cc35b1ecacedf5546c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402871, "uuid": "22c5485f-6b9f-4ded-904c-05776c8e0e7d", "comment": "Malware payload (RedLineStealer)", "value": "dfb7f831a14e25d04e6c90d3e504fb67b606ac44db2962619a5a917ab50ffb0c9e7316b25486d84471e10a33938a6050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402871, "uuid": "f273c379-3a9a-4774-b393-6c505c575d08", "value": "T1B8F41247F7FC9021F8B527B209FD07C309327CA15A388397268A7D9E1972660653E76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402871, "uuid": "618424ff-1b73-44a8-8112-0de9510bd8cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402871, "uuid": "46bd086d-b7c1-420b-bb41-fa9375d1309a", "value": "12288:3Mrly90wHW/8uMDvo1Ytdp9iNexB4FpMD5HNQ5XRZNramRCukcK5HG2OxrQ659cG:+yD2/L+wgd79jDBNQ7raiCuq5HdWrQQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402871, "uuid": "37452d57-ddb5-4f74-a176-1bd49c64f7bb", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402871, "uuid": "695c8bec-e5e0-4701-b104-fae3fc1c2b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402871, "uuid": "4a8e7d04-a149-4552-86e5-84450daa7828", "value": "4b162d35ea6a4ce1c2e2a79189395241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5b6f5c-acbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676417580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417580, "uuid": "0ff5a888-359f-4671-a3a5-73be6a66a1ca", "comment": "Malware payload (GCleaner)", "value": "bece1b82a54645859bf5d3951c14cdb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417580, "uuid": "9858628e-2bed-48aa-89c6-4eec666fcba1", "comment": "Malware payload (GCleaner)", "value": "973b3124de4a101ee32ec9e7389e461f684ea599a022d1c51da472335cbc0323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417580, "uuid": "b480f71a-48e0-4157-a0fa-267c8de1d62c", "comment": "Malware payload (GCleaner)", "value": "4bf63345a76892aff90d80d8eebf60e5eff9ec71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676417580, "uuid": "757307bd-33bc-40dc-bc73-d000598900eb", "comment": "Malware payload (GCleaner)", "value": "9cba8aec77d0817956a520a98753a03c3ddfdebf63629041bd29a63b96905f85ee7f9cee21a926f5fbe198623f50c163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417580, "uuid": "9ae83a17-d519-459b-93cc-5c3afc26c5a8", "value": "T131F5127C7105C8ADC680BEB88C26E4E75CC76DE3E9D0A46375D9BF3F92B91885A19103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417580, "uuid": "f4ae9dc2-6689-4bdb-8039-f6aba2927f3c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417580, "uuid": "e521b89a-83ff-45a4-a80a-a518d6bc4018", "value": "49152:rdHVK+WCTjQgru1Lp1VKFeH/tnfVL6kzVaCAMRjVfx/jwSBTdBS054LCgv2MR:JHVK0XQg6/KonGkJaC/LfxvB++wv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676417580, "uuid": "de4f536a-17d9-4646-aec1-21d56dd89fe2", "value": 3343067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676417580, "uuid": "41da3569-1f24-46e0-99ee-5b64300f8ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676417580, "uuid": "9761b704-56ab-42a1-b2aa-eb84eff76467", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e00afb4-ac2d-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676354556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354556, "uuid": "18e3abbc-b20a-4bcc-acc6-e9385b666192", "comment": "Malware payload (TeamBot)", "value": "758c48107441dbfe0b1c2f87c86d4605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354556, "uuid": "fc93aa95-4028-4124-9535-d22692e7e1f5", "comment": "Malware payload (TeamBot)", "value": "9751fbff38e23afbf3b42f966973322e01cef889a9cd722db3612e11dcec6a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354556, "uuid": "370b151e-d9d1-433a-9b8e-f9b26086568e", "comment": "Malware payload (TeamBot)", "value": "a415a20ed5eb4782c6cc04249dd48822ac4602fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676354556, "uuid": "15006b15-6c03-45be-ab21-f6c795d277b2", "comment": "Malware payload (TeamBot)", "value": "93f19b5ce5f266cd2e543592f0151c92695b2a28420299beb59e00fcc5273021e29cec79a46206c4a033f1691d103462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354556, "uuid": "2652c6ef-bb2b-458b-8c5a-bfa5da5be675", "value": "T1BE04D0523AE1C072D473C6746931E7A05A3FBCA297A6C097335016AF6E213D1CBB935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354556, "uuid": "ecba1dee-4899-4f12-a04f-397c1949edd0", "value": "81b62a0be155aced9a744e6e96a19e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354556, "uuid": "ed6b9b44-f0c6-4619-9564-deac329bcdb4", "value": "1536:bor1JBho83RkLHLZHke+ky5fS2jX3AEkFTu5hB5WsltxCxWvjHaZD9FfmYCz+9AF:boTyLHtHJQ5fS+AHmXJPv7MXNU+9bDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676354556, "uuid": "76012d69-e9d0-4ada-a36d-e1cc11859de8", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676354556, "uuid": "b47f56f3-7e08-4cf2-9144-205c3ff765c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676354556, "uuid": "c4b114cd-ef67-40f1-8198-b7d28df9aacc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e21e5d-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381495, "uuid": "afb4d256-b4f8-4512-9873-90ac07aca93d", "comment": "Malware payload (RedLineStealer)", "value": "5be76a434b8687ec0ec811a6583b5beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381495, "uuid": "27902751-f2ef-4255-b244-5e9404264579", "comment": "Malware payload (RedLineStealer)", "value": "976ca3d1ad58f10511e1b2e4b986f911fac48a8460db84f6dce2d08b1fc8297b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381495, "uuid": "a8cfef21-906f-41ec-8a32-edbccba8293f", "comment": "Malware payload (RedLineStealer)", "value": "fea89cca099321fc033929fbb35935ec460eae21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381495, "uuid": "c1c9a6dc-8513-4124-bea8-d744c18a5009", "comment": "Malware payload (RedLineStealer)", "value": "46df32914ad3f288e3d0ceb2ef5a9db6feb799c10888265cc320651b50c612fce24698e370fc0ee2f15168354e4bec67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381495, "uuid": "e0c29a59-984f-4270-a9a0-2e164a050152", "value": "T1F136127323234442D0EA4C318D2BBE5C36F79E754A83597D79AA7BC52A314F5BA03A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381495, "uuid": "5ad934c6-d603-47b4-b34a-ddb707e7e189", "value": "b0a438491df559e2ae875aca71787ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381495, "uuid": "0e1e156e-0df1-4402-86c5-4a5709d65565", "value": "98304:6I49T/+NCNjtBvLCOsDSUEoYIV1fj4Ksps1WA2WOnT3xtuJxd:6I4F/YCNjtBvLzenbfquJLY3ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381495, "uuid": "53b6d332-23c4-4aab-867b-9e31869523ce", "value": 5272576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381495, "uuid": "9b3bbb21-1dc5-4734-bac1-7fc9b0aac120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381495, "uuid": "61805e3f-a729-42b8-9b3b-b3133ba92e6c", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df35e715-ac65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676378905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378905, "uuid": "a5dea003-a42f-4b5d-aa50-076f0ecb27a9", "comment": "Malware payload (RedLineStealer)", "value": "29a53c6df25b963953ce4036138f9c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378905, "uuid": "c171920c-31d8-48dc-aed3-dbb6882a5d02", "comment": "Malware payload (RedLineStealer)", "value": "978ba49d259ce7f6f5d4dd8cc1f370c8f9f719e214ce757b8e8d48af35c80071", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378905, "uuid": "a8e4c94a-c3d4-42e1-8be8-62c81f703eed", "comment": "Malware payload (RedLineStealer)", "value": "8f51522df7c0bb557a11fdbfa362d6bf21d10c7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378905, "uuid": "a8d828cc-c7b6-46ff-b40d-0f7956d553b3", "comment": "Malware payload (RedLineStealer)", "value": "6e4b2e0715e4464b1a52870cc61d12687d910c539fad90e5e880104e57b26a9b58d394dece0945fb99763f7fd909e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378905, "uuid": "1bd5865c-f934-42ba-9ffb-2057102e8aaa", "value": "T135B4021BABDD8076E9715BB008F613D31A36BD60AA38871B174FAD1B1873660F13536E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378905, "uuid": "891596c0-55a5-4091-87d7-a739897cffe3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378905, "uuid": "4078c1c7-61a4-40b1-97cc-cb6ed32b1a88", "value": "12288:uMrny90wrJ252SaYVTOOItBxv3j8lOHb955TOoc/:tytdWTOdVwlstc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676378905, "uuid": "2f229118-1cd4-463f-b818-a633abd3b071", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676378905, "uuid": "536edcce-47e2-45f7-a623-989630f179a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378905, "uuid": "58e4ff7b-e96a-4e47-8f9a-ccf5a919490a", "value": "29a53c6df25b963953ce4036138f9c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02225f23-ac9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401297, "uuid": "8e78abca-b4fd-40a6-9643-ff8a9c155b00", "comment": "Malware payload (RedLineStealer)", "value": "8cb45175915f7a5a3a1279d7423a7520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401297, "uuid": "786c9d98-3c12-4ae4-b8b5-545aacc3fb7d", "comment": "Malware payload (RedLineStealer)", "value": "97b5701ad09bea38e4bdc99117d026a05b29d7fdbbededc70be6855cddfd9b39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401297, "uuid": "4a19c87c-9cab-4a14-b05c-ce5f9dc8179d", "comment": "Malware payload (RedLineStealer)", "value": "f350cf67788ef50b148f48417cf2d3996552142d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401297, "uuid": "8e94c00f-928e-4cf8-91ad-8cbbb7b113c0", "comment": "Malware payload (RedLineStealer)", "value": "6185ff9ca54afed356932aca7689e63369d46dde4679c015349e10cba91b89e0186fbba7c132aedce8ff22cf929a55d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401297, "uuid": "6fcbde2b-0e9f-4840-b0fa-f69c7652c46b", "value": "T1DC74961F74BB7B5CE195A6B53994EE88E8E3741887220E62F5D0851F7B3E280CD270C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401297, "uuid": "a5804c2e-416e-42d1-a4fd-c6ec644e3e0a", "value": "c0a0dc5efcf313a25eeff245ebb1015c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401297, "uuid": "7c837ac5-baf1-4350-9226-dda40dbdea6d", "value": "6144:XYNzvLnjA5AgwobtV2PcmBGVVChO7/91CxCJpPixWAixWAixWAixWAi433YY6on:l5yAV2UmYeOp1CUJpPixWAixWAixWAiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401297, "uuid": "026f47ae-51d6-49e2-a856-105cde0236c4", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401297, "uuid": "461ee2ef-27a2-48ab-88a5-5551ef3654e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401297, "uuid": "608d9de0-525d-457f-8c34-ad0194cad0e0", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3b702c-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369367, "uuid": "532d9936-82f0-4aec-a3a1-f0cf55dc6fe3", "comment": "Malware payload (SnakeKeylogger)", "value": "f17903cd6d1776b6de8af1895e47683e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369367, "uuid": "0434b89a-2833-407e-88ee-6001b046053f", "comment": "Malware payload (SnakeKeylogger)", "value": "98536221ae4e88e5e4348cffe9d94364f4e985632eb18f59d7ff0d685ac3395a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369367, "uuid": "cf7a254d-ccbb-40af-8d3c-c8a020ff7b95", "comment": "Malware payload (SnakeKeylogger)", "value": "49df56c3712f7de4a4ef383258dd6711dd5869b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369367, "uuid": "0d45a7d0-ebef-4dad-a235-19536df7a8c5", "comment": "Malware payload (SnakeKeylogger)", "value": "623eeae80ca44ea6254d64c4947b4f7a6980dfb5066035a4e469fb1636af3c463431359aacd60febd69e514d57d84049", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369367, "uuid": "5ffa62db-fe7b-444f-bdf1-e40dcc59699b", "value": "T1E834F1D720D6816EC2AB5E3464749310C7A392534938F66EF34A65AF1FBBFC08A157B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369367, "uuid": "be038996-566d-44b5-8b48-a4399456073e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369367, "uuid": "7bf04d4a-eb67-4b1e-b94a-51d6ef75f81e", "value": "6144:nuFDutOc6duxKLolts5CdubjKlq6hzDvcbMfoCDrqr:uFDutOc6duxKLoU5Cdubjr6hzRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369367, "uuid": "faf14eac-d559-4ce4-94d7-fdd9846fff02", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369367, "uuid": "45bffab6-7d6c-4bd0-b56e-1a4c1ad8b6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369367, "uuid": "631af89e-cf28-4af9-9037-193145ef0acd", "value": "SD098578-876456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6e1527-acae-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676410098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410098, "uuid": "486220b7-9b4a-417e-ba29-f96ebc510098", "comment": "Malware payload (RedLineStealer)", "value": "b23d86964b55581adfbb5817087deac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410098, "uuid": "e2978d3b-7f12-4318-aefe-e6776c758e2c", "comment": "Malware payload (RedLineStealer)", "value": "98aefdb22469ffc15030589ae600294f9749a0a8a09765f9332595f3558e971e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410098, "uuid": "d0c1e66e-8c75-44ed-bc4d-6c1c654661a9", "comment": "Malware payload (RedLineStealer)", "value": "181a585e3312be217beddde1a60c1d6855f7f004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410098, "uuid": "5fe8ce76-09b2-4210-82bb-a8740797a13e", "comment": "Malware payload (RedLineStealer)", "value": "bc4362276b46852ff3663b97e913831aca3a0a8607df4eddd0d0d875791309e22d58a9a1202e67180b24dc245f2960cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410098, "uuid": "731c1b85-5e22-414a-8237-d0f277d43471", "value": "T122252343A6E880B3DDA817715AF642D70B397E516F35938B238DAC1D18736A0B63173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410098, "uuid": "1114c2c1-bdf9-4754-82c7-93a6ab9510b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410098, "uuid": "6f1dbb9b-9057-4244-83c5-42f118a66da5", "value": "24576:RyXlMHU9SWPiHNEpUqXaF4ItwK0m6NGiF56jbe3:EXlwP8o+pLgLtD6N36jbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410098, "uuid": "4986bf12-9034-4d5c-a852-0526af51b712", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410098, "uuid": "ffe7c05b-6b86-4251-88cd-7b841af0cfdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410098, "uuid": "bdd84c17-1089-4ab1-9d3f-6260f155b399", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53703433-abfe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676334432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334432, "uuid": "8fa4e229-ede8-4c41-b947-5ae06358a770", "comment": "Malware payload (RedLineStealer)", "value": "583181f49bac625c1a3c5104845ac0e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334432, "uuid": "32fdded5-154f-4125-b3b3-24c4b830807c", "comment": "Malware payload (RedLineStealer)", "value": "98d86ef941abb6eeba8339b677d261cefbff7044362743cad08f781731795b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334432, "uuid": "0ff56198-ae66-4142-bdfc-fe1a05a051fd", "comment": "Malware payload (RedLineStealer)", "value": "94ec35d39c318e7e685066946d005f6da0c5234f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676334432, "uuid": "8e1fdc59-4f57-420c-8f62-aced33523ad4", "comment": "Malware payload (RedLineStealer)", "value": "6666d60e842613acaac9b659db7f43dfe8d2a3001f270539d65374701453003ba8a05b0df69b9aec808f1dfaeda11661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334432, "uuid": "927a7079-aa55-4bdc-b1bc-8bac4981dac9", "value": "T199F4120BABE89462D9B4177019F207D31B357E205E38C25E364FADA90C71671B63636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334432, "uuid": "0979e18b-c7e0-4d86-a688-d14e02a26d3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334432, "uuid": "6b561cef-7a2a-4b76-bde4-424e1d5d1572", "value": "12288:zMr8y90marAP4S+mw7qXHJ1QnF7tixkkeJrSj60Fc5eKGRRkP5tPD6QpF7nN:nyBffw7WHJ1QnF7ccGjjjK9P+QpxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676334432, "uuid": "5ce62034-29bd-4ec8-b6e2-6e3281ee194e", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676334432, "uuid": "f5ece6bc-a83f-4416-92f3-5ea3345cd3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676334432, "uuid": "00c07ef6-2b7f-4917-9305-a852a3500ce5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e14bf1-ac1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676348793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348793, "uuid": "1df3a47c-6073-42db-bef7-27d2b23c54be", "comment": "Malware payload (Smoke Loader)", "value": "9183f6f0df1f025130f38baccbd302fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348793, "uuid": "50658a16-18d0-485a-9b8d-ca467d391422", "comment": "Malware payload (Smoke Loader)", "value": "98ddbf192242a49b18fcd36c04c4f18814c29c8da0332593805620b114d4c7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348793, "uuid": "bf76a787-2742-428e-a39a-f8595260b16c", "comment": "Malware payload (Smoke Loader)", "value": "35201edc00d01fdadd577d856db96ef2cb562078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676348793, "uuid": "27b72b9e-1170-4b29-8dd2-1fff264b1fbe", "comment": "Malware payload (Smoke Loader)", "value": "fabaa6521b1c05d3ce16c5d934ba536cf67b8688e074b428f466b7d33b9092fb796634e6a10fa704b4792c5dc020bc8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348793, "uuid": "706a02ed-806c-4e22-af3a-dcca26d4d1c1", "value": "T1E614BF12B2E1D871E4220A318C29C5F46EAFF8214B6596DB33946B7F0FB17D18E76385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348793, "uuid": "71304e4c-7925-49c8-9cef-c1288514d49f", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348793, "uuid": "7e2dbb1a-f58d-4e6b-8b80-c4ac9aa2d971", "value": "3072:1pdluRa5zKmgB+iuBUmdFOttzCFPSNYFt4nzZuEV5FiSh6kzuj:1EcKrammdFYtfet4zZuEV5FHh6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676348793, "uuid": "2ac036b2-52a6-422a-bbe2-c7cd29698bea", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676348793, "uuid": "44f17b4b-bc01-4c5b-a6d8-b9c1bf30e9a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676348793, "uuid": "47b5ed26-5cf2-4b63-9896-e8d7c85fdd6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3070a7-ac45-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364807, "uuid": "9b4c87f8-9183-422f-b9ff-e1110f73a395", "comment": "Malware payload (RedLineStealer)", "value": "4a207c36c3128a11dbd219fd4203c4b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364807, "uuid": "11a70186-4f75-4734-ac07-700a9770dc67", "comment": "Malware payload (RedLineStealer)", "value": "991b1e9e8d7711415e43af3ead47f9934be2424bb5a5d2835a4072643af714ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364807, "uuid": "149684c5-72a1-41db-b67e-2ed7adc23a04", "comment": "Malware payload (RedLineStealer)", "value": "bb58c8c24548b10f1ed8519e8ecc991bf8e71916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364807, "uuid": "85e50d97-5bd8-48cd-9341-362a6371ee74", "comment": "Malware payload (RedLineStealer)", "value": "732ad00f748f4b2dab41d9bd7d92767e28277bce4849f45b3453eb95395adbaf9e8b1ee211e6c5c9786462867db15afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364807, "uuid": "ec933405-e219-4fb1-8168-4f8f66f05b60", "value": "T142F41203E7F89522E4F1577098F713D31A32BEB06A3443DA628B9D190873A71A63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364807, "uuid": "7e7240b5-719b-42a7-a6f1-fefc78430b1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364807, "uuid": "8f737e72-1498-4567-9cb0-a5a0a2365a52", "value": "12288:QMrAy90trn+RM5RLf6z0O3wmQoFd4HXvOR+gdCF7QdzYgWhiU/r5fu:Ayorn+RMDu0erQRHXtgde7wYgWhigr5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364807, "uuid": "c73a0a4e-e629-4467-98cd-899953109623", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364807, "uuid": "38d78b1f-c274-409d-849d-bdb171f920a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364807, "uuid": "61398b9d-f65e-40f1-b929-fb8c56eb3195", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef529a8-ac56-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676372247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372247, "uuid": "4ec3e1a8-6c2e-4944-92dd-449f66519f24", "comment": "Malware payload (Amadey)", "value": "de25f80b75c009b9abbb670a7b675c33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372247, "uuid": "2ec3aa5b-b20d-4c7f-ae9d-b5380ee7a050", "comment": "Malware payload (Amadey)", "value": "993fae410de88ca66cb5ba99a1b28528069f74298696fc533faba14d99c5689d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372247, "uuid": "80cd05d0-3ceb-43fb-bc01-4ce569509dd9", "comment": "Malware payload (Amadey)", "value": "6b42b14ec6befca7b6e0092caf894823eecddb40", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676372247, "uuid": "f3b02868-ca0c-4acb-a922-f7c7f3bcf783", "comment": "Malware payload (Amadey)", "value": "989526b5f9de3e3e2daacb5d685792a3d857169420596a3a24bf1fd2452f3364d5b0eba0148541b09b280ea20935b7e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372247, "uuid": "c297f299-3db8-40af-b5f7-efdacd328077", "value": "T164F41297F7EE9222E8B46B7018F707E30A37BE505A398647274E5C5D0C721A0B9713B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372247, "uuid": "7a902d99-53d8-4eb9-8cad-98f45fe05945", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372247, "uuid": "4cf98ca3-0c24-474d-8f76-6b162fbdcb77", "value": "12288:ZMrSy90dBtssXUjzgn5lyDELw4eF8PJvDZDJxgKChMj1cxXMvCc11/f7mrVOb7nO:byCtnEjzg5WEs488PJvDZdCxhMYcvCUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676372247, "uuid": "631aff5a-99b9-4d18-9f55-05eda6d95b0f", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676372247, "uuid": "6ae67864-d5d2-4585-8e81-5d280340210a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676372247, "uuid": "ce876ff1-4723-4fa9-9baf-39e1840b5188", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6f1825-ac75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676385774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385774, "uuid": "af338f7c-adce-4bb1-8169-6b787eab907a", "comment": "Malware payload (Amadey)", "value": "e0a25f1ba75e82927b89cd89451a5417", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385774, "uuid": "d28b2adc-29bf-4e1e-82c5-3f1fedb84435", "comment": "Malware payload (Amadey)", "value": "996d837c0c09504cb078af339ce50595e4fbb51780bf052021b62e6b91e3dddc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385774, "uuid": "6109d034-b0d7-4369-ae58-f8e6a16fe872", "comment": "Malware payload (Amadey)", "value": "c96daf82787beee275e384dc0140c647d09bf7e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385774, "uuid": "a9b73fee-2385-4867-8877-68b2b1bff556", "comment": "Malware payload (Amadey)", "value": "e1410654c88e87eb2abfc4af2fa484e180ab4d11e180f39bcf3538d3153967007ef60d12534da07a4bb7d4e4f1c8db40", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385774, "uuid": "4bcf8af0-1fba-48ea-80bb-defe03c51fb9", "value": "T165F41207B6EC8131E9B557741DFA07C32A327EA05E3587AF478B9C4D18725A0B93236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385774, "uuid": "ca148250-e754-40ec-8069-10a5443349ed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385774, "uuid": "b06e92fb-8cde-43c4-a3f0-bc5f499db5b0", "value": "12288:lMrDy90PybTaGVa0+qe4vOhpcX3PqRnZZGMD5+L653hpF/WNr2h+rMOhwG:KyGybVVatyOPCPqRnZVDsL6NhX2FrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385774, "uuid": "a3965aee-632a-40bb-b9fb-ed3db3f3bbf0", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385774, "uuid": "eb282eab-378e-41cb-a970-28916a304e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385774, "uuid": "2cd0d07e-015b-4ff0-98d3-4ca91d816aa2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fff8d73-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1676391442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391442, "uuid": "241a12cb-d1b2-4f9e-bab5-debd59c02779", "comment": "Malware payload (NanoCore)", "value": "4e69292de9fe35193cd09a7e817391e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391442, "uuid": "6d1df7fd-ecb8-4b47-bf2e-a528f0dcefcc", "comment": "Malware payload (NanoCore)", "value": "9986462b72acae9cd44ad422abe31e33cdeb2cc606085a92063d2047745bc3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391442, "uuid": "74f221dc-0b0f-4f43-b1c1-018b0eecaf50", "comment": "Malware payload (NanoCore)", "value": "1dd67e63a08664dd4e3dae03d61042d787661325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391442, "uuid": "51c08afd-facd-4f0d-a0c0-a0248d0f2685", "comment": "Malware payload (NanoCore)", "value": "da5fa06c080b8221dec64a78644d71d8bf2422c795345e3b59fc67070c615e37c22697c6b8c01d9bd772e968a61db719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391442, "uuid": "5aa5b381-65cd-4f4c-a31e-2d326e3024f0", "value": "T17115D43CD9A82D2B4272E579EAC5F417FA9048D7B71D8D9F82C2AB520503513BC9BC2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391442, "uuid": "4449c311-1188-4828-9056-7266cea549e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391442, "uuid": "68e909d6-5485-47ee-8e1e-76b2e7913f5a", "value": "12288:3LHnyJf6ojUQWELGJjdvUJDLo0w2vn/8GfGQ06a/W4hhK:3LHaf6ojHPL2vUJXfw2//80KWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391442, "uuid": "411ec40d-27b8-48ea-b518-8e770d7b377a", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391442, "uuid": "12a2c4b7-1617-4458-ae35-6f567476962e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391442, "uuid": "4aefc71f-1295-4efb-9a07-8987fa18db43", "value": "4e69292de9fe35193cd09a7e817391e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef299b6-ac85-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676392622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392622, "uuid": "a78b50d6-1803-420a-ada5-c2a882bef669", "comment": "Malware payload (GCleaner)", "value": "77c7fe4a6525a6e403308d4c0cb34fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392622, "uuid": "61298b1d-0a91-48e2-b353-505f645af93c", "comment": "Malware payload (GCleaner)", "value": "99c174299dbb2e0fc5a2fa4bab7bfbc95b7ce2c510fc043a5a4a952a61d28ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392622, "uuid": "e589f64e-ddf0-47eb-bcdf-42daf987a217", "comment": "Malware payload (GCleaner)", "value": "ff323b1849877b5b567e12ddaedd02ca2dc82a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676392622, "uuid": "9d28c340-dacc-4d1a-8eb0-7b5e42b30647", "comment": "Malware payload (GCleaner)", "value": "d5791e659bc22bc27d950dd4627fe8f2315895906a0688d833aa961c9ce9dfade14b071569cf99c1657070c94e226c23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392622, "uuid": "d4d0f115-8a2a-4f01-bfb8-479dee62bf76", "value": "T14144F152BCE05832C8FAB5318872D71519BFBC601A21D94777F9225A6E323C09EB57CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392622, "uuid": "2577c793-d0ee-423f-8f93-19b417814e38", "value": "033c129a4522b4dc7e5484557290091f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392622, "uuid": "f93cb281-1174-4aab-a7fa-c35703061db8", "value": "3072:6lZOL4sT5oF2anGSNuiUbiUl0fyfbZOjWCJAfr249TEVVjlI0gqpR+x4wROgEBZ:ZL4sKHGoFUq6AJufr19TEO0gyRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676392622, "uuid": "55b229ef-a583-40f1-9764-0562af52f3fd", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676392622, "uuid": "6f68a22d-3d35-4615-b4d8-9a4e8c836fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676392622, "uuid": "005e5758-c15e-44c4-b5e5-82b3185466ba", "value": "77c7fe4a6525a6e403308d4c0cb34fed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d95d18-ac5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676375161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375161, "uuid": "35ba54e3-360b-4c73-b93d-372306b064c9", "comment": "Malware payload (AgentTesla)", "value": "3ce8466126155dda1f7925f19eeffbde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375161, "uuid": "bdef0125-6f49-4d93-9134-ee7149e98a3e", "comment": "Malware payload (AgentTesla)", "value": "99f7368761e35109beafc17fde02051f24e04a3fe3f8472bce2c32643e9988be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375161, "uuid": "90436add-a8b0-49f2-80f8-bf7c30d8567f", "comment": "Malware payload (AgentTesla)", "value": "eef1cee33fdc03bda74ce5a03f63308bdf032070", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676375161, "uuid": "875ff681-de49-4f35-9c27-4fd5b7de238c", "comment": "Malware payload (AgentTesla)", "value": "b97d865b00ebd96be098c12445eb811fc3916d15ee261892e5c9fc30367393bee7399ea2806e73598955cb468504cbd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375161, "uuid": "4231d345-3599-43a6-8fe3-093074d6431d", "value": "T1A6E46C8DC5BD4212DAFD0F7DB19F29480DA0004A266E4D3B97E7F880E57326A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375161, "uuid": "685e21e6-7d0b-4b80-81d0-f5b6e00ecbd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375161, "uuid": "af94bdfd-e0d2-4916-9ccd-823cb13e07e1", "value": "12288:niecesAvKYn1kL7tQDNE4+iwleItigI1Vn8TX9auiHaac+r1WNElKM:bces4E7SDQi0eMi9Pn2X9auiHJz1WN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676375161, "uuid": "63e41641-271a-436f-8187-1843457ffe8b", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676375161, "uuid": "c3374db4-db85-4377-9256-52fc64562ce6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676375161, "uuid": "491c6406-eb60-494c-b27b-346fdb1dd160", "value": "Teklif talebi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82f1fa5-acbd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676416662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416662, "uuid": "991fb952-7a11-4592-8a50-4891854c6db2", "comment": "Malware payload", "value": "c7e81b5a3fb1f2ae26cbaa1bbde35c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416662, "uuid": "7b3c177c-f30f-4af0-8b3b-f827b75b6249", "comment": "Malware payload", "value": "9a03216fe3b867e74a4e7daeb9e08e8346ce747baee4702a4769e2b354da2d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416662, "uuid": "5dc2fc85-699d-440b-aecc-63b52b6257e8", "comment": "Malware payload", "value": "74bb46e080b28cf5f04037f98335ba77be61f062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416662, "uuid": "220f5d4c-68d7-4fcf-a9e3-9910999b5015", "comment": "Malware payload", "value": "2aa4b9683ce839c4c75342b21fe892aede545e3f372a9fa4f3922fd9c2e8a5ad8aed6a41bed5336147fcab27ccf12f39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416662, "uuid": "4f323031-b673-4d37-9ea1-69703da23cc9", "value": "T139258C8137F19462F1DB05B51028778C1E3D7443A6E6E2665BBB39C49703ABBF298F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416662, "uuid": "3941132f-1bfc-4806-a373-7026e1e4c9c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416662, "uuid": "65735227-246c-4228-a837-5dfcd9c2926e", "value": "24576:keVaU2rgiX9aqtvc1Xw++tkOom0BtSxpIGnr8zw6Rhc4N34H:k5lgbac1XR+tkfmgtmnr8zU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416662, "uuid": "7a8561c4-7279-43e1-b397-a80404cc9a7d", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416662, "uuid": "ec765c4b-3186-4a70-8ba2-1ed47bcda082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416662, "uuid": "f8d2a596-51b9-4174-b7ab-a251ae39ec0d", "value": "PO-191021-02837.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db570435-ac9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676401662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401662, "uuid": "d73cd3b2-a49a-4eee-b977-85f8970c1006", "comment": "Malware payload (RedLineStealer)", "value": "6bb2664d8fb5de718843599575641911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401662, "uuid": "47c6dc25-c912-4d9a-814c-9b65de192119", "comment": "Malware payload (RedLineStealer)", "value": "9a0d523224ed382417674d3fd72ae39d3d6b81c6614476f75005569236886b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401662, "uuid": "96fcad43-fa8d-4d75-921e-0cf484e28fa7", "comment": "Malware payload (RedLineStealer)", "value": "73d06419772a05d581fe76fb938d0ad1d0499a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676401662, "uuid": "22a1546b-3abd-4387-814a-4a1afe4f73e8", "comment": "Malware payload (RedLineStealer)", "value": "006c96bf193882db61f998b02ae6d6ff67f16c2dd4519fb24c77a3ec9393a74ed27ca2455ec553c1059b9dbe9943b75c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401662, "uuid": "4a766bd6-cf2c-4ac9-81c2-60e693bd8f64", "value": "T162F41247F3FC8032D8B827B019FA42C30936BE614B38975B255A2D2E19B2660777577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401662, "uuid": "c156cf9f-46eb-477b-9db5-59c3701545b7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401662, "uuid": "f4282b97-6f82-4ae9-9ac8-d2ac011b3be2", "value": "12288:KMrly90cRsnQ1ErSFvy2cHE1bU196oEkcw5HGCD4kZ6Q0WD21X:HynR6Q1ErZPHB196oEQ5HJMkZJ071X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676401662, "uuid": "8d1698b8-46f3-40e1-9019-3920b10c2a8f", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676401662, "uuid": "ede04da3-5088-4688-aa9b-aaebbb778e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676401662, "uuid": "874a05b1-829b-42e4-945c-c762c7df8322", "value": "6bb2664d8fb5de718843599575641911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3311c7-ac09-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676339118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339118, "uuid": "2d2dbaca-fa37-4931-acbf-a2140228d4af", "comment": "Malware payload (Amadey)", "value": "9eb477ce025e71c9985df8f8a0a84a30", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339118, "uuid": "503abdd6-d327-4d76-8007-14babfbd93a2", "comment": "Malware payload (Amadey)", "value": "9a127eee161c614e8c18158b0551df84456baa95af8cd9625c6b06083624a9bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339118, "uuid": "adbd70e5-a708-40c6-92c0-306e8c1b7e6c", "comment": "Malware payload (Amadey)", "value": "aaad20cfc50a7838916387d36be5722c16779d2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676339118, "uuid": "b62c4451-f4fa-4746-884f-1f7b9e2adcbf", "comment": "Malware payload (Amadey)", "value": "80f355342281a37374c2d00d063fb91172423a48b75edb9d8beffd7e9064f5046e284e479e9307ae2d3d8500f0f10e6a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339118, "uuid": "6ac7ff00-8c32-4a57-87a2-927104b4cb54", "value": "T1E4F41207F6E88022D8B4937058F707D30D36BCA1BF388757264E9E6A1D736A4A975327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339118, "uuid": "3a65a9c0-3636-4c5c-98c3-292288bba868", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339118, "uuid": "d4d1bff8-6a72-4606-b4e7-a199dc6663a8", "value": "12288:yMrNy90dcnwBp4IFCzg7pnkmuNyCWZemyaE6qvD3+JtHxHQ5dYNXfTr3GmqMzvdT:zyCM7IEzgFnkYCUtyaE6qvD36tHpySvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676339118, "uuid": "8544d1fc-9c37-4596-8263-cdef3b55e437", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676339118, "uuid": "48be21b6-ba41-4f2a-ac1d-4759d05bf714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676339118, "uuid": "d85a652e-4e94-4c6a-aa1c-271e8ba2216f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a17e07c-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391432, "uuid": "82b9faa5-17bf-4d0b-ad67-c139e054dd68", "comment": "Malware payload (RedLineStealer)", "value": "0214a5f244e21051dc97d1854f7a8195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391432, "uuid": "57fdcbe5-acfb-484e-ac5e-003194343baf", "comment": "Malware payload (RedLineStealer)", "value": "9a777a1e92e31b1137c0d90c749eaa78e34e79a8708da66edacd997b52ca0478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391432, "uuid": "098bc1d6-f42e-4798-bcfd-1c1a490ed43d", "comment": "Malware payload (RedLineStealer)", "value": "08162603074decdb65404c06f22d534888427b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391432, "uuid": "8d17d8b7-eaac-44b4-982a-0c5538dd4dee", "comment": "Malware payload (RedLineStealer)", "value": "6ea100c4e9b52acfc382228f3ff04a8978db22ad2772b41c784afb2d2f33e2693773afee34465be58554d3627af2aa2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391432, "uuid": "80338e96-0065-4092-9801-dc7aca924531", "value": "T1EAF4120BEAEC4071E9752B7029F706C30636BDA16A3C9367274F5D4D09B26B4A23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391432, "uuid": "ee2f599e-6885-4e77-be3d-2aba979ecccb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391432, "uuid": "ab881353-3966-4689-abd4-ef88292fce8f", "value": "12288:yMrZy90yNJKmBFy9kQHB/whHbgvuYVvKB9YdoDgnaVV3Hq4tSe2fF2eR6:jyjadkQh/+gvut9mopVV3BYfF3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391432, "uuid": "ed8f080c-1ba7-427d-a777-fdca805c52e9", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391432, "uuid": "be4de740-c689-4832-a93e-2b6ce675cf17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391432, "uuid": "d5a34058-6e23-4335-a182-d3dd56260adc", "value": "0214a5f244e21051dc97d1854f7a8195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504783d7-ac6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676382101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382101, "uuid": "55c98251-6408-42a8-951a-9efa596e8ac5", "comment": "Malware payload (RedLineStealer)", "value": "0134b80367a9a0b2eaa40bee26722807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382101, "uuid": "9fd6334d-82bd-4599-8378-87190b8daf32", "comment": "Malware payload (RedLineStealer)", "value": "9a7ceb9ee65d555df0dfd7ce1e3f4b0bfc85b6fc61e8186b0dab4131b8c4f897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382101, "uuid": "c6f1eea2-0bb2-4773-a830-7950246b5223", "comment": "Malware payload (RedLineStealer)", "value": "d52e4bb142f0cb5ea80d4fd99ddd9753e79ca6b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382101, "uuid": "d01b5234-b94b-46b4-813a-b603d3723f51", "comment": "Malware payload (RedLineStealer)", "value": "94477993368949f4a38b37c593ab1e095674217bd708c6c19d95f8e0c3827a647bd8b115e5ce05ebdd491e9591c176b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382101, "uuid": "e4e5c0d2-299b-46d9-8abc-4d9b8627a9aa", "value": "T1B7F41257E6EC9022E874577429F606E30937BEA09A3C935A238F5D5F0C725B0E6353A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382101, "uuid": "751e00d1-7b5a-4284-9287-cb5caffa620c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382101, "uuid": "16751e67-f413-49e5-b9b4-e2bd685d076b", "value": "12288:RMryy9015aNfYUZXhlkUKJvnePZ+B72SPD+K6HhNdTGXMKgt1ke75lnP9mkbFk4M:/yo5aNYUZxlZmmPDhrdicKgd5Nhk45i5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382101, "uuid": "36f839e1-a028-41f1-95e7-7855635c2fc2", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382101, "uuid": "fb206609-6f6e-40e7-b428-995effa868e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382101, "uuid": "aaf588ad-225c-4cde-bb40-45a88512e6aa", "value": "0134b80367a9a0b2eaa40bee26722807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c89779-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419027, "uuid": "c90b6437-f43e-418b-a37f-4004acb53ed3", "comment": "Malware payload", "value": "45b5ac59c4d51b019cf7f43362511dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419027, "uuid": "1d03b9de-ba11-4b3d-8403-eaa19b1e3d86", "comment": "Malware payload", "value": "9a8cc1a99e2cd00a2d67fc6b7a4537e76e2ee9e9beec9a7592d7c9a12c973fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419027, "uuid": "0973b539-de5f-411e-8195-a75e384411b0", "comment": "Malware payload", "value": "0fa158d0c89860cd8ef92ae821b0d85236ff757e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419027, "uuid": "ded2847c-37a0-43c8-aecc-594cce018ff5", "comment": "Malware payload", "value": "88f9e31c436dcc6dd08eccf4ad60098ee98a976033d6ba55cbdac08b45c7287d6d934e686768708fd751e03b393944e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419027, "uuid": "d06fcce2-5437-4da2-9a76-35c11823aa3f", "value": "T14315124BDAEC8126D9B107382DF707D31635BE505A784247734E6E6E1CB37A0A0763AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419027, "uuid": "50b086a8-50db-4c38-9cb7-ad7ff62db66c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419027, "uuid": "b275f544-d686-4f78-bc00-7dbcf3a01282", "value": "24576:nyKZmpN8DA8l+kqZO1LY+rA2KuWKeN5jT8O/J:y8mMsw+9ZO1UOAnPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419027, "uuid": "8c9ddc9a-dfda-41e8-85dd-c5eed6abed38", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419027, "uuid": "3fdfb375-b79b-41c8-8100-d90c37913d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419027, "uuid": "99ecbd3b-9a07-403d-a4ec-70a4b58ded1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1123d7-ac20-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676349269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349269, "uuid": "fbeb26ba-a82c-492e-a8e4-93838f78e4cc", "comment": "Malware payload (Amadey)", "value": "92179af9c276dd794dbf8d3597b53d2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349269, "uuid": "d0835b34-0523-4a87-8c02-bec83c6dcfbe", "comment": "Malware payload (Amadey)", "value": "9aa30d8d25100cef3fb769014120cbfac721ad104e8fb9f3334d40db25a61da6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349269, "uuid": "dac5def7-958c-43d9-b893-664f9901753c", "comment": "Malware payload (Amadey)", "value": "b8722f07b3ec15643f245f19a3b0f423e3923823", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349269, "uuid": "af8a3865-a7e8-4575-a11b-63acb0c1c306", "comment": "Malware payload (Amadey)", "value": "a32720270f8aca2de76aebbd0e4a1ed077a92ef2da29394f084034b264a751ec704f43b1f4002025b426583ee5b0f5e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349269, "uuid": "3beb4cce-0f78-420d-b34c-41149be6cfca", "value": "T124F41247F7E86021E8B1AB7059F602D30A36BDA16E74C796278FEC290C32264B535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349269, "uuid": "5dfbb7b5-bcbf-45aa-83c8-1be102157d8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349269, "uuid": "eda46f86-cee5-47e8-bed1-9358a830743f", "value": "12288:pMrty905gaxGKzocL6olgiYSI6NRFJ4grgWbAenzDltAuv4gJ/N:UySBxzkc+olgVSIngjA0XTz4gJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676349269, "uuid": "0a447b91-b1b2-4f03-bddf-454245cd1152", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676349269, "uuid": "0c6c560b-1fdf-44f1-8eda-28d6e103505f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349269, "uuid": "adf07f3b-7e77-48ce-8393-a3e78e9368ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0963e3c8-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676382412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382412, "uuid": "9ccb90c3-c5fe-4f0e-a68f-4930c3ab2d86", "comment": "Malware payload (Amadey)", "value": "af6da7a8470f5b0d29a8091e7e7ecd87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382412, "uuid": "71ee7f52-3231-4afa-b4d3-82ffb617ca7f", "comment": "Malware payload (Amadey)", "value": "9aa42f2e5fd4553d6f8d3e2a11631913d3f75f2060e119e9a7f2a68df3ecc539", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382412, "uuid": "0ed2982d-0c10-462e-a294-fcb47cfeef6a", "comment": "Malware payload (Amadey)", "value": "8a8534088acc149d020d6f542525377ce2b11b5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382412, "uuid": "73cfe88e-f6ca-415a-90be-bfab6f594d57", "comment": "Malware payload (Amadey)", "value": "e693451b636279c79f30561935a09ffbfe4b419a3b57b870a791d16569cb31a6d79423678469eebbe3f5e0dcf2991eb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382412, "uuid": "5d32e8b9-0230-44f4-83c0-3cde8614e727", "value": "T1C3F41247BAD99132F8F0577019F207D30B37BDA19B389257234EAD5E1C722A0A97532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382412, "uuid": "af478210-3ba4-4583-9662-a287a76ee5f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382412, "uuid": "5cc06b0f-0d84-48cf-8889-09448e619f33", "value": "12288:DMrxy90sM3jAqqWTisedWWW38DjVAt3vDnJJ45baXXIK1gaoXMvvc11/u7CraObQ:Wyn7qKsetjV23vDnT45bIXIPaocvvpPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382412, "uuid": "a8a1fccd-8744-4212-8f64-6cf1359a8959", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382412, "uuid": "48ec79ba-f31f-4aab-8e5c-1f5005395db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382412, "uuid": "58c6cd37-3435-4f7f-910f-10408d3e34da", "value": "af6da7a8470f5b0d29a8091e7e7ecd87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c019007-ac6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1676380832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380832, "uuid": "50f98400-ed1c-406d-94d4-e734e2c9eaec", "comment": "Malware payload (Guildma)", "value": "b06c65866b864eb12efcb7d1956a72cd", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380832, "uuid": "9c6f6678-2f90-45ab-8932-99e891eb3f2c", "comment": "Malware payload (Guildma)", "value": "9aabcac5242057393d838df592fc55c2bd29b35911fe3ee99e2469bd41175a45", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380832, "uuid": "d352b4c6-737c-4a5c-b402-93103a124490", "comment": "Malware payload (Guildma)", "value": "e2fbf884a8db7480b7769ee367f729511bbcce99", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676380832, "uuid": "765002f9-94ce-4db9-b570-4a8bb42a1886", "comment": "Malware payload (Guildma)", "value": "71d27bb0367dff6dec0a63aec95286cfde57ba1786f793009d5b345ac9f894cbaa44aace1dd595c1ec1b1e3fb55df7c1", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380832, "uuid": "699e9c90-d6bb-44e8-9afe-dbf5e3349679", "value": "T1C0F0AB5AE040BF83D23C5A3B4E0713254C083D9B0F013222AECA06850510A047E0E190", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380832, "uuid": "ed910885-59b9-4900-be3c-063502dd3fa8", "value": "12:8rflM8OBE6ZGNgkUwNDVf2KjdYLYWOmIm7AhoqUQmLFpo45l:8loGNFPNIKiLDOjm7AhoqUd0ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676380832, "uuid": "36210827-9a38-4f0e-b0e6-dcec05b08820", "value": 477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676380832, "uuid": "20212335-c660-4a38-b28b-26d26f2bd0af", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676380832, "uuid": "a626e64f-e79d-437a-9ecc-e13ada4ebc59", "value": "b06c65866b864eb12efcb7d1956a72cd.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3813e5ec-ac22-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676349848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349848, "uuid": "84fc42d6-6258-4a22-add9-e7f728bd3096", "comment": "Malware payload (RedLineStealer)", "value": "9161730c2e58bda41dda09695001adb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349848, "uuid": "6b91803a-61b0-40ac-9711-dcdb5a9f8868", "comment": "Malware payload (RedLineStealer)", "value": "9ac0e23e4499363011fce80492d64dbe2656d33b5451ee0c0fdc22a926b00ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349848, "uuid": "877d21d3-c07e-4739-ac8e-adffe05b1712", "comment": "Malware payload (RedLineStealer)", "value": "bc48bff46531bd86ea626cc2437d3bce0fcd90ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676349848, "uuid": "3e7a6143-4118-47ba-b068-9bf321558536", "comment": "Malware payload (RedLineStealer)", "value": "59472aefcc3c6dc0ee36f69f9a9d2564caa2323272255da03acecf5f82c4b94c72a20c64f2e3f3c678925653ae48d444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349848, "uuid": "53af538a-b2e9-4da5-89b8-6327aa86c4a2", "value": "T126F4120BFAFCA025E8B047B059F647C31A367E905D39879B234B5C9A48B3960763477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349848, "uuid": "a9094977-18a4-4b5c-b527-20ffa78171de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349848, "uuid": "e80891eb-5d63-4a26-9ffc-9b626daf536b", "value": "12288:dMr3y90207b9EIJRU0VbS2eGAMKe1CLuQLqBF84Y45l0/BpZDsPPMuwbnZc:qyWP9rJjVbsMkLuQ+TY+lAZDoqTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676349848, "uuid": "26bd98c7-4195-4825-9cad-e7097f1f1f9b", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676349848, "uuid": "6602bdf7-009d-4602-9d37-22d46e40f3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676349848, "uuid": "4449bd87-e2c3-4902-9f6e-f8a8c85bdeb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e98877-acb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676412816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412816, "uuid": "2c62cf78-e086-4178-a061-ea4b9d0bd5e7", "comment": "Malware payload (RedLineStealer)", "value": "eacee8508d4a8f42ab3d77d308260460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412816, "uuid": "b3f1ea2c-1a52-40dc-a8d4-a9e0434f21fe", "comment": "Malware payload (RedLineStealer)", "value": "9b83295232742e7441e112964f0cc24b825f5c7367589781ce3cacf8516c47e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412816, "uuid": "7bf061ad-587d-4275-aadd-eb5a15ba5476", "comment": "Malware payload (RedLineStealer)", "value": "7d93956628c190ac0175c53c7a49e0952000fa8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676412816, "uuid": "a5632c45-9304-4198-960d-cd3b660bae14", "comment": "Malware payload (RedLineStealer)", "value": "d270feb14c57d21aae013c5dd0f8199018560e4ae944337f46273be213ed85ed819da11b2dc7a11470f7299dfb49cfb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412816, "uuid": "5e4b1a71-4ab5-40f1-b7b5-40536d9d9297", "value": "T12444E8512ED04AE7FAA38FB76322D16DB11A847D560F2B5AC369C9E1433434413B87BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412816, "uuid": "9c10a895-5085-4ecc-a433-4dda70f300ff", "value": "4daca7182a967075c4a8cd470c438efe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412816, "uuid": "595b738a-d915-46b2-9644-ceb74248f36b", "value": "6144:EbWQ96xwwVrqCCz8qDxcEt+1dZ0tXSu37wO:E0PqCCdVt+F0tis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676412816, "uuid": "586f9f89-9147-4fb2-a4aa-105e96af855e", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676412816, "uuid": "eaacc076-aef0-49b1-801d-b591a66507b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676412816, "uuid": "948dfc82-d0a3-455a-9bd0-1daa425657f9", "value": "eacee8508d4a8f42ab3d77d308260460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c695bf-acaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676410346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410346, "uuid": "aab8a8c0-9d29-49e6-b6b2-8bfca9d98616", "comment": "Malware payload (RecordBreaker)", "value": "076060efaa00bbd28cd0bc5f953ac535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410346, "uuid": "21fdccce-81a9-482d-b3aa-458e6fc85727", "comment": "Malware payload (RecordBreaker)", "value": "9b9d501a35b3f1e9f80854e2ce8df89feffb12f484e6326516dda90de4de5204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410346, "uuid": "65410a12-6a4d-429d-b83d-00660ef56757", "comment": "Malware payload (RecordBreaker)", "value": "f6779a175a135854d50fdd917cb585821ce33503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410346, "uuid": "d2658a86-8069-4983-b28a-9473aa84c8e7", "comment": "Malware payload (RecordBreaker)", "value": "fa84d6271cb2c1251f3059db62c24a4ea0afea2f9ce46fdbde71e5fb07d5c1f7644e6c81724b5f88030304d0ddf5d59e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410346, "uuid": "f1809533-770a-48a0-ad48-b840f2594a88", "value": "T11414DF11F7D0D0B2F45B81749861EEA06AFEB932E7A5809BB3C406BE6E302C157A5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410346, "uuid": "6f3426dd-0b0d-493b-9a23-5d17b7b6ec96", "value": "f3f91ab88cd7f7832f622d1dea42a33f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410346, "uuid": "bb2b76b9-c329-4e57-b628-b6e10f39453d", "value": "3072:R5FN3H4LvWGo5FZ7FKwQ/kxjclmc7BSjDsgPvFfbImn1:f4L+Gs1swQ2of7BSsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410346, "uuid": "a1b442a2-43de-4ec5-b8a0-b222bb12b786", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410346, "uuid": "3fef1bfd-9394-4e30-8e49-2ec2cac5d142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410346, "uuid": "92a68ea8-d3c4-474a-abce-8d707bb61027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b633be-ac6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676381275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381275, "uuid": "97afd582-ab81-49f8-8bab-40bc43c438f9", "comment": "Malware payload (RedLineStealer)", "value": "e2b29040e6a76abb5ea24981e4b1510c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381275, "uuid": "7ad78b0d-3581-4542-8d11-8f55c3b11f73", "comment": "Malware payload (RedLineStealer)", "value": "9bc7821632e1a1131405446d0867d157b59e0028b077f382e3f0132618c9887e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381275, "uuid": "8590161f-b59c-45dc-a20e-6c3c2bc384f5", "comment": "Malware payload (RedLineStealer)", "value": "5a2db928adf450abccaaad3a0b1c51192763f5c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381275, "uuid": "d88785bb-7478-4180-8ef3-3d776f9be9fe", "comment": "Malware payload (RedLineStealer)", "value": "f02aaac32e367fc41eb3ff7257a78c98a410a008a75a5fc179b94ef81b9cf22ddb24afe96045bd0089a367d09e3b055e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381275, "uuid": "65f937b1-26c2-4e91-b6bd-7531f67532de", "value": "T19154F111F9A0CC76F966F1BD5530D6206DBFFC722361819733482AAE2D702D16EB9386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381275, "uuid": "d9bc53c1-9eab-405c-b0d3-080562078904", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381275, "uuid": "4cb83f57-5c62-4951-8bdb-35f08022324f", "value": "3072:AoK3Lylje5nvwkjJn5WCYs51R4ax3j6WjaVnx+0IZE+Woe2qA9UWJfllaka:H0LyljUvwy5WCYI+C3j6GCx+0IxeJuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381275, "uuid": "98da6640-6cd7-41c4-ac6d-fbf68bab2b70", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381275, "uuid": "cb8d2884-9ef8-43a0-aa12-51b7d9309df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381275, "uuid": "6635a38b-6b2a-4ac0-89ab-ef79a9fb9e79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe7fec8-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676408192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408192, "uuid": "62784249-d378-46a6-b136-2d088b7dae6d", "comment": "Malware payload (Mirai)", "value": "00160416a99d43aa4942263f7c842590", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408192, "uuid": "f4deaa81-0a68-476e-b1ec-0bc645478a17", "comment": "Malware payload (Mirai)", "value": "9bff12d3a6bdc189dc76cbbd3b5c2f4eaf82cef2b775a2cc2c3e62eaf8fc79de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408192, "uuid": "b2c0e33a-35dd-469b-a871-8001988255e2", "comment": "Malware payload (Mirai)", "value": "d22be68b60dcb0bd79438d04d9027a6b2f27d4f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408192, "uuid": "ee848382-220a-4668-8f7a-618480f1077b", "comment": "Malware payload (Mirai)", "value": "2bd60f04b092526c4ee85eab9e4e536db999417ebc9bdbbb67c47b0360fe767c3dfcc38e218e10ceff902d731d01fee2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408192, "uuid": "220bd3f3-aa04-4787-80f7-6ecf66fc6d97", "value": "T1D5D3966A3E11AFFEE268C63007F75F70939526922A919785F26CDB085F7028D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408192, "uuid": "2b0c883d-6016-4b52-9929-8fceade5a32f", "value": "3072:DffBX3W6+WLtvNxrc6K2lcw4MluyIareaGEZs7ECQiwYyW5hvv11eF3xemqY1fu5:LxnigW5hv98F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408192, "uuid": "048e4259-1273-4d06-b2be-9010de6d9e80", "value": 137910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408192, "uuid": "e9eb88e9-e6ce-4c19-b199-7a2493fc852d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408192, "uuid": "55b03fcf-059b-4d85-a7cb-70e0c23ab990", "value": "00160416a99d43aa4942263f7c842590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfd6b6d-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399571, "uuid": "145ef5a6-b76c-41b4-9230-e85d87d221ad", "comment": "Malware payload (RedLineStealer)", "value": "78e5e6e004de464d42e3e93d3e0796b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399571, "uuid": "50e1194a-810b-45b7-a7e6-be5240cb983f", "comment": "Malware payload (RedLineStealer)", "value": "9c3579244aa0c04d72385b0149c33faacb6bbb861e4242a58c6388dc49bb1fcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399571, "uuid": "28d8e0ad-aaf9-45ed-9120-47ec635f84eb", "comment": "Malware payload (RedLineStealer)", "value": "c7d1ff308e9aa9340a6647fbef93be1c358de867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399571, "uuid": "e69f01b7-b88e-41fe-aa98-03ef606fa621", "comment": "Malware payload (RedLineStealer)", "value": "4aad731b076c58702faef31d691c0377e68dc5ee1b74830afa73ec75f216f25e3299a75107d690ec35ed99c6930e014b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399571, "uuid": "7267f5c2-1972-4bb2-a1d0-f89c43ab4f59", "value": "T1D5C40207E6E88432E8B013B05CF707C30A3B7D605A78836B268E7D665DB2664B17576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399571, "uuid": "9b05f5bb-1e01-43aa-b55f-80fb7e6478e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399571, "uuid": "b3a7fca1-01c5-49b1-8904-c5b6cd16c1b5", "value": "12288:jMrty90sl78HzktfBHGW3upRaNUtfhPHEUsvysH:eyvl78TMmHtfhPHEfqsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399571, "uuid": "a1ae17b2-8d10-4c78-90f0-1af2ef10582b", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399571, "uuid": "3711e6ad-83db-47ff-8486-0bbec1707017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399571, "uuid": "6762ebf7-9c6b-4342-8ec3-c9249b58169e", "value": "78e5e6e004de464d42e3e93d3e0796b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14553ee1-acaa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676408200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408200, "uuid": "548d8836-d8c3-4516-80a0-23e0642a07b6", "comment": "Malware payload", "value": "e690e99d98b7a97400c8981b377bb660", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408200, "uuid": "4d20ac9d-c005-414f-ba7e-3f4565498a57", "comment": "Malware payload", "value": "9d07c0359a0098ecc07a89ceb96cb3fc67e82b03dc22561dbafb507a4f864a85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408200, "uuid": "349c7dc7-e8a1-4ec4-80d3-40f2427267b5", "comment": "Malware payload", "value": "49c5f8caad9be3c5b53811f0f8914f716144030b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676408200, "uuid": "78fbf83c-e8ae-4b3f-b7c7-6c0b025cab73", "comment": "Malware payload", "value": "99714585b45b3e44fec365a2f46a37a62fbd6b1f2fe7f5cfe2c4d243a34208af7b6eb3b0df6ec72968532e9e26f0b9a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408200, "uuid": "2cf8b149-bacd-4caf-89b7-c910e3dfa394", "value": "T1D72401356C26E223C097FFB8EEE9B992D759F2C30F85820361A4116D49F9999641FCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408200, "uuid": "ee874cfc-cc78-4295-9eae-2aba3eb5e79c", "value": "1536:FioLKpma4GlQ/WixfiCxKhjjDF6WC4AcCKr+RlUcym+4m0KTKJmasb7:EMEQ/WixChQWwcCK0CcymDm0KTWmasb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676408200, "uuid": "3910f152-37e7-4fc8-9dee-ea6b4da46bce", "value": 209866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676408200, "uuid": "d2013940-1df0-4fc6-b765-d74eebcb52eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676408200, "uuid": "413af119-0ae9-4d02-aa26-4a0bc053e3a8", "value": "e690e99d98b7a97400c8981b377bb660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d996227c-ac3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676360427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360427, "uuid": "028a00fb-6d62-44cf-b788-02e83e0e128d", "comment": "Malware payload (RemcosRAT)", "value": "d92e87ca111affaac8535d81b24b6e04", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360427, "uuid": "9c7c9e3c-4b11-463b-8520-ecee9f786c0b", "comment": "Malware payload (RemcosRAT)", "value": "9d452abd21f6770ffab0344ffe423fa84ec1a143f6cac1bbcb60fea1cc7b560c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360427, "uuid": "f42fcc8a-2172-405d-8506-515c97428cee", "comment": "Malware payload (RemcosRAT)", "value": "bb7909f2de1319bbfb5f09410e0c5193cf82edae", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360427, "uuid": "82c5cabf-2fd8-4f15-ba18-2e352c59c090", "comment": "Malware payload (RemcosRAT)", "value": "6f43cf610c413db4ed299adf693f537afab1cb3e28466e5ead7b981ffd1c69f694b2d30b9a1e151f412aa6657f472231", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360427, "uuid": "c1b04dd9-ea1d-413d-8774-ae09c0af2251", "value": "T155F433D8C8E7143CA87025F5A8E5F453BD4888F519763BB4BB093EE194EBA309E63471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360427, "uuid": "01143081-9369-4b6e-b8f6-2dfaf28a70e2", "value": "12288:tT6lJrv0aNjJ/EE9OP3LrzmwZd0nEWOR0I+nuh/ahlMJJUmqwPjZTfLMnXG0fjit:tugYcTNd0nEMq1JbRLMnXvjknI0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360427, "uuid": "f54aec18-8aac-42d7-b583-e60dbe11909c", "value": 746155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360427, "uuid": "09a2f4d3-5eed-4649-ba6b-979056ac879f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360427, "uuid": "a6a6f6f4-a430-43ef-ae13-09f3e8c7f500", "value": "SOA#202302.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0aad2f6-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676391765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391765, "uuid": "aebf89e5-7115-48bf-8599-8d508619712b", "comment": "Malware payload (Loki)", "value": "ba2ffde847f66722e22af3956fd7d008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391765, "uuid": "a4c94dae-08c3-49af-9083-7ed9ddf13744", "comment": "Malware payload (Loki)", "value": "9d7b1f8056466b7823edd70986a04ff2da37afe528dfbcafb0b8202a2952e0db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391765, "uuid": "b5b001d4-71a9-43f3-a271-5443293cb690", "comment": "Malware payload (Loki)", "value": "282e49361e47c1250ff924b3002ac10123312273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391765, "uuid": "36a60146-5d93-4d1b-afe9-2e82d4b6dd79", "comment": "Malware payload (Loki)", "value": "1b28a5ea2307573e6981e9222f8431aca6f7be382a80b3d20a2b879a22a25a9caa1902f3fa59e58ab94136663a0f276c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391765, "uuid": "abe4e5a7-7fb8-46be-8007-6656c2fccb08", "value": "T174C42A8DC4FD4292EAFD0F79B59F39080DA0044A266D4D3A9BE7F880D57321A707EA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391765, "uuid": "aebe3daa-0880-478b-aee8-d0600625c694", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391765, "uuid": "fd4bbaee-ea5e-4036-bf31-1f7c8cde69fa", "value": "12288:Tyecesinzq/MBgr+RcFA4Hpr2cSoOfP+jJh:PcesiuQW+MDp6rf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391765, "uuid": "6b260a0f-0deb-48e1-86c5-cd0e7e57e27d", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391765, "uuid": "c3ebe5a5-8140-4e29-be3b-678e54977083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391765, "uuid": "fb740c05-1770-4c58-a9fe-ee120e469ebd", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b657c3d0-ac9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676402888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402888, "uuid": "a0538e19-4482-48b2-95d5-779175c493ca", "comment": "Malware payload (DCRat)", "value": "210be50d9639ed868994248fe1675d50", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402888, "uuid": "dd802bbb-e126-4d3e-a6f7-05dd723f550c", "comment": "Malware payload (DCRat)", "value": "9d7dff299353f51792a9730966950685b2db5e01a015790905a39f3493de1dcd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402888, "uuid": "964cd3ac-bb5f-4442-b59e-5d2cbe8969aa", "comment": "Malware payload (DCRat)", "value": "9eb32e4ec3669507c0a9640db6f1af797eee06b0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676402888, "uuid": "1607e853-bf8e-424b-a4b8-954c6103c394", "comment": "Malware payload (DCRat)", "value": "c1a6912380973c875c093c28b85caeea97f2b5272c884388b3e27cdc1dafb1a66f0e677f30a6c862d8a2cb0a305abf69", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402888, "uuid": "e44db6b1-d67f-4124-8c0f-c385db9fe77b", "value": "T1FF657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402888, "uuid": "6a30f9b7-1458-48e1-ab2a-e89de38962e6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402888, "uuid": "b6851cbb-ffc5-4a46-90a3-cedbcfb5af3a", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676402888, "uuid": "3bf3e225-a09f-4dd4-b1bc-0521d52d7ba2", "value": 1410057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676402888, "uuid": "1ac3d647-b150-4076-b0b5-e6f3aa273f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676402888, "uuid": "89daa199-7b20-4534-b6a1-f5bf421287cc", "value": "210be50d9639ed868994248fe1675d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c648d0-ac5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676374431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374431, "uuid": "18ce897a-b177-4326-960b-04b3bf2158a4", "comment": "Malware payload (Smoke Loader)", "value": "dbfb7c060193971c9fe40ddf22a9e3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374431, "uuid": "64039328-0383-47cd-a40e-30d4851fc6b8", "comment": "Malware payload (Smoke Loader)", "value": "9de30d4159b1d128f5a68301232d5cc03f0ec0dbdcb2ad455dacb99b92f16c7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374431, "uuid": "391e2c55-ea09-43de-8568-4e5b5be48e19", "comment": "Malware payload (Smoke Loader)", "value": "375114a694b9267e2e96268a3bcd01469a344991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676374431, "uuid": "dd7642cb-8c95-4386-ae56-1b48f5c7c3df", "comment": "Malware payload (Smoke Loader)", "value": "4701837ef1cb0af917783d59edcf048234153d42f930cf3cdeb5611abdd63c990a934964b58f3ff369a2a4917d1ee37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374431, "uuid": "c0f8c836-ab7b-44bd-aa97-5f1ec98bcb10", "value": "T10204D0117AA2C032E467A7705430D6A16A6FBC316B65E1BB33541ABE1D303D18E673BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374431, "uuid": "6023d867-8396-47dd-bd6c-7f9c45be9ed7", "value": "798e86ce43c6c756580e060a65d134f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374431, "uuid": "128906cc-c001-4d41-894e-06d8ed6b231c", "value": "3072:eo312x0xLum25n4IugaLSCOWQ3sr3e0iocXh6amNRDQ76S:t31fxLumc4IwDOWQ34e05cwNyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676374431, "uuid": "3b9ee32a-6532-4eb9-a4cf-25ad7674253d", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676374431, "uuid": "1736ec3b-cfa8-4802-b984-5a564508559f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676374431, "uuid": "fc1d7e9a-eb66-4702-b038-57d239f2271d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aec0f8-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399991, "uuid": "c2524b02-e93b-439c-bfe7-19ec60657468", "comment": "Malware payload (RedLineStealer)", "value": "b4f700edd0e415611ade9e11c62617d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399991, "uuid": "83b83269-ef63-4b52-86aa-98c6b6d41d2b", "comment": "Malware payload (RedLineStealer)", "value": "9e0b99883bacdd8bf450ce4482030b3bb870662ddfd4c19b89aecc59b555ebf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399991, "uuid": "6596250b-ba5b-4154-bf9a-681e9a831721", "comment": "Malware payload (RedLineStealer)", "value": "064af013b48cd9690b08441c9d15f91531452620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399991, "uuid": "0bb6e6c2-56d3-426e-8b95-dea118fb2e78", "comment": "Malware payload (RedLineStealer)", "value": "cd81072f8a6672ea10a2e3b8d9046170d74b07a94d6bb50fa68424417c5dbe7919632732cf90f17d81a7a0352eb613b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399991, "uuid": "2d7d5c40-3d81-4e74-b2c7-0c9ddadbc03a", "value": "T179F41207F6E85026E4B0577058B702D3193BBE619F78829B634E6D9E4C736A4E93037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399991, "uuid": "24ae33ff-e2f7-4071-8b13-c99ead7675f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399991, "uuid": "8d7b8939-612b-429a-b380-e87a0043f26c", "value": "12288:2Mrky90MuSiwzLBsLrmKKx/+5zF8lE72vDRFJFI1xLCu+rqzh/tAuAxgqTOrY:yy1uSiwHBsWhZazF8lE72vDRXFcLWuFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399991, "uuid": "217ddbb7-6d45-4d76-86bc-c73fc88b4b8f", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399991, "uuid": "c71bc8b4-a165-4eae-bd01-3f77857c172b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399991, "uuid": "d45e14d3-66f6-4121-9951-a9c67f0b548c", "value": "b4f700edd0e415611ade9e11c62617d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b108b934-ac18-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676345756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345756, "uuid": "bd97e6fb-7d54-4a1d-a771-e7aede59f411", "comment": "Malware payload (RedLineStealer)", "value": "8432cbfc46088d769a1640a14fcd930f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345756, "uuid": "1a038297-7e9d-4cec-990b-347ba4641dce", "comment": "Malware payload (RedLineStealer)", "value": "9e5b5c5d496d16e64aaa75ee875902b41ba82ab2a7fdb4b55a6d84f716aa3f49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345756, "uuid": "2389dec5-75ef-4ea6-946a-78aef78c1a36", "comment": "Malware payload (RedLineStealer)", "value": "efe70e6d9ce1adb48677af9a5e9373b69b82c8eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676345756, "uuid": "dc3adb2b-75a9-45cf-a8d8-88568126ac8e", "comment": "Malware payload (RedLineStealer)", "value": "428131692ce6820dfc04e6acfc7322aac6d46c9a62781827a505b58fe6174bdc599712862242d46c825f5d5358d99c3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345756, "uuid": "1acda55f-e6bb-48f5-855c-f91935537a43", "value": "T1E4F41217E7EC9031E4B05BB558F60BD30A33BCA09A3483AB234A9D6E5872970F571767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345756, "uuid": "928e3028-b238-48b6-8685-bcb18ec6883c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345756, "uuid": "38d7bff2-bc51-4d4a-9e9d-302b1eeb6624", "value": "12288:vMr0y90sQNJH+fXc/sj59HWpFL4Are49aM6Kz1GtAun7gSGIH:zyaZ+fXcsHHLA5wM6Khkb7gSGIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676345756, "uuid": "4c637fe3-821e-4284-8f5b-4674191a7193", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676345756, "uuid": "84822bdb-99df-4737-800c-e72b8968fb6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676345756, "uuid": "92daef29-7e4e-49da-be3e-b6355a33f8fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ebf83e-ac43-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676364063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364063, "uuid": "2a25188a-ccb1-4e71-9ee1-19d00f13cf2d", "comment": "Malware payload (RedLineStealer)", "value": "c2d886f0f04724777b5ae0bb85964674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364063, "uuid": "f58b1ca2-622d-4bf1-be02-d94a7514d0d5", "comment": "Malware payload (RedLineStealer)", "value": "9ebb7f2c3b8746de82679c1e24ed9a5300d4d8d05830e2e1a7d0075ebaea25da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364063, "uuid": "d8946dde-bf4f-4064-9d66-4ae8a74f272c", "comment": "Malware payload (RedLineStealer)", "value": "17b403c65558243902d735a9f2d723490c4e1d06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364063, "uuid": "c73b7faf-cf11-473a-b476-52c67a51b9aa", "comment": "Malware payload (RedLineStealer)", "value": "adca3dedaec0ffcc4360781fbe487e65e3ae106d6acab6c452fe3245ba8d514e47412236f030d6b4147b7cf43efd0660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364063, "uuid": "22459b44-c130-4b66-97c8-161c0ef5e861", "value": "T107F41207FAEC4126E8B05BB059F607C31A37BE90AA358397234E7D1A1872690B57537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364063, "uuid": "d383ed2c-a02a-4d4e-b3b2-4e92206b8a60", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364063, "uuid": "2b289ec1-2f4d-4f16-bf3a-f5bbc34d4c7d", "value": "12288:2MrWy90WJJvwOeCe0epBDn95LU49FzTvE1gvDbfJ07+2StzNzM/tAuzYgWiWjhL:Myxbe82Dn9ttlvE1gvDbR0qDBNolXYg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364063, "uuid": "478ae1e9-1ec0-4662-a746-b01b898127a0", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364063, "uuid": "0a829725-1b78-459c-a3ce-c1868a74cd11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364063, "uuid": "a0adc5f2-e83e-440d-8147-4b283d88e150", "value": "c2d886f0f04724777b5ae0bb85964674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea223ef2-aca1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676404693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404693, "uuid": "972a6884-ba7a-4ec1-b0dc-7932bbb4f38c", "comment": "Malware payload (RedLineStealer)", "value": "38339e07bbe1ece26742976fd709abf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404693, "uuid": "95d0a0cf-e2b4-45cf-b5b8-88d93655245a", "comment": "Malware payload (RedLineStealer)", "value": "9f0d0d42b8c5d14f1cd98e79edafa729daca05eaae7dbdcfe940f19b83430e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404693, "uuid": "30fcf332-526c-4ebf-8a41-b68f99dc640d", "comment": "Malware payload (RedLineStealer)", "value": "d024a81ad26f6d9fd0b45c8afed52d18e7a37a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404693, "uuid": "d881179b-7ff9-439b-8846-b756ec2b63a7", "comment": "Malware payload (RedLineStealer)", "value": "abc6a986aedfe012a37fbf89ce676601081e5ab5ea8e9083b23fea0744f69c0029ab196ea91ea52ad440bfc0cd49d511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404693, "uuid": "9028e0e1-d8a0-4ab4-accd-993854a45ceb", "value": "T1EF14CF2234E1D0F6C59BD5744420EBA09FEEB8726BA5C15B27581AEF1EB02C0477E397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404693, "uuid": "e0f04884-1288-4358-bace-e268eaa681e0", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404693, "uuid": "cd299544-8d9f-4cd5-baca-f3e871f0ea71", "value": "1536:SBPN7CQPjd78TvULxa4kNnSP5bcOVJ5Vo2+87LZbEQBl6s6jjJG/m3tdhXr+4d8M:S+KL4SLVJ5VSwFa59WmnhXr+4dzZXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404693, "uuid": "2d586885-2c88-4c01-94fa-3a7bdb41992a", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404693, "uuid": "77799d7f-febe-4fc7-b476-a4e86ee75a11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404693, "uuid": "e723f11e-12ae-4f99-8cef-8a4127c0a0b6", "value": "38339e07bbe1ece26742976fd709abf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a07c33a-ac8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1676396345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396345, "uuid": "e39692ba-dcf4-4b71-894c-bb1f20c7502e", "comment": "Malware payload (Vidar)", "value": "b64e13823f736dcc033a4407703ff1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396345, "uuid": "f8d17b27-9fc2-4eab-9899-5b0a5f4d5332", "comment": "Malware payload (Vidar)", "value": "9f1ea67ba5281a92142a5daf50f99030fa7778ffeaf2a33c109a4bc95daeb453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396345, "uuid": "534496cb-a47d-4919-8ccd-f4e2c01e9a09", "comment": "Malware payload (Vidar)", "value": "7856a03a1ae75e5d88a1a14a78d6215e3fff3cd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676396345, "uuid": "7388fd49-d03a-48de-8f9b-503958d03cdc", "comment": "Malware payload (Vidar)", "value": "ef8bd686f7114e5865214b0e6ffccd1c75d0bdd7e2ce4f42c1e40a148cf41df9b1e1caab9818f0522fc17d0a6dd59218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396345, "uuid": "61a9de94-42f4-45d2-aa53-7948e57fd166", "value": "T1EE857D25CA1F8DB7FB2F6F32924C2D1114B2BDBC1F568916965490192DE20EE863FD83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396345, "uuid": "33c9f3cb-061a-462e-945e-150e434f27d1", "value": "c434c6d43b9dd2659df575eadd46929d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396345, "uuid": "b5d9fda6-36c4-47cb-a68f-9aa8ec449119", "value": "49152:GuqT+pDmTKMaEqL4T4pv3Sfb9kPGFOQK0R:GuqT+UTsEqLWcvq9SGFOQKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676396345, "uuid": "d3b8ea4a-a357-4fab-8b7a-2cbeb0d2a089", "value": 1706904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676396345, "uuid": "a650b29c-ec63-42b9-946c-9db7bb2a8b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676396345, "uuid": "711234bf-e7ce-47ca-966e-e74b7fee55a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e71e070-aca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676404835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404835, "uuid": "906bce94-3f44-43b5-802e-9e2ab45fabf2", "comment": "Malware payload (Amadey)", "value": "3f448c89e980ac23d80f9c915574b090", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404835, "uuid": "88ae1a39-ebab-4545-a7e6-e02aa5f082a4", "comment": "Malware payload (Amadey)", "value": "9f237d79c0ae41d575b20be1beca5c27bcaa4930f82d108df2848552bbb044c9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404835, "uuid": "325656fc-d086-4f0b-abf6-f33955448bf8", "comment": "Malware payload (Amadey)", "value": "d69ee540fb2ad0fd6cc12d03fb758a1196fc7e29", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404835, "uuid": "1c9bbcc5-1fa1-4756-a783-1ab6d455b795", "comment": "Malware payload (Amadey)", "value": "e8f662298fef90068a72cfaef288377022a247cc9caa8ff1ec4dd57883670d6ab5ba27d41f24bfee9f8d6c6ed49d3e64", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404835, "uuid": "5094f62b-d5c6-46ac-81db-cb00a8838a66", "value": "T11CF41207EBFD8532E8B0977158F703C31A327D614A75879A234F6C2948B3A61B53572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404835, "uuid": "25db0497-0d45-4730-8e31-4bc19b08a2ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404835, "uuid": "98e962e7-3288-46fc-bc42-84e907f32d1b", "value": "12288:3Mrey903zLMFheC1EzBhyQWsfWs3ZA/jFt4OBD5tgMQHlXo711YPivJ:ZyCyYCCVhvVOtgfXo7vse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404835, "uuid": "5017ca71-aa3e-4348-b9a1-c175fa296844", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404835, "uuid": "f8065e91-fc75-46ca-ae82-87e68565707a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404835, "uuid": "e15e55bc-d506-4bc0-a03b-bde10b581c7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420ca0d9-ac8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676395392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395392, "uuid": "160b2b4e-fab3-43e1-a196-bbfd0020bdcb", "comment": "Malware payload (Smoke Loader)", "value": "9185b542ad16191bfcc6e9add5ab3815", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395392, "uuid": "b6653573-4df8-4b12-9a07-787d1721252e", "comment": "Malware payload (Smoke Loader)", "value": "9f3abaf3dee90242be14d20b869562caeb8aeccfd83b2f0449670d89db529854", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395392, "uuid": "b5cc9fd6-f32b-4c61-bab1-aef76917e00c", "comment": "Malware payload (Smoke Loader)", "value": "6380d08e73953e4e6d666acce8925e797634b0cd", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395392, "uuid": "8b291e97-b331-43f5-a3ad-5496c6c32f4a", "comment": "Malware payload (Smoke Loader)", "value": "0dde3282115d08987fe0a8679f7e7162431af2f21f71b0b59e338cf8f292d5f1f215fda4de42dcaf2c0c23568f7c30a1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2022", "colour": "#FF51CE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395392, "uuid": "c0651470-3e8a-4b2c-809e-c089e2459313", "value": "T1C2D6331829BA554743FD9934E1AFDE3078F2C0779B6E0309B948B8B27B56D1C44DEA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395392, "uuid": "9c837042-533f-4288-ae7c-372b2961ae76", "value": "393216:1wJbhaZUA9p2rxAlfBNpKo5euljyx/EDnD9K:1wJbsZUAHMxAjNlKBeD9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676395392, "uuid": "ebd11981-97c4-4c2e-aad9-9852974c7800", "value": 13219732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676395392, "uuid": "677b20d8-06e7-47dd-8cb8-5c9f231157d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395392, "uuid": "41389bef-7cd0-43cb-b9d9-c203471ff64c", "value": "Setup_x64_x32.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dddf250-ac8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676395868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395868, "uuid": "d4dbde73-ed00-4ba3-ba6b-2c2c05e409d1", "comment": "Malware payload (Loki)", "value": "423f4c2362a604ad167e5d9c9c71b50f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395868, "uuid": "f0d2de9f-7b57-4939-9a86-c27dc0542450", "comment": "Malware payload (Loki)", "value": "9f69c10fc02a6d92e09ba2a0ce64f3ad093448d5bfd69d0023337417c1ddb774", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395868, "uuid": "ac27ec68-1e9b-49ec-9581-e1384e102f18", "comment": "Malware payload (Loki)", "value": "9668a3308afd8008b45f0318e893b12c2e358bdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676395868, "uuid": "cda84e38-fffb-4bd4-ae5a-f002acfc337e", "comment": "Malware payload (Loki)", "value": "856390a36b467108f2cdc65c436b18360f554452bbbd9b5b7724b347c655354c0942538fd033ddf1fa0207764f9fe8b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395868, "uuid": "a68bf5a5-725a-49c0-a45e-e83a1cf659b0", "value": "T19014BE22B3E0D471E92346318C35D1B56A6FF8215FA59ADB23946B3F0D713D08B7A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395868, "uuid": "a21ff6f3-2f49-471a-82ac-286ccaffeb75", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395868, "uuid": "74431d13-bfe6-45dc-abb8-eaf2ba4c9613", "value": "3072:oJ7uFa5zvmULiU5mntmsLIDy5xz2AdrJCTqA4sFkCVM:ooovvrStms023iAPwqTyBVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676395868, "uuid": "41492695-36aa-4a30-a8df-6c55562dbce8", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676395868, "uuid": "b658d69d-cfae-4c4f-9551-d457ea76841e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676395868, "uuid": "b833392c-12f0-4d7d-93a6-74e36d45faee", "value": "423f4c2362a604ad167e5d9c9c71b50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a48d83e5-ac6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676381813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381813, "uuid": "6446585e-c671-444c-ade4-ed0ee30893d0", "comment": "Malware payload (AgentTesla)", "value": "4763dd5209d228ba243a8ac3da58ff88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381813, "uuid": "7b4b3f10-87ff-41dd-a53a-eaf11022bbb1", "comment": "Malware payload (AgentTesla)", "value": "9fc6f01a0e05e3ffa8d1391586e36f2a587f38ad3a186dc68ac8a6101fd94b6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381813, "uuid": "aed32673-0c6c-484a-8bd7-c423cb73f687", "comment": "Malware payload (AgentTesla)", "value": "afa4189f88fb0986dea50e2b5f626dee30de51f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676381813, "uuid": "37b5b5ac-f81c-4beb-aecc-1cd69fed89d7", "comment": "Malware payload (AgentTesla)", "value": "3f3a2b2a1631c98d82d097c68510402a084d5576dc45e03ce097275ce43a66d1ee409bb202a5e794d30c03884ab43d01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381813, "uuid": "5e6d9265-56d3-4f3f-8426-7210e42bf9d0", "value": "T185E4BF0B040C9E9FF2D36BF800BD47EDD11989A74C449E25FAEF9BCAF7568D26048469", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381813, "uuid": "9f1b1a96-5c59-4ec8-9e6a-815c056c3160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381813, "uuid": "ff49d5fe-94af-46bd-877e-8d8d4412de5f", "value": "12288:bG48o4dzmtzGFiEXm3jH8mJcHNK5kAOxP9TzYzUJqcQ5ORSE:q49czmlGMEW3jHNCtssziaqcQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676381813, "uuid": "2d59dc20-94dc-4d6c-b65c-39e271da4923", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676381813, "uuid": "4e73582c-e9aa-45ec-968a-ac203f9673cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676381813, "uuid": "53f217d4-0514-4ae4-92a3-9f77aac5aaab", "value": "Tumpcenccik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecfe8c5-ac64-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676378206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378206, "uuid": "1f0a5ad3-0fd4-42cf-bce9-5e1b91a44cf6", "comment": "Malware payload", "value": "949a9764db358e34c1ac2907ea227dfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378206, "uuid": "ee0536ef-77ff-47a3-82d2-270ff2c90197", "comment": "Malware payload", "value": "a00bc07c458a18926092123546c1c954596c2e602e64e277b5f3371adfecde8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378206, "uuid": "c5f82733-d781-4b0b-99ac-f794baa06a0f", "comment": "Malware payload", "value": "69837610d657690b941d5d7e2ad4c52bc41f9893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676378206, "uuid": "ff0b0ac9-bf65-4225-bac9-0bd2035de520", "comment": "Malware payload", "value": "b7e3e8bdb92563da2b51971405765ab00f2f64f6bf4fdd133fa372bac4ea6e8cec579e39c06a27a418932474bffcda8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378206, "uuid": "60e77d45-3d83-4e9b-89d5-5dfbd9242ba2", "value": "T181636C61B1D0C032D0A7A5304CB8CE714BBFBC111A798C87BB98163F5FB16C25A7979A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378206, "uuid": "40bd1bc4-f9cc-4d14-89d3-9b0cf564027c", "value": "99c11d488d3274f9045ca98bae29cc2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378206, "uuid": "feb48110-1445-4409-a396-e0252a40a575", "value": "1536:9FIUn3hHFeTNX55DMRWhZYLL4rnG7lQoPGb6PbIhX:PIU9FIha/4epo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676378206, "uuid": "3ccb968a-442b-4e0c-83c9-d993db79b5d3", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676378206, "uuid": "a4890245-082a-4b19-aebe-f003c6a20fca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676378206, "uuid": "fe437bfd-7618-482b-8086-2b6b966c5ecb", "value": "SecuriteInfo.com.Trojan.Loader.1303.28313.26671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3f79ec-ac95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676399575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399575, "uuid": "ec53168e-b9df-4e16-b1f9-929b0cb374a2", "comment": "Malware payload (Amadey)", "value": "a7dba9c322113b680fe1c5f7e57c7374", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399575, "uuid": "377d112d-2117-493b-b06a-fbe5aec90360", "comment": "Malware payload (Amadey)", "value": "a0482b6b606cdc97e0e863d21dae54c423389adb58cbdc5f7b5094bcd34f01d4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399575, "uuid": "52cd826f-3e8c-4d76-a731-cc405d4b7998", "comment": "Malware payload (Amadey)", "value": "08b01444d5d95ab99a32304aacf2776dcc129b80", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399575, "uuid": "f251adee-e59c-40b0-bc6c-13eb0ad96274", "comment": "Malware payload (Amadey)", "value": "3c97ea797c23f2e47a61029a04908b8be6d96d672bf4e3934f61d7a8d53b6c90e512c24f375c22057e8cdd95ca5e9985", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399575, "uuid": "63baadc2-c161-448a-97b2-6928d9eb0188", "value": "T12FF4120BD6E59136E4AA67710CBB13C309397E504A7DC34B578EAC6E0C329B5B0357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399575, "uuid": "7e63cec1-b11f-46ee-92e4-fe3ced51ee82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399575, "uuid": "d16232b5-da2f-49c3-976b-d79c768f15d7", "value": "12288:1Mroy9010eBxjk3yIl90Md7Z2qF8HMD5AUn522/uxY/OU7k9kCdMDW5cOW:Zyw0eBxjk3yc0Md7IgvD2UnMZo+9kC6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399575, "uuid": "67b8c651-3dab-4cc5-9c30-83a58d705a7b", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399575, "uuid": "94a2b80d-e30a-44d9-a7fb-55cdc12835d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399575, "uuid": "0f87efd2-ecfd-4691-bf8d-3ca799a32160", "value": "a7dba9c322113b680fe1c5f7e57c7374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a0aad1-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399855, "uuid": "4f3eacba-797b-4b93-8182-ebc7acc019ce", "comment": "Malware payload (RedLineStealer)", "value": "c5aaecd3b9b76428c743e22178df1220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399855, "uuid": "4bc0636d-b150-4d98-8494-06e9ef80be3a", "comment": "Malware payload (RedLineStealer)", "value": "a04ef19314d164f2f5d0d88a228cfbe667a773ca7441fdfb525b088641cee057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399855, "uuid": "1cb41d2b-c178-47c6-b263-74d3a7e7c993", "comment": "Malware payload (RedLineStealer)", "value": "75dbcc7b00177df051726ad2d8b9ba1ac5ea6302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399855, "uuid": "d2cf3647-e7e3-4d62-9a50-63a09a328f4a", "comment": "Malware payload (RedLineStealer)", "value": "0eba5370e694003fb1ea5d058c69a40d90b917e396570433d5c402e5def278e1b68b8fedf58b92121f71a1e0dc21581b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399855, "uuid": "b84a136a-4bfd-4f50-b050-2521b53809b4", "value": "T1CDF4120FE6E89532D5B1A3704CF607C319377D919A39835F269F9C9E08326B0A532B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399855, "uuid": "49a71583-d431-47eb-b35a-c102d6a07c3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399855, "uuid": "cbf385e6-be3e-462f-9802-37b3654f5e9b", "value": "12288:UMrOy907Wypp8709iMuKszhq9QFL4cnMD5rpe5GzKdyw6DvA4bCn9hAj8:ayPyppDYM8q9KL5MD5pe4mcXvA4bC9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399855, "uuid": "4bfa9de7-4115-459a-851e-1135b6585976", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399855, "uuid": "38185708-7f35-4c5a-bbd4-2145e7adf9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399855, "uuid": "f68de9ba-4c8f-4940-97a9-223ce4dd89a0", "value": "c5aaecd3b9b76428c743e22178df1220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89777e34-acc3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676419134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419134, "uuid": "4861c68e-e172-4b4c-a7d8-322345746c35", "comment": "Malware payload", "value": "70babb4c781c7317b28aa38ef3613b93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419134, "uuid": "4a3c5d16-3ef9-4f4c-ba0e-4c67035ab2b1", "comment": "Malware payload", "value": "a0633f1edfc5fc28ec009ec9ff5c12677fcff4726bb8b5451f0a3f5cde8732ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419134, "uuid": "2ad147a8-fa70-4a8c-80ff-9876af831d0c", "comment": "Malware payload", "value": "e0905736d50f5870e7a23e8558c4516a0dd33f72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676419134, "uuid": "d60038bc-07a9-4021-8b83-2b9e62325269", "comment": "Malware payload", "value": "c9c577f00b5cf1fc31060da7e04cc36a834341d96a1f829842c1cace27271e297af995da7af545ffb08d308fd734204f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419134, "uuid": "c6195cf0-7016-448a-aa55-7a3aebc6e6da", "value": "T1F6C3F82BBB270B23C0C6007116D71B32BEB5D3D935FA52976AE06DAC6F165843416FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419134, "uuid": "d8442b0b-3aa6-45ef-9b5a-d15be937140b", "value": "3072:o3GN8mgKqzdFhTORcNcmKYFV/esFLfpZe:oW+ZpFhTORIcmKYFV/XFLfpZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676419134, "uuid": "04c2ca07-f568-4d46-868d-4439a409f9f2", "value": 125918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676419134, "uuid": "e3119f89-537e-45ce-b71a-a503e53d553f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676419134, "uuid": "f6802867-44d2-4b6f-9dbe-d54f1e3b3403", "value": "70babb4c781c7317b28aa38ef3613b93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fee9fc-ac0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676341496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341496, "uuid": "97412b89-9512-4ed3-9e98-d9d89e662ce6", "comment": "Malware payload (GCleaner)", "value": "30fb8b1a284ba50d919d90dc1ce916d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341496, "uuid": "a8a3824a-9960-4387-8a28-d88a5cc8b00c", "comment": "Malware payload (GCleaner)", "value": "a0bcf89c02ad71f0080b2bc7fdd7171e9bae7ed60fdcf920eadc837fc6d2c0a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341496, "uuid": "4c17c6d6-faed-44ad-babb-84441c91a7fc", "comment": "Malware payload (GCleaner)", "value": "f90bd9fe9fd5da1e050a758b39534acdae85016f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676341496, "uuid": "c3d107ea-afa8-4076-b475-4885f5619d26", "comment": "Malware payload (GCleaner)", "value": "50c3f76cb96c0103b0ac23a64010f2a09a5a30a33bc9451a47a900c723ed838b2e78277bae5b97d0cbd9f1f05c8c8e3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341496, "uuid": "976445c8-3153-4c68-8a0a-7be259d8ca72", "value": "T15054E112BB909831E86A2A318D36C5B52ABFF4110B256ACB77F4673F5D712D09E313C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341496, "uuid": "11b7d01f-2309-41c3-91e0-595f01edce2f", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341496, "uuid": "f4404c65-bd0a-4dfa-9be9-217e0bcedba9", "value": "6144:DryrlpEh91tnGH74rFbG/9RmD0e7dRMzgLzCIqfbXAfJWzxrO:DryC1tnS74rxGqPr5lq0RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676341496, "uuid": "f05614a6-ef6e-4d54-87a5-92bfbbad14c8", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676341496, "uuid": "9875bded-feed-440a-a3f8-1c48857533ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676341496, "uuid": "01ac01c7-ed77-46c6-a6b9-53bddd5aeeaa", "value": "30fb8b1a284ba50d919d90dc1ce916d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5cbe88-ac1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676347169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347169, "uuid": "30303c33-d833-48f8-b0cf-943ae751cb67", "comment": "Malware payload (Amadey)", "value": "e6361cba8a2613f9fafd10125f0b564e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347169, "uuid": "07520354-5560-47bf-a1d2-e5180132ec1d", "comment": "Malware payload (Amadey)", "value": "a0fe90fd49e0f7bc1febd8abfcf10e7bbef25f5cded7a207d3df6dba13eeaae2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347169, "uuid": "d499d1d0-90de-417a-b43b-7a75d2e53522", "comment": "Malware payload (Amadey)", "value": "34093d627f5607a4239d90b52bc00b8f2dc94821", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676347169, "uuid": "d1b62cb7-f88b-4306-bc01-9bd897fa0a4e", "comment": "Malware payload (Amadey)", "value": "d68fae151af0e77101f181ab4ed8b1098574d1051337d974c809ab0efc21654b93b5e7454af670580b933bdbea5ab860", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347169, "uuid": "e12694be-d9a8-4c06-94ad-f483ee902901", "value": "T19BF41247B3F84027E4B54B705CFA13C31A32BDA52E348397274EACA91872668F57536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347169, "uuid": "bbe7142f-a49f-4fd7-81e7-7221c27033bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347169, "uuid": "3847cbe4-059f-4e66-b561-c1990cc670db", "value": "12288:FMrry90gFIbm97/q21FLEjQ9GFu48OwRqCzvltAupMgy2jAjFN:CyymECAj78ZRqCjTtMgt0jL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676347169, "uuid": "c1258e94-b18c-46fd-ba02-1823cf709293", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676347169, "uuid": "7aa2c19a-1528-4dd3-87a4-9dfca59c677b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676347169, "uuid": "0ad92601-973b-4686-86d2-1007cecd8d32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b66227a-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1676407541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407541, "uuid": "3f6af145-33ea-43cf-a5ea-d4dab802fca3", "comment": "Malware payload (Gafgyt)", "value": "3d0c599ecb7a602b2adfa475123ff718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407541, "uuid": "2a90be9b-84ff-4d4f-8721-53d7416d7964", "comment": "Malware payload (Gafgyt)", "value": "a10f2b5be8e2504b4ebdbb7899be7f6b79d79f29c60d5a5fac05a8ab4ffbc803", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407541, "uuid": "80ea370a-4610-43f2-bc14-7dbee290bff0", "comment": "Malware payload (Gafgyt)", "value": "db66fcd4d1ddc1c7250223aeae92000cc68f659d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407541, "uuid": "cbd67baf-06e2-4e28-8669-fae4e8a1a6ba", "comment": "Malware payload (Gafgyt)", "value": "c98a6eb82a43844917babe65d8d8418769e07c1b4b30af93b002ed160185ddac22d5e9b4ba342f77c709c2fd2f0dddfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407541, "uuid": "9d0cd8c4-e9ce-42dc-b29b-a16a7aa9682f", "value": "T1EF345730AC16D213C0E3EFB8EFE5BA9AE719F6C34B8593036560116D1EF5A59241FC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407541, "uuid": "bc2c73b1-269a-494b-84f9-87d9895634ac", "value": "3072:ixMCfCY60I8jUUaxj2WB+cCeE/X/oIeijlkvmzQOJjpZfa:crCY60uUadZE/nSvmzQOJdZfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407541, "uuid": "21c18c0f-07ce-42ce-ba16-8985e944f8ca", "value": 244415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407541, "uuid": "a52f3396-0749-40ac-9d1c-e2bc6548643a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407541, "uuid": "2ad4253d-969e-47bc-93ae-8c2c6547a2f2", "value": "3d0c599ecb7a602b2adfa475123ff718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1613beda-ac24-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676350650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350650, "uuid": "95ca533e-9cf3-4340-9bc4-368d1cba686b", "comment": "Malware payload", "value": "3b57c0f29f077a6c5897f78abca394c1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350650, "uuid": "ffc0d56c-c4a7-485d-ba4a-bb50b6ae1375", "comment": "Malware payload", "value": "a1524f1194fd6879434a294c6ba6daadd5ac91179eb9dc40fa6034b88407237f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350650, "uuid": "b4e20420-c530-4406-9b13-5621a20f5929", "comment": "Malware payload", "value": "4400f0287d314ea4b244492198f2cc5d2968b408", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676350650, "uuid": "edecf1a9-794c-48c9-81e7-bf56061ea8aa", "comment": "Malware payload", "value": "d01c83ae45cd3ddebf549cad0af4641da7213e553148f6442262ffbc23542a6d2d8e0c4398f7a542f40913f3e34547b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350650, "uuid": "63b8b059-db0f-422f-ba51-f38c136728b0", "value": "T1C0063B68A7A0E578D3EED1F4288C991A1837FC1673C21DCE70D8BB6017F6BA8F852551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350650, "uuid": "b5e8f5d3-d4bc-47b6-b2a2-5047df6dcfcd", "value": "12fcd3183e0fb67f1e38925ed5c0c47c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350650, "uuid": "404248a7-2b66-4ab0-a11c-839f3d2060fa", "value": "24576:eEtl9mRda12sX7B9NRdpkhtIShJVVTyJNPtQ:9Es1R3DCjVy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676350650, "uuid": "9c49293f-a933-4802-b491-8094c2f8aa93", "value": 3716124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676350650, "uuid": "e51b48eb-1944-4732-b5ba-68e4bb993ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676350650, "uuid": "8ce96b86-7fa4-463c-8aa8-7fa7c25fe403", "value": "2023-02-11_3b57c0f29f077a6c5897f78abca394c1_ryuk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06156b6d-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676399586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399586, "uuid": "f3985256-cd4d-41cf-b082-4d043a4e4eb7", "comment": "Malware payload (Smoke Loader)", "value": "708e575385318d39ac6aa5fd6a1f11e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399586, "uuid": "f1f075c3-e17c-4e30-8441-9d5b4a299c71", "comment": "Malware payload (Smoke Loader)", "value": "a19e2b87b1938f3e5282a63d510073f4264feb7d9e1763626dd9038db0c95d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399586, "uuid": "f933743f-bc0f-4009-a927-ff0d95638b53", "comment": "Malware payload (Smoke Loader)", "value": "6ce7f482cbd259486b95277f45adf5ef9b3a5b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399586, "uuid": "7c8adb29-1760-46c0-b6ec-e2479a009086", "comment": "Malware payload (Smoke Loader)", "value": "40dbf948db0dbea4d13f98f9260b3d6caf7ae60d3cac94db6fbb2c9fc048c1db63d747ee77dfa4007a60113173b206a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399586, "uuid": "7bee2399-5d49-48d0-bdc8-cd05fdceeb80", "value": "T14B14D022F1E1F073D5DB44745970E6B069AEB832EBA5818B336E1A7F1E202D0477A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399586, "uuid": "3a86a18c-602d-48af-b646-dadc9f5c7442", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399586, "uuid": "bf670c1f-8c53-4147-a1ec-92716fdf2fd9", "value": "3072:S4jBL7AhA5VJchOk044H/FoLYAT9zfGr36:JlL0hsJk/0n/W5pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399586, "uuid": "21eccc84-6d4d-4342-a6b7-f93a874255ea", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399586, "uuid": "04940ee4-c14c-4022-85a3-2ff827f56fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399586, "uuid": "2e464f7a-5c5d-46f5-be15-743ca2278861", "value": "708e575385318d39ac6aa5fd6a1f11e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4e1e90-ac4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676366955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366955, "uuid": "f6c157e3-7cbb-4c0c-a1e9-f7fb4454211c", "comment": "Malware payload (RedLineStealer)", "value": "7240978b7b2eee2a4e483730c3e15123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366955, "uuid": "e862019d-e48f-48b8-aecc-53e8697c526c", "comment": "Malware payload (RedLineStealer)", "value": "a1a365e1d4accfc96e00f71f23410d6a97770b107899559a1155f84138df42cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366955, "uuid": "1c07c4b9-5cc0-47fd-be42-791fd058b075", "comment": "Malware payload (RedLineStealer)", "value": "a1ae8380875517a0488e91facf2515c6d5f979cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676366955, "uuid": "b592e718-9ec9-4341-b9de-16df4813bb03", "comment": "Malware payload (RedLineStealer)", "value": "68ecfe90201576682e3c462a035c53b0ce72a144f7d2520f558ca7ff5c0a0d9f68aed6aa9d452bb5ab96bdecf47bd447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366955, "uuid": "49aa3aa2-ada5-4ee4-b0c9-1e130328b33e", "value": "T1FBF41207E7ED4631D6B567748CF702D30E367E90AA74839B270BAC2E0C32615EA35766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366955, "uuid": "8ee6c45f-d6da-4de9-9130-68cc1cb7b345", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366955, "uuid": "04eca46c-c218-4534-8db9-6ce4ff150c46", "value": "12288:pMrjy90QcXngsEEZg3X3iXoE2qq6r95FF4CtVSp8h5D4K1xa7FXC0Ry:+yCXnZdZY33E2/u2CHSY5kK1whXC0Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676366955, "uuid": "126138f4-5dd7-4e9c-8527-144f2452376d", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676366955, "uuid": "adb04f48-3f36-4fdd-a896-8cef35818e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676366955, "uuid": "63426613-ac9e-4cf1-aec2-08072904024b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec37d38-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403815, "uuid": "847fdef1-fd2b-4e09-a6c3-89d978d3c1a5", "comment": "Malware payload", "value": "897282e7bac560d11e57ed7217a777d9", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403815, "uuid": "0ff6841a-2f0b-43a8-9e45-c40b55a2cc56", "comment": "Malware payload", "value": "a1f5765e5de61704ab038787697deb3962d1adb316a9460fe86a8ebe3c13368f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403815, "uuid": "4d69e921-5d02-4eb2-b6e1-b37834c8b4af", "comment": "Malware payload", "value": "2d463696aaa78038e36131e22b24d8403f3e6b9d", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403815, "uuid": "64cbbb54-e98a-4146-87b3-78fb42d2f970", "comment": "Malware payload", "value": "0cf0f692f332b9acebe39cc4be89ad3a81dbf83298b47d21389deca078cf12f9ac35d16cdb4f425b13f2e304a81982da", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403815, "uuid": "54ff1bd1-f9cf-4705-a476-9249c2df369c", "value": "T17165BFFC75047DE62A6F576BCA96ACDC13B51B229A8BA4CD80A477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403815, "uuid": "6dac1f9e-e243-4d6f-8ada-4412ebaaf83e", "value": "24576:m0kGpUiCBpKMtPx34PJ2bvlE2H/W/NJgATPadGgxDpi+2MFnMrEv967LeUlNAEUv:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403815, "uuid": "ce1489f4-a9ee-447d-bfc2-2c50c1d0fb3d", "value": 1452782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403815, "uuid": "6cb4a914-dec9-4534-8260-7d655640eb5d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403815, "uuid": "9fc2c3fa-e62c-4a80-b8db-c3eac5e8061f", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.13271.31309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4602af3-acaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676410723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410723, "uuid": "cf535d35-320d-493d-bbb6-905312b723e0", "comment": "Malware payload (Amadey)", "value": "7426060b4ecee212f4b7c6fe9cc5b918", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410723, "uuid": "22ebb57f-4cff-4091-be4c-636086827a8a", "comment": "Malware payload (Amadey)", "value": "a277db122d9d03cc538031647692325d245c956c1c7959f51d0fc65e662179e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410723, "uuid": "4d30923c-4f70-473d-9778-fddb373cb6ef", "comment": "Malware payload (Amadey)", "value": "903a915c930241500d2596944d6e0bc24778c07d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676410723, "uuid": "d9df59f3-834a-4130-a7f5-f1627a18f927", "comment": "Malware payload (Amadey)", "value": "0ef3bad702a3898821f3a7aa33070bcbfd1e0adffda98730c4ca6af4f1749cd7235b3b485c47e48917f99de2d8be65e9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410723, "uuid": "b1da60ce-b602-4e0c-a6f1-a7880f694bbf", "value": "T116251247EFE89062D9B6077059F603C30A35BDA16F78878F674E9E092C72560E23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410723, "uuid": "f9cd7228-2ce2-4e42-b750-e288b43df1cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410723, "uuid": "ec3be7a0-3fc8-4d95-a3b7-0670d11a47fa", "value": "24576:gybetjP2PJAshcsAKm0MaE2ItuKkjb21pLBiv7eulURCFN:nbetDsJAPKm0EhtubYBiv7hUoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676410723, "uuid": "80b7948a-9dc9-4896-b622-8455a39b8de9", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676410723, "uuid": "bddddb15-84d1-449f-8651-dc9ed9c06161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676410723, "uuid": "956b3637-8080-4147-8749-3186f9b1a4de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54f5d6a-acbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676416281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416281, "uuid": "6d47ee6f-d22c-4fa4-b5f0-282ed0ad129e", "comment": "Malware payload (RustyStealer)", "value": "ff9e00ffe9dc9e721c73332785b4c553", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416281, "uuid": "9dadc024-2f99-472e-b76c-462741e1d706", "comment": "Malware payload (RustyStealer)", "value": "a3121fab9f7c1c304bfed15b404e718b0008705073bedb8ddd90dbd6f3b35f5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416281, "uuid": "ae8e5021-b45e-4d67-b7f0-2b9cc4d14609", "comment": "Malware payload (RustyStealer)", "value": "3fb1bf76a86b5177bd25714c2473676cf2d9eeb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676416281, "uuid": "08797479-ce1c-40c1-8dd5-eaabd831f3b8", "comment": "Malware payload (RustyStealer)", "value": "c8622e951fe0394ae78ff13c90152605507b2d69f37a46b23e5f8ffe60dcdfff605eb00d63a83420eb0b3083aa82d8ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416281, "uuid": "bed41f9c-a160-4179-9c63-b04507c84965", "value": "T125A6330F899E54FECBC70870D407A9A176F38E9685C80804FDFABA5E8C32FB55099756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416281, "uuid": "6b17f9c1-d243-4566-986d-31542d36ff60", "value": "881ebfb4b8b20e1f3b3657fb82622ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416281, "uuid": "d9e79111-9c83-49a4-9dc6-e0fcba3add33", "value": "196608:oqS/4h/rXqoSATFVtpGa8pVOWuNT+p2vIEJV4la4+55HCVwi2j/DIA:odQ/LqSFlGO+XEJV4la1FGw/Pp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676416281, "uuid": "bbcf4777-dcd6-4941-95a1-c3e7ac80d3b4", "value": 10149576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676416281, "uuid": "bbddf69c-a6a2-4a53-bdf0-d0b45c633bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676416281, "uuid": "c31cc417-01a7-4b6f-996c-2239c7b4d5ca", "value": "ff9e00ffe9dc9e721c73332785b4c553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218c02ac-ac61-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1676376869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376869, "uuid": "49c36b50-8e8f-4889-86e4-c83014ad163b", "comment": "Malware payload (IcedID)", "value": "c3e3cd8d4b637772580a9db31c2beb49", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376869, "uuid": "13491c6e-fb35-478a-8f7a-7d7af70397bc", "comment": "Malware payload (IcedID)", "value": "a40bfbcfe67cfe4b2db3f7b7254a28a54847f3a82ebeffafd6ad8456d2605075", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376869, "uuid": "2de8c299-0d2d-4d55-a98d-24105c2110ca", "comment": "Malware payload (IcedID)", "value": "156bc239b85b74799e96629b3a1b41f78c45164c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676376869, "uuid": "6d023475-d595-49c5-baee-b845aa4f5a20", "comment": "Malware payload (IcedID)", "value": "8412bbc6063c96930221a8d6ff8aec6ce1bcf14f66716592db7813e4015b80f73038c59d3f46b539e79998c40959d12d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376869, "uuid": "b19acb78-accf-4689-afb0-399c360589f6", "value": "T1E1C3D4343B4993EF41D6F6449B26F81D3F613E3E8919B2EAF7D25BCB468C854AC12520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376869, "uuid": "16aca619-4f3a-43ae-a698-eaea9dfd89a3", "value": "3072:roUimDiCnN8NNqFCya5VNcUqHqh0N1DV8:roU9pWqQ5VNcU/0jDV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676376869, "uuid": "f4aece60-8a1a-4257-aa23-7c145b1d2788", "value": 127550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676376869, "uuid": "e887f516-48e9-4fbb-9497-6a6d5ea1ce25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676376869, "uuid": "2d79b7dd-63b3-4851-b8b4-a8b2aef91db3", "value": "Setup_Win_13-02-2023_16-33-14.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38efafaa-ac45-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676364882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364882, "uuid": "a3a13489-b4c3-49bd-bb07-0fb069af0d0b", "comment": "Malware payload (SnakeKeylogger)", "value": "b815bcf8df9ce445efcb966b099e3b4a", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364882, "uuid": "3d3d881d-0ce9-4dbf-9985-95f1a2ff1ba2", "comment": "Malware payload (SnakeKeylogger)", "value": "a42fb903d71f12dd437ab0fc7c12390b150f20a0ab27846e208cdc330cb1607e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364882, "uuid": "6a5b6a28-7f9a-4a9b-9d25-463262cc5d22", "comment": "Malware payload (SnakeKeylogger)", "value": "94a78b2947b90a75c679bea46ffb6c5ec9a027c7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676364882, "uuid": "317ad23e-15f3-4a40-bbb1-79fe056b679c", "comment": "Malware payload (SnakeKeylogger)", "value": "733ac748636ce05ac04ad95ac95e79c5289b455a99048f6be46f7ad5674cf49a370a8d95c478ba30af64523223792e64", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364882, "uuid": "cdd6d205-cec2-45fb-9862-ecf11e8e8212", "value": "T1C76423A69C6268B60D68AEE1F36DCDF8D56F04A188808396BD146930F78DBDDFC0D354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364882, "uuid": "aaee14c6-3677-4ea9-b91a-c6a5b5f1364a", "value": "6144:3gCQV5aWe7JUvjQV4V2yxo3BviVWTLZx/YoO+yHb3gG24Eg:jQV5Imjy40yawVSLv/YR+yHb44Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676364882, "uuid": "058cbdb4-c850-4183-ba34-03a196c42a97", "value": 316321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676364882, "uuid": "b2f62c67-3a14-429d-96e0-f10cf80b5073", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676364882, "uuid": "52f723b2-d72a-41c7-bee3-89b5ece9bad1", "value": "57m\ufffd LPG SEMI TRAILER 7 NOS.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10605a9d-aca2-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1676404757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404757, "uuid": "6551e964-31eb-4dcc-9d52-748d765915f1", "comment": "Malware payload (QuasarRAT)", "value": "9c4a4fdc32202960df4bc6113fc605dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404757, "uuid": "c57e52b7-45b2-4eb8-8f3c-96380a3e87ff", "comment": "Malware payload (QuasarRAT)", "value": "a468152606ab1d34d46df8854edfb1a22d69db029de1174ea0fb8690356fc27d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404757, "uuid": "89630206-cf3e-4b34-8627-956a23a9537f", "comment": "Malware payload (QuasarRAT)", "value": "03c720fa45ce24420c4c1eaff4278bfc2533ba81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676404757, "uuid": "dc6328af-e735-4d42-92ed-d87c340b194b", "comment": "Malware payload (QuasarRAT)", "value": "04e8d8eb170f5e983e8956309118c29e1eef7354a653e4862d45e797a93f0991dd278313c2b4b70be30644c0d48a1b4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404757, "uuid": "9763b78f-ed6c-48d0-9221-8961bb9e3cad", "value": "T12B05231219BBC30AE8BC46738DE5EE94A552BC568911DC0FBC6C248F3FEB39145A4B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404757, "uuid": "2aea5b18-78fd-4139-8ef8-f5c6ae6a8048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404757, "uuid": "f5075db1-f858-443e-9bcd-f7649edcc578", "value": "24576:x2c+nZfbRY8VaO3VDT5TXfLD2FeIuvePjPF:x7SZTRY8Va8zwxp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676404757, "uuid": "e1075cd7-5183-4b30-8610-5b2ece1a4293", "value": 838656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676404757, "uuid": "cb8e749c-6c78-44d2-b296-9697eccad65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676404757, "uuid": "e07d1a2a-7666-477b-abec-d47b828fbd41", "value": "9c4a4fdc32202960df4bc6113fc605dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c358b8ee-ac83-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676391743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391743, "uuid": "186038be-0564-4e19-8c62-bed312992241", "comment": "Malware payload (RedLineStealer)", "value": "fb82c4087f33ef1500be09b2c64edd7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391743, "uuid": "10e1971e-8adc-4377-86fe-c39ace165d5c", "comment": "Malware payload (RedLineStealer)", "value": "a49071caacb938f2602eab78925d1cb38ce8fe180d3db37a91a58b49c912f265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391743, "uuid": "db8e1747-0b93-4b00-8ebc-5b4161104085", "comment": "Malware payload (RedLineStealer)", "value": "f3bc3a8bc794198f45c88e4e7f209301a7319247", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676391743, "uuid": "6fa972b8-27cd-46b1-8e7c-1cb018fd4ee0", "comment": "Malware payload (RedLineStealer)", "value": "fb4c7630b6885b8dae574096bfce405b8c3c8ece49453691425a628f67956aa9f1e46367a5f3c4ec6092730c3247cd67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391743, "uuid": "7b1fbe26-9b28-45b9-989e-94ab4ee4e315", "value": "T1DD54F1907DE3803EC11BC2B01421DAF5663F7871AB68855723941BAF6E302D39AEE752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391743, "uuid": "b35ce6dc-1e76-4d17-bffc-5a021ef8b598", "value": "17104dba2e0e802750207f94b99930de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391743, "uuid": "f768a05e-e55d-4470-a7a1-74b86463803a", "value": "6144:8/ILQiPCZhbbn7oPU/4OS31o8R1if8tnaDdzkEVV4Iy2k:8/InPCVbn7oP2sFoMuUnanVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676391743, "uuid": "9c8e7028-c924-4256-8c59-437b36bbacf3", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676391743, "uuid": "988d28ce-9997-462c-81ce-ea0c69bd2397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676391743, "uuid": "45dc3a1b-1cb5-4883-b765-65aadc817cbc", "value": "fb82c4087f33ef1500be09b2c64edd7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1e0d95-ac9f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676403567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403567, "uuid": "687908f7-5836-46dd-a6f4-fa045ada3eca", "comment": "Malware payload", "value": "34496986a36f5c1e9b81710de7e2994c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403567, "uuid": "c42dd1da-f8d7-4038-aaec-eca5dd6cd878", "comment": "Malware payload", "value": "a5269d9bf8827a5688f87ab7a7f687b7c7ba2cd6ac5d4c6b2b623fad7112da3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403567, "uuid": "69ee1141-9429-483d-a89b-ab65473479bb", "comment": "Malware payload", "value": "b48b9c5eefdbf2cd14c09d5cd8e7ee68a41f40f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403567, "uuid": "aa0506fe-b6b8-48e6-834c-fd0835b88beb", "comment": "Malware payload", "value": "03562eca072b9ce2840305bf48d39ddf92be64d80bc65819daa75e88e742fe7355d7dcf2b17db0f965566cb015c0ba0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403567, "uuid": "f3eeef2c-0a78-4b9e-bf67-327d7151e7e5", "value": "T1FCE44B081FA95F16E4DE13FAB43107E9D6B6D25ED847F70B264129E91FFA3C409422E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403567, "uuid": "c28c5724-2b78-4459-9c5e-3c25ffcf8ef2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403567, "uuid": "a291a024-6df1-41ad-9f79-440cb980459a", "value": "12288:G//V7EP8KrFNVgdlZnylaYUqrv1gkBad0CC/cZiXkGIx:G/yrpgdlZeUqr1aSCWcZiXkGIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403567, "uuid": "babe6e56-51b4-46c2-ac5d-3d74c7955f18", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403567, "uuid": "34090975-70f2-41dc-b37b-4e7834267598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403567, "uuid": "ed67cb86-2d0d-4a9f-bb2d-b773768304df", "value": "sample1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11f6a2f-ac92-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676398155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398155, "uuid": "5646be73-d04b-428a-a174-174c6777009c", "comment": "Malware payload (RedLineStealer)", "value": "14402713393f5ad7686fe89b8a95d927", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-shgzcheats", "colour": "#C40C5E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398155, "uuid": "49d93856-79ea-4ee0-ab71-e306b11a8385", "comment": "Malware payload (RedLineStealer)", "value": "a537c57344bf3b1040d31bf60901014386a6938ddfca7e0f2ff2461d100e6b94", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-shgzcheats", "colour": "#C40C5E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398155, "uuid": "3882756d-bc62-401b-8bab-911423955a10", "comment": "Malware payload (RedLineStealer)", "value": "75f0f89d859fd670b326befa6c184b0afaa92407", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-shgzcheats", "colour": "#C40C5E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676398155, "uuid": "b4173d06-f100-4845-9657-3f8ddd56876d", "comment": "Malware payload (RedLineStealer)", "value": "758bd2fba28d743624b1ef9fc7af8c9c31e109af0144ba8fe37b8b2aa0c1319e2fa617f5e71c930d6916754942013c0c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-shgzcheats", "colour": "#C40C5E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398155, "uuid": "1e98ef12-fec0-4ecc-9d55-5453f6c56322", "value": "T1F45633EA2B4DEF0D59509833D8F93F4258DC4A0F2114A0285BBBB0BFAA6847F561537D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398155, "uuid": "212ee919-dea4-487f-8ec5-e2849b526762", "value": "98304:ZDlfHtC0zusc89hrw/dRPhLhxrb/y1+CFHCSLjgnd4QsNIii9PwGaP:rHNc89sRZLhxrbK1djLJQsBiJwGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676398155, "uuid": "c39acaa1-7229-4cfb-b8cf-a366e81c6a72", "value": 5924478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676398155, "uuid": "e8bef3b2-7faa-42cd-8bc3-91384f036d16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676398155, "uuid": "2f16b367-dfe9-4a8d-ac56-15bea90aa82b", "value": "Kiddions_Mod_Menu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12210ed8-ac11-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676342483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342483, "uuid": "7852244b-0052-4612-969c-8dc747062cc9", "comment": "Malware payload (Smoke Loader)", "value": "eb13380e3d6f75792b5caf00f537e0f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342483, "uuid": "7e6c1fa2-d156-4003-8c4a-e5bba1aceeb2", "comment": "Malware payload (Smoke Loader)", "value": "a54ccf22f770a1e032d3951157cbf371a523988841422dfef6fe5ab0d5f4f2bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342483, "uuid": "ffb99a3f-92be-4611-ab07-ce93a11f2339", "comment": "Malware payload (Smoke Loader)", "value": "f83d6ceb87c08587411b7e176c3a5c274e01781d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676342483, "uuid": "397852cd-d124-4ac4-ad12-163186bfe2d7", "comment": "Malware payload (Smoke Loader)", "value": "01037e1d77e62a9e854c996f997a645c114a99a1d122033bc4055af87485477d544d76a4251ed1e0a5c92ea4ae8c6524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342483, "uuid": "5360d869-ed94-4e66-89fa-1b87f616095c", "value": "T1F914C012B3A0D471D8674A318D29C5F16A7FFC614B79AACB23949B3F1CB03C09976399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342483, "uuid": "4729f119-0d57-46ad-956f-b5f142b6c050", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342483, "uuid": "e8a0d3b9-d324-4feb-9249-58e05d29ab6f", "value": "3072:sJ0uwa5zvmULiU5mntmszIV/Ks+YnxxYMh5neGTTVcAFk:s97vvrStmsUVyI3zh5eGNcAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676342483, "uuid": "6baac378-6abb-4ef4-8536-d9959e900d5f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676342483, "uuid": "5ee78c23-d354-4382-8b94-9234fc280019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676342483, "uuid": "0e38d464-4462-4130-9dbc-fcfeca40a584", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c0234a-ac96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676399857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399857, "uuid": "a86a1753-9fc9-4586-abfd-abe90c394e16", "comment": "Malware payload (RedLineStealer)", "value": "c86956cd010a32dca39ad8690fb90d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399857, "uuid": "f0605d90-88c2-4938-ad95-cce5740ea94d", "comment": "Malware payload (RedLineStealer)", "value": "a5833d8b3e53a76b0eb15d89d26572fc5f27d74d13a0eac2ed340abcab5e8edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399857, "uuid": "7748d26a-b214-42dc-9eea-b3ae3d1b0322", "comment": "Malware payload (RedLineStealer)", "value": "7b349507c44e071e4cdb7cb64cb60bd4094d9b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399857, "uuid": "04cae4c4-8ef6-41b3-b84c-c51e85d72bf0", "comment": "Malware payload (RedLineStealer)", "value": "4502f6519fa5514db7405ca758d68f81a3ba248f5353530aae1aa7936819f9d2e92f491a92b138c44cb66cca475cfb49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399857, "uuid": "6390c86f-befc-4bd3-af25-1922259a61f5", "value": "T14EF41247E6E89426E87117B41CF703D31A377D116E78836B238BAC6919B31B5B131B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399857, "uuid": "cf54b3b8-618c-4673-9d8b-9a865b06ba0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399857, "uuid": "f47e9802-9341-49bd-8a59-ea6a78013621", "value": "12288:uMrty90wc38UccVYtWXoVIz72coWPnf2lIEU0+heoQvmvkqnSbEo:zyD+8aV7oE7ownf2lIE3MeUvLnSbEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676399857, "uuid": "86011f56-b423-4d33-9b02-f6e005e13ee8", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676399857, "uuid": "8b31bac2-8186-46d6-a342-b1553a2fe0bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676399857, "uuid": "80665214-9bd6-44f4-aa52-d619789e2af8", "value": "c86956cd010a32dca39ad8690fb90d82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929b1de6-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369328, "uuid": "60316343-d771-4720-9001-ecf93d57d747", "comment": "Malware payload (SnakeKeylogger)", "value": "d77e56941bb2677d3686d7e07b6c0cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369328, "uuid": "1a105846-6a31-42c3-8c8d-aeccfc2cdc3e", "comment": "Malware payload (SnakeKeylogger)", "value": "a5c26d42bb66fd537d2a68ca5e0aca1cf4f528f4c3b53b42cb483034cfd90e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369328, "uuid": "6cb67394-c49f-43df-bb4c-725675aa8205", "comment": "Malware payload (SnakeKeylogger)", "value": "379e2c1ef6f25a67bb48c45cd59852fcc67a54af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369328, "uuid": "e7b5f7b3-ca57-4e6e-985c-5f1f2df6a603", "comment": "Malware payload (SnakeKeylogger)", "value": "27f0fac3f51f6a4b917573aa116f31d12571eea28c20e102c9f8901271779cd75e8b65cb079988c3b2f4e4c2fb3c636d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369328, "uuid": "59c13a87-0d91-4140-aaeb-059517d0fa0e", "value": "T1AA44120C77E1C0EFEC82157225B60696EFA16E2556F8AB0F03448B5C3653B52EE2E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369328, "uuid": "7b415e4f-e3cd-46d0-99e5-08f6a6bfcc81", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369328, "uuid": "a4e8080a-2362-4fbd-aab4-fcbae0bc5b1e", "value": "6144:3Ya6zb9TLATmKK8Z6UN6gpA1c4ThzA120Drg2/KetO:3YBbBuP6lgAN0DF/Ke8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369328, "uuid": "f477fb48-8012-4515-bbe2-d4875c298c69", "value": 268312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369328, "uuid": "67c9b2a8-2859-4e6e-8299-35c4dc98268b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369328, "uuid": "e5e426b9-06bd-450e-977c-3142023bd7a0", "value": "Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8d69b0-ac76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mekotio)", "timestamp": 1676385876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385876, "uuid": "78e3f655-3a99-4434-84ed-f21e3009b90e", "comment": "Malware payload (Mekotio)", "value": "44eb698d862df59f6513dcd8cdcb05d5", "object_relation": "md5", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385876, "uuid": "bab68338-0448-4119-a3c0-6bb296d634dd", "comment": "Malware payload (Mekotio)", "value": "a625a995071c4c817e5d4ab86c40eec4c7f0858fc66e0aac31231f0e50f55c6b", "object_relation": "sha256", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385876, "uuid": "534b6702-85d3-4c52-a8cc-a61cd6eb1d20", "comment": "Malware payload (Mekotio)", "value": "64b4ca00db8d6d823084b7afa523b090be7e71d1", "object_relation": "sha1", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676385876, "uuid": "e3511099-4eaf-4fb1-981a-d8252fdbcf38", "comment": "Malware payload (Mekotio)", "value": "a536092b8c22d4821db08525a18b2a65f8d6ebf4825e3fc8c28f7ad922fec5f34371233ca85a56956fa6ee676152edcf", "object_relation": "sha3-384", "Tag": [ { "name": "Mekotio", "colour": "#6237B2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385876, "uuid": "626987b3-e17e-4c4c-990c-282a2920d43d", "value": "T1EE66337B40096F1B9FE4E5541AA6E3ACEAB20670B1F552A97310C2DD5E1873A80F07DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385876, "uuid": "903586b6-1eda-4f6b-b582-30737910a1a0", "value": "196608:fkCVvItfzdhHLV0Ig631EzPjxY1ETJtgzy:MCVvItLfFgo1YPFN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676385876, "uuid": "a8e1b490-d347-493f-a10c-5a1ffa4ede19", "value": 6762714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676385876, "uuid": "794d4d73-fd0a-4790-88c5-f63b75836ba0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676385876, "uuid": "0460bc0c-fd5a-44bb-afe9-ef9c8c1432f9", "value": "ID-FACT.1676385466.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850d5f62-acb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676413972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413972, "uuid": "c42ff632-0ff0-4796-8255-62646e64fd9a", "comment": "Malware payload (GCleaner)", "value": "33c8875befb0b247503b63f4391d438d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413972, "uuid": "057170d8-d467-4d50-bdc6-f9ce987024a6", "comment": "Malware payload (GCleaner)", "value": "a69d9e231fc5c5fc14c3bc1db719148a2371a31cf4a2d4fd766548994e575843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413972, "uuid": "72b65644-be4e-4e25-812d-b20d7db71479", "comment": "Malware payload (GCleaner)", "value": "9a3d3e2859da866f01e1c1932e3c2c25da7d594f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676413972, "uuid": "0846f1d6-86ed-4ea2-bb6f-3ba1c7df1f4e", "comment": "Malware payload (GCleaner)", "value": "0b0902e8aa448f9888234d4c5fc2f27aee14355b55e775638cef9c82f568cadf3f4639c2810e8a3f32ddee758b3f0069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413972, "uuid": "46135461-fdaa-42fd-b4ca-1ec322c0bef6", "value": "T178F5127D7505C4ADC280BEB4882AD4E7ACDA9EE3E9E0A56270CC7F3F917D1889719017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413972, "uuid": "d6ab66ad-810d-448d-aa2e-15d8ad6a5ad0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413972, "uuid": "ea615a37-bf8d-45ae-a9e5-f81e9c7f8623", "value": "49152:rdH9KYyg3ozHna/z4TwGjKUB7gnu7nlFmUft3ZrZQfu8vZU6ZxxGF99mD8xWxqLV:JHPozH4DGjfOuj/Wb262YDxCv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676413972, "uuid": "bca7ed52-addf-477b-a8cf-5f0779aea61b", "value": 3372883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676413972, "uuid": "19c1e594-5f1a-45ee-b70e-db05edb1b1eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676413972, "uuid": "ad8086c1-9098-414b-977a-85c146e05110", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8db76ed-ac7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676388800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388800, "uuid": "2eff99d6-b813-49a9-a95f-c1fc9d276283", "comment": "Malware payload (RedLineStealer)", "value": "1241b9329459b7f3fb97cbfc4991f15c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388800, "uuid": "fbc39566-d69e-486f-91c8-a214d1dfcf90", "comment": "Malware payload (RedLineStealer)", "value": "a70ec0c05dcf37af7b72ebf1d4e3308f7a6a90fd22ef2e4d1fdc5d2053ed14c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388800, "uuid": "6899121d-bac1-44af-a9c0-71234e6e10de", "comment": "Malware payload (RedLineStealer)", "value": "76d3665432574760703547bb0f9267c5c7f2f877", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676388800, "uuid": "b66767d5-a0db-4acb-a5c7-f39d0428bfe3", "comment": "Malware payload (RedLineStealer)", "value": "ab5d77c3111de28f79e376ea02f618796027fb477cb310f7662d67c8cdb9ac5eada11f6f797977a8d8949e134abb1e76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388800, "uuid": "9fcc27fa-5a7d-4804-a869-b73932cbfeb8", "value": "T152F41217EAECA032D5B557B019F103D31D367E705B3882AB278F985E48736A0A676337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388800, "uuid": "022e808d-9fbd-4355-87bb-796243b70925", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388800, "uuid": "37d0ce70-c673-47d0-a451-65e2dc6b388b", "value": "12288:FMrNy90X8fylBdcRoyT0R9o452sFz4/bGE2KNOihoMxUnaPKTYl:cy89Oqfq/yzKNOihoGpPcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676388800, "uuid": "58cf3770-fa72-4549-890d-489cb65d852d", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676388800, "uuid": "58e668eb-7976-4f93-8a4a-1ece050cadf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676388800, "uuid": "868e7861-b546-4dd1-a11e-4c11ddf3da5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03f5a50-aca8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676407683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407683, "uuid": "1272e5bf-8f46-47df-b82a-2cbf1655898c", "comment": "Malware payload (RedLineStealer)", "value": "ad56c0e70f2b868addd76490608fee5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407683, "uuid": "d06e4fc1-f474-43b0-8f05-9a7ae9f537ea", "comment": "Malware payload (RedLineStealer)", "value": "a73a1a0b55c18085c146c9b1fcbfb5e8e722302a97b7b1d33c37ed9a15d6e991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407683, "uuid": "4c4eddfc-8ab3-4e91-9688-1120260f7d8e", "comment": "Malware payload (RedLineStealer)", "value": "2003b329f24a539d89211866c8000a7098f3852c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676407683, "uuid": "18b1c623-e772-4842-9375-74c5207e0b00", "comment": "Malware payload (RedLineStealer)", "value": "7f9b71290fec4608ad3bb07e5f863033e614b055cb1eec15486bd9be614aac735ddaa7632e84498eac58e5c369768f39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407683, "uuid": "fcae557a-7de7-4856-aaff-38f3ca9ef34a", "value": "T1CFA40207EBEC4132D9B653702BFB42D31636BDA15934835B278E6C4618736E4A53173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407683, "uuid": "bb429f50-71a3-4f64-875d-1d4bb897ca68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407683, "uuid": "b8cc042e-3053-4538-9e38-4f8eeebb6fc4", "value": "6144:KYy+bnr+hp0yN90QErFPP6Cxfr8LnBD1Za4+Opbv1m4PaEUjsiJ18Dv4Th7+eFcN:MMrVy90JFqHbBTaLqvLBU3IAd1CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676407683, "uuid": "6a05a930-769a-466e-9652-90e6e0a006ef", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676407683, "uuid": "bd89f596-40ef-488f-a627-7bf1a6c49aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676407683, "uuid": "7968a9d5-f389-4980-8a82-c5066c422992", "value": "ad56c0e70f2b868addd76490608fee5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86de4600-ac4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676369308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369308, "uuid": "f314cc89-1e7a-40d4-82e4-0904696adbd0", "comment": "Malware payload (SnakeKeylogger)", "value": "31cfda9a37c6e51b5f03cb1e8d13ed69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369308, "uuid": "bcbac6d5-d9b4-41e2-a343-829e0741930a", "comment": "Malware payload (SnakeKeylogger)", "value": "a7ab29ab4ac8baeaf3291f50e904bc5456ab09db6cc356775dff05c24e5a577a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369308, "uuid": "18d2a8a1-79c4-423c-b82e-733511543b0c", "comment": "Malware payload (SnakeKeylogger)", "value": "c3752346cbc03a6318bd6679b13d680ac98d04ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676369308, "uuid": "76beb391-047b-45b3-9ab0-e1468a7d80fc", "comment": "Malware payload (SnakeKeylogger)", "value": "eeeacddcbc87fa51d0e559b4d55c5e2fd4b23a24bbe05d15d3758cec1743c9e881e65baa5946b0f3211bcc967882ea09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369308, "uuid": "483a4e52-9b57-4c32-8fb1-f90e033fef97", "value": "T1D7B412052368F356EBF90BF56CB0A1662379367FAD26D60E0C8A21ED0956F111601FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369308, "uuid": "2f532abc-28ef-46af-963e-16ca156a4716", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369308, "uuid": "668aa7a8-e0d7-4fca-affc-84836337809e", "value": "12288:kFFZ6wg+/0funIU+cqG0DMmYXJRwxkza2yfM:O6PU+7G05kRvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676369308, "uuid": "c743162a-49a2-4fe4-a417-d2ae3869a75c", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676369308, "uuid": "053851f1-b74b-412a-b7ed-55a8f73bd149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676369308, "uuid": "bef86f7b-d7aa-4cb3-ae94-aaaea3cbd5df", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68950532-acba-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676415213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415213, "uuid": "43313fab-0998-4919-bbe5-a8ed5e3e8b37", "comment": "Malware payload (RedLineStealer)", "value": "feec4210a48473bb9e3ccc044c96442d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415213, "uuid": "b3d4199c-7891-450d-9ebe-315892f8d6f0", "comment": "Malware payload (RedLineStealer)", "value": "a809d1cdeefbe89fbfd660e5543a089dae02650d39df97ea5871ceadb636145c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415213, "uuid": "aa7e891c-d478-4ed3-8ca2-f3839f8b67c5", "comment": "Malware payload (RedLineStealer)", "value": "c0b075061688e32b23a6beedc407c7ec8833ecdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676415213, "uuid": "d009d77b-a1cd-4a67-ac2e-239f19901d3c", "comment": "Malware payload (RedLineStealer)", "value": "db665743f988bbc6cea7a3b0d8e6c7762067d0fafc40531d370b2d0e7f4f95cc6ef95d6b2eae90cbf6d94746965c0f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415213, "uuid": "45957b84-3b21-42ca-b874-179e4b2f98c2", "value": "T1B7A4020BA7EC5036D9B557B058F703D71636BC616B384297238FAC8A1C72AA0B536737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415213, "uuid": "d81543fb-7d7d-481f-a928-07a6760daa9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415213, "uuid": "2d2c46d3-5372-4c38-be4a-03ee6cda9bf0", "value": "12288:pMrWy90Y0DmwiSVLYs1ECEdHF2Gxdb5Zk7w7hwrt:fyx0Sw1VLbElRZ6pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676415213, "uuid": "32ae508c-f146-4182-a824-c9fe232a8f1e", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676415213, "uuid": "a653e164-c4f1-4c23-996b-ae07a333aa2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676415213, "uuid": "db685db7-e70d-46c1-994c-23987204dfae", "value": "feec4210a48473bb9e3ccc044c96442d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341ad0ba-ac6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676382483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382483, "uuid": "72ab7970-61c7-42fb-a902-434b4dd8c7f4", "comment": "Malware payload (SnakeKeylogger)", "value": "47f4be0c6e0f951102c0fcddfb82b685", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382483, "uuid": "a2866adb-9d7e-4d06-8e8e-af4a61c1b9e6", "comment": "Malware payload (SnakeKeylogger)", "value": "a858e16102e74879e57ec752ee60fc5d0a909bf879affbbcd14077aa6df7b516", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382483, "uuid": "bd449119-aadf-450a-ba32-0b050e862e86", "comment": "Malware payload (SnakeKeylogger)", "value": "7dc95ce2f1ac88babbe753cfc95b65203f0e0a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676382483, "uuid": "3cacbf72-61f8-4565-993b-63fb48a06955", "comment": "Malware payload (SnakeKeylogger)", "value": "70fa699250e04e6317ff02190724dfc6e48dd85e2bf8d2593bc3ed4f4d2519e72aaafcce9c85582f846afdf86b1f9dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382483, "uuid": "8117f1dd-1859-4935-ba86-736db321025f", "value": "T1F4D4932AC9BA17E7C039F16182A54828F9ED8553331FCD5AADD317D60F80601AFCA5DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382483, "uuid": "c8f132c0-1e52-4a6d-a1fe-3473b61d1975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382483, "uuid": "ee74c7d6-f9f4-4509-a920-0bcc3e66d7ab", "value": "12288:7f3jXKQbOyemi1bFsOX6NTnrtOXA+/0C+OpwEBi/QoByJ3XPAr:7f3jOjsOX6NTnrtOXA+/0CfSEBpir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676382483, "uuid": "4edd058d-fd2c-4248-8366-68deae4ec8a5", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676382483, "uuid": "4e0499fe-7ad7-4e98-8a66-e3319fc519e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676382483, "uuid": "e1f99ccf-a242-425c-821b-8a097b1d7af0", "value": "PO2310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20acb365-ac3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676360546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360546, "uuid": "e6fa6636-7402-4519-a43f-027a51a90cf5", "comment": "Malware payload (SnakeKeylogger)", "value": "2b16120720223491db938b5b8ce55b04", "object_relation": "md5", "Tag": [ { "name": "B2z", "colour": "#FCCA4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360546, "uuid": "ee5c1add-af31-457b-9534-3ef133cbc448", "comment": "Malware payload (SnakeKeylogger)", "value": "a878dd08d62fe493f7d67d2866ab3fa01709bf15e058bfc91cc6dc20fa568831", "object_relation": "sha256", "Tag": [ { "name": "B2z", "colour": "#FCCA4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360546, "uuid": "ac291ff3-082d-4365-bd3a-c98df4a564e8", "comment": "Malware payload (SnakeKeylogger)", "value": "2167d355748a5a0270b0f472bde4df979b703021", "object_relation": "sha1", "Tag": [ { "name": "B2z", "colour": "#FCCA4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676360546, "uuid": "b1cebc6a-05d8-4709-8a52-f08740bddefc", "comment": "Malware payload (SnakeKeylogger)", "value": "f12b23fbbf80b86a69435e21d6c0abeac56992799bd53ad9e548477e58c89341d952aa0d08807289be21a7f516946468", "object_relation": "sha3-384", "Tag": [ { "name": "B2z", "colour": "#FCCA4B", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360546, "uuid": "1d7796b3-0d3a-452f-be24-6f25ae9bd90c", "value": "T1353423B00EF86E9B6DC464E10615C3B0465E0553DB3B9F1B133980E7DD42BA69EFB829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360546, "uuid": "bb011f5f-edaf-43fe-8af0-9115c0a39311", "value": "6144:HQfBCCAFADTxWdxSObhnkpbI94RswVFR/WvkTrU/lqK:ZA1WTXVkq9yVFRiWqlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676360546, "uuid": "a60dea22-13e7-4fd7-b8a6-62b14aa91276", "value": 253097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676360546, "uuid": "990c636f-fc44-49e5-a8c3-76eee010b615", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676360546, "uuid": "7feac84b-4749-4659-a97a-1ed69f626173", "value": "invoice .pdf.B2z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bed66c-ac70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676383291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383291, "uuid": "1da0e102-3c8c-4d77-ab88-fe88c3a0fe4c", "comment": "Malware payload (RedLineStealer)", "value": "9c70b082d4666be47ea23dd0a2d9155a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383291, "uuid": "ac5c9451-5939-48b2-b620-d2a7bfb98040", "comment": "Malware payload (RedLineStealer)", "value": "a95412203aa11eddf5f0cfd5540c392c624d074f69a282c625324e9a2f1512e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383291, "uuid": "e02ff78f-e167-4ade-954e-4e9940eabe54", "comment": "Malware payload (RedLineStealer)", "value": "daa5a75ffef96a58b25036be16f880c606aa79ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676383291, "uuid": "7f09f771-8e47-4c11-9182-a02c78980a78", "comment": "Malware payload (RedLineStealer)", "value": "ecbb22cb802c3944142fb1c43d84863b6b5d7ba6c40f7a726cd0b32154d0bfbd513f905b9f4134417439292c0b15f4c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383291, "uuid": "08ebe94c-2108-4d83-8f9c-b0470f59396f", "value": "T171F4121BBBFD8032EAB5937059F303C31A367D605630979B979E5D1A1C72260E2353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383291, "uuid": "3dfbdf45-6b79-47a6-8610-a80a4d0e6aa7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383291, "uuid": "b0c16da9-154c-4bd9-a138-3d316d9007ef", "value": "12288:PMrjy90BYtSDDr/g1nnHw/3xJ+7yA3Fx4orurZN1FO826GrqQDroq:QyU8nHwfxJ+7yA4oCNNPGrlDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676383291, "uuid": "10fff7d5-b46a-4d95-b760-e281836ae84f", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676383291, "uuid": "d7e7e49d-353a-4213-92bb-027501eb555c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676383291, "uuid": "3a70b73c-f55b-479e-aeae-bed682c4fee3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e1593c-ac9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676403126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403126, "uuid": "920d249b-ec5e-4861-9754-c21c6adeceae", "comment": "Malware payload (RedLineStealer)", "value": "f3fb4af445ecd758a85becc222c8a0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403126, "uuid": "bd711313-4ffb-400b-b354-aa9104733aea", "comment": "Malware payload (RedLineStealer)", "value": "a970c572a972d47352c5e233fd0ee1f7d7f32b3eb36f7964188f2c093f36bd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403126, "uuid": "63328269-a41e-4f8b-940a-654a6c588801", "comment": "Malware payload (RedLineStealer)", "value": "cdd63203e0cf840a6d0c9236d4b8ddd6026b3b51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676403126, "uuid": "5342d0e9-5958-42a8-85fb-b8203c8e2388", "comment": "Malware payload (RedLineStealer)", "value": "6746a7f418c903ba779f2d39de3a35eff66ca30f947971b3b912ba86bea690137b6591a0a8e94126ad677ecbd230fd5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403126, "uuid": "3232a74e-75ec-4f48-b14b-5285139a8129", "value": "T19654F12139E0F833C59B85708D60EAE16D6EBC624369C56B23D42BBE2E307D1577B706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403126, "uuid": "d482b795-79bf-4014-996b-493405bf66e1", "value": "0f63c9bece0dec2416e4457a684c0376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403126, "uuid": "012f2ba6-c9a2-4d82-859b-53cf010f9add", "value": "3072:fOPLzeInws5VQJkwfoP29hOZasyxC7Z2e4giWDX2TzoSnDztt7Xde8mZ:sLiInwo/wfoe0aH2+gio2TzoSnDRt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676403126, "uuid": "3472872f-f6c6-4228-8f2a-ca2f39bfb1b1", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676403126, "uuid": "1cae90e2-5402-4113-ba75-668bfa43c7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676403126, "uuid": "6597d11c-5a4a-403d-a4d1-d561738375e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6bf0bf-ac94-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676399004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399004, "uuid": "d01816b7-2265-4268-9a0c-11627b0e6215", "comment": "Malware payload (AgentTesla)", "value": "ce64f7cef876c36aa4cbced9f2a479ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399004, "uuid": "65d5a1bd-a9da-4949-ace1-dc9cb02e51e3", "comment": "Malware payload (AgentTesla)", "value": "a9ad1c8db51f9e20280bab4947b9d9b47572e7c634cca0e2b121f3e7966a976d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676399004, "uuid": "99465724-83a9-47e6-bbe3-8f4c5c8a8ad7", "comment": "Malware payload (AgentTesla)", "value": "23757c26d95a52e6ce8b391e4ba0f24787042d01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }